Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER335a.dir00\svchost.exe.mdmp 16325836412032460
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER335a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '83.#28.52.6':445
- '83.##8.54.21':445
- '83.##8.229.230':9988
- '83.##8.64.129':445
- '83.##8.40.108':445
- '83.##8.207.225':445
- '83.##8.247.21':445
- '83.##8.161.224':445
- '83.##8.174.117':445
- '83.##8.169.204':9988
- '83.##8.188.148':9988
- '83.##8.158.55':9988
- '83.##8.85.115':9988
- '83.##8.54.219':9988
- '83.##8.24.188':9988
- '83.##8.137.101':9988
- '83.##8.32.162':9988
- '83.#28.7.52':9988
- '83.##8.222.95':445
- '83.##8.219.212':445
- '83.##8.226.169':445
- '83.##8.142.214':445
- '83.##8.201.251':445
- '83.##8.14.24':445
- '83.##8.205.81':445
- '83.##8.169.204':445
- '83.##8.32.162':445
- '83.##8.164.151':445
- '83.##8.236.72':445
- '83.##8.212.184':445
- '83.##8.202.218':445
- '83.##8.85.115':445
- '83.##8.189.207':445
- '83.##8.83.81':445
- '83.##8.219.14':445
- '83.##8.152.44':445
- '83.##8.252.54':445
- '83.##8.48.65':9988
- '83.##8.64.190':9988
- '83.##8.158.233':9988
- '83.##8.205.81':9988
- '83.##8.247.21':9988
- '83.##8.234.201':9988
- '83.##8.72.46':9988
- '83.##8.83.81':9988
- '83.##8.170.146':9988
- '83.##8.75.110':9988
- '83.##8.202.160':9988
- '83.##8.142.214':9988
- '83.##8.148.92':9988
- '83.##8.40.108':9988
- '83.##8.205.8':9988
- '83.##8.173.249':9988
- '83.##8.222.95':9988
- '83.##8.64.129':9988
- '83.##8.226.169':9988
- '83.##8.212.184':9988
- '83.##8.202.218':9988
- '83.##8.54.21':9988
- '83.##8.207.225':9988
- '83.##8.252.54':9988
- '83.##8.201.251':9988
- '83.##8.61.195':9988
- '83.##8.219.76':9988
- '83.##8.189.207':9988
- '83.##8.219.212':9988
- '83.##8.33.129':9988
- '83.##8.161.224':9988
- '83.##8.232.3':9988
- '83.##8.117.235':9988
- '83.##8.152.44':9988
- '83.##8.14.24':9988
- '83.##8.219.14':9988
- '83.##8.164.151':9988
- '83.##8.174.117':9988
- '83.##8.234.201':139
- '83.##8.64.190':139
- '83.##8.40.108':139
- '83.##8.14.24':139
- '83.##8.189.207':139
- '83.##8.85.115':139
- '83.##8.173.249':139
- '83.##8.169.204':139
- '83.##8.117.235':139
- '83.##8.32.162':139
- '83.##8.202.160':139
- '83.##8.202.218':139
- '83.##8.161.224':139
- '83.#28.7.52':139
- '83.##8.232.3':139
- '83.##8.226.169':139
- '83.##8.205.8':139
- '83.##8.236.72':139
- '83.##8.229.230':139
- '83.##8.48.65':139
- '83.##8.170.146':139
- '83.##8.247.21':139
- '83.##8.137.101':139
- '83.##8.158.55':139
- '83.##8.174.117':139
- '83.##8.64.129':139
- '83.##8.207.225':139
- '83.##8.52.143':139
- '83.##8.188.148':139
- '83.##8.61.195':139
- '83.##8.72.46':139
- '83.##8.252.54':139
- '83.##8.83.81':139
- '83.##8.212.184':139
- '83.##8.24.188':139
- '83.##8.33.129':139
- '83.##8.222.95':139
- '83.##8.54.21':139
- '83.##8.173.249':445
- '83.##8.188.148':445
- '83.##8.64.190':445
- '83.##8.205.8':445
- '83.##8.61.195':445
- '83.##8.24.188':445
- '83.##8.117.235':445
- '83.##8.229.230':445
- '83.##8.48.65':445
- '83.##8.232.3':445
- '83.##8.202.160':445
- '83.##8.75.110':445
- '83.##8.54.219':445
- '83.##8.219.76':445
- '83.##8.148.92':445
- '83.##8.234.201':445
- '83.##8.158.233':445
- '83.#28.7.52':445
- '83.##8.72.46':445
- '83.##8.219.76':139
- '83.##8.75.110':139
- '83.##8.219.14':139
- '83.##8.142.214':139
- '83.##8.54.219':139
- '83.##8.201.251':139
- '83.#28.52.6':139
- '83.##8.148.92':139
- '83.##8.158.233':139
- '83.##8.52.143':445
- '83.##8.33.129':445
- '83.##8.170.146':445
- '83.##8.137.101':445
- '83.##8.158.55':445
- '83.##8.219.212':139
- '83.##8.152.44':139
- '83.##8.205.81':139
- '83.##8.164.151':139
