Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERa4a9.dir00\svchost.exe.mdmp 16325836412032056
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa4a9.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '59.##8.35.10':445
- '59.##8.61.18':445
- '59.##8.188.241':445
- '59.##8.241.209':445
- '59.##8.184.79':445
- '59.##8.176.149':445
- '59.##8.147.45':445
- '59.##8.120.224':445
- '59.##8.224.133':445
- '59.##8.35.10':9988
- '59.##8.224.133':9988
- '59.#98.3.34':9988
- '59.##8.241.209':9988
- '59.##8.222.79':9988
- '59.##8.223.92':9988
- '59.##8.68.65':9988
- '59.##8.114.222':9988
- '59.##8.154.115':9988
- '59.##8.139.92':445
- '59.##8.88.37':445
- '59.##8.89.242':445
- '59.##8.222.37':445
- '59.##8.134.61':445
- '59.##8.190.148':445
- '59.##8.167.207':445
- '59.#98.3.34':445
- '59.##8.225.111':445
- '59.##8.154.133':445
- '59.##8.89.219':445
- '59.##8.89.54':445
- '59.##8.181.164':445
- '59.##8.164.28':445
- '59.##8.222.79':445
- '59.##8.164.241':445
- '59.##8.24.230':445
- '59.##8.201.71':445
- '59.##8.54.148':445
- '59.##8.95.150':9988
- '59.##8.113.168':9988
- '59.##8.209.177':9988
- '59.##8.162.121':9988
- '59.##8.154.133':9988
- '59.##8.225.111':9988
- '59.##8.201.71':9988
- '59.##8.164.28':9988
- '59.##8.88.37':9988
- '59.##8.54.148':9988
- '59.##8.134.61':9988
- '59.##8.147.187':9988
- '59.##8.23.198':9988
- '59.##8.15.22':9988
- '59.##8.120.224':9988
- '59.##8.167.207':9988
- '59.##8.94.237':9988
- '59.##8.184.79':9988
- '59.##8.188.241':9988
- '59.##8.61.18':9988
- '59.##8.147.45':9988
- '59.##8.139.92':9988
- '59.##8.176.149':9988
- '59.##8.89.219':9988
- '59.#98.7.98':9988
- '59.##8.214.80':9988
- '59.##8.69.73':9988
- '59.##8.99.182':9988
- '59.##8.24.230':9988
- '59.##8.181.164':9988
- '59.##8.222.37':9988
- '59.##8.26.14':9988
- '59.##8.164.241':9988
- '59.##8.89.54':9988
- '59.##8.240.6':9988
- '59.##8.199.165':9988
- '59.##8.89.242':9988
- '59.##8.162.121':139
- '59.##8.154.133':139
- '59.##8.190.148':139
- '59.#98.3.34':139
- '59.##8.26.14':139
- '59.##8.212.254':139
- '59.##8.23.198':139
- '59.##8.29.214':139
- '59.##8.225.111':139
- '59.##8.54.148':139
- '59.##8.164.241':139
- '59.##8.222.79':139
- '59.##8.201.71':139
- '59.##8.24.230':139
- '59.##8.89.242':139
- '59.##8.134.61':139
- '59.##8.222.37':139
- '59.##8.88.37':139
- '59.##8.167.207':139
- '59.##8.147.187':139
- '59.##8.114.222':139
- '59.##8.94.237':139
- '59.##8.99.182':139
- '59.##8.223.92':139
- '59.##8.87.176':139
- '59.##8.214.80':139
- '59.##8.199.165':139
- '59.##8.16.116':139
- '59.##8.154.115':139
- '59.##8.95.150':139
- '59.##8.68.65':139
- '59.##8.209.177':139
- '59.##8.15.22':139
- '59.##8.240.6':139
- '59.#98.7.98':139
- '59.##8.113.168':139
- '59.##8.69.73':139
- '59.##8.69.73':445
- '59.##8.240.6':445
- '59.##8.15.22':445
- '59.##8.113.168':445
- '59.#98.7.98':445
- '59.##8.147.187':445
- '59.##8.114.222':445
- '59.##8.94.237':445
- '59.##8.99.182':445
- '59.##8.29.214':445
- '59.##8.26.14':445
- '59.##8.162.121':445
- '59.##8.212.254':445
- '59.##8.23.198':445
- '59.##8.154.115':445
- '59.##8.95.150':445
- '59.##8.68.65':445
- '59.##8.209.177':445
- '59.##8.223.92':445
- '59.##8.176.149':139
- '59.##8.147.45':139
- '59.##8.120.224':139
- '59.##8.224.133':139
- '59.##8.139.92':139
- '59.##8.89.219':139
- '59.##8.89.54':139
- '59.##8.181.164':139
- '59.##8.164.28':139
- '59.##8.16.116':445
- '59.##8.214.80':445
- '59.##8.87.176':445
- '59.##8.199.165':445
- '59.##8.188.241':139
- '59.##8.61.18':139
- '59.##8.184.79':139
- '59.##8.241.209':139
- '59.##8.35.10':139
