Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa07e.dir00\svchost.exe.mdmp 16325836412032396
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa07e.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#23.49.148':445
- '20#.#23.126.152':445
- '20#.#23.34.229':445
- '20#.#23.172.112':445
- '20#.#23.152.92':445
- '20#.#23.24.207':445
- '20#.#23.187.194':445
- '20#.#23.250.105':445
- '20#.#23.62.109':445
- '20#.#23.85.149':9988
- '20#.#23.46.214':9988
- '20#.#23.155.121':9988
- '20#.#23.190.167':9988
- '20#.#23.95.190':9988
- '20#.#23.210.172':445
- '20#.#23.154.126':445
- '20#.#23.123.63':9988
- '20#.#23.79.44':445
- '20#.#23.211.110':445
- '20#.#23.160.208':445
- '20#.#23.25.1':445
- '20#.#23.212.162':445
- '20#.#23.84.80':445
- '20#.#23.199.226':445
- '20#.#23.247.151':445
- '20#.#23.29.160':445
- '20#.#23.250.97':445
- '20#.#23.186.117':445
- '20#.#23.187.123':445
- '20#.#23.105.150':445
- '20#.#23.127.146':445
- '20#.#23.160.238':445
- '20#.#23.123.193':445
- '20#.#23.72.139':445
- '20#.#23.123.63':445
- '20#.#23.52.181':445
- '20#.#23.127.146':9988
- '20#.#23.105.150':9988
- '20#.#23.115.27':9988
- '20#.#23.199.226':9988
- '20#.#23.72.139':9988
- '20#.#23.24.207':9988
- '20#.#23.172.112':9988
- '20#.#23.187.123':9988
- '20#.#23.96.96':9988
- '20#.#23.49.148':9988
- '20#.#23.187.194':9988
- '20#.#23.79.44':9988
- '20#.#23.34.229':9988
- '20#.#23.211.110':9988
- '20#.#23.154.126':9988
- '20#.#23.52.181':9988
- '20#.#23.126.152':9988
- '20#.#23.152.92':9988
- '20#.#23.49.62':9988
- '20#.#23.123.193':9988
- '20#.#23.29.160':9988
- '20#.#23.250.97':9988
- '20#.#23.30.26':9988
- '20#.#23.9.70':9988
- '20#.#23.84.80':9988
- '20#.#23.27.92':9988
- '20#.#23.36.234':9988
- '20#.#23.212.162':9988
- '20#.#23.186.117':9988
- '20#.#23.160.208':9988
- '20#.#23.247.151':9988
- '20#.#23.141.179':9988
- '20#.#23.79.88':9988
- '20#.#23.51.228':9988
- '20#.#23.160.238':9988
- '20#.#23.62.109':9988
- '20#.#23.29.160':139
- '20#.#23.250.97':139
- '20#.#23.160.208':139
- '20#.#23.84.80':139
- '20#.#23.199.226':139
- '20#.#23.53.231':139
- '20#.#23.49.62':139
- '20#.#23.247.151':139
- '20#.#23.96.96':139
- '20#.#23.123.63':139
- '20#.#23.52.181':139
- '20#.#23.160.238':139
- '20#.#23.187.123':139
- '20#.#23.123.193':139
- '20#.#23.25.1':139
- '20#.#23.211.110':139
- '20#.#23.72.139':139
- '20#.#23.212.162':139
- '20#.#23.9.70':139
- '20#.#23.102.212':139
- '20#.#23.36.234':139
- '20#.#23.141.179':139
- '20#.#23.155.121':139
- '20#.#23.121.156':139
- '20#.#23.8.42':139
- '20#.#23.30.26':139
- '20#.#23.46.214':139
- '20#.#23.115.27':139
- '20#.#23.27.92':139
- '20#.#23.70.43':139
- '20#.#23.79.88':139
- '20#.#23.51.228':139
- '20#.#23.85.149':139
- '20#.#23.15.194':139
- '20#.#23.95.190':139
- '20#.#23.190.167':139
- '20#.#23.15.194':445
- '20#.#23.155.121':445
- '20#.#23.190.167':445
- '20#.#23.85.149':445
- '20#.#23.36.234':445
- '20#.#23.9.70':445
- '20#.#23.141.179':445
- '20#.#23.121.156':445
- '20#.#23.102.212':445
- '20#.#23.49.62':445
- '20#.#23.70.43':445
- '20#.#23.96.96':445
- '20#.#23.53.231':445
- '20#.#23.79.88':445
- '20#.#23.51.228':445
- '20#.#23.95.190':445
- '20#.#23.115.27':445
- '20#.#23.27.92':445
- '20#.#23.172.112':139
- '20#.#23.250.105':139
- '20#.#23.62.109':139
- '20#.#23.210.172':139
- '20#.#23.24.207':139
- '20#.#23.127.146':139
- '20#.#23.186.117':139
- '20#.#23.187.194':139
- '20#.#23.105.150':139
- '20#.#23.46.214':445
- '20#.#23.79.44':139
- '20#.#23.30.26':445
- '20#.#23.8.42':445
- '20#.#23.49.148':139
- '20#.#23.152.92':139
- '20#.#23.34.229':139
- '20#.#23.154.126':139
- '20#.#23.126.152':139
