Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER7d38.dir00\svchost.exe.mdmp 16325836412032468
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER7d38.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '21#.#93.219.120':9988
- '21#.#93.79.185':9988
- '21#.#93.110.182':9988
- '21#.#93.36.194':9988
- '21#.#93.82.205':9988
- '21#.#93.177.56':9988
- '21#.#93.91.129':9988
- '21#.#93.146.89':9988
- '21#.#93.65.179':9988
- '21#.#93.240.63':9988
- '21#.#93.63.5':9988
- '21#.#93.145.89':9988
- '21#.#93.221.160':9988
- '21#.#93.15.163':9988
- '21#.#93.180.155':9988
- '21#.#93.104.190':9988
- '21#.#93.147.228':9988
- '21#.#93.5.231':9988
- '21#.#93.252.253':9988
- '21#.#93.34.123':9988
- '21#.#93.90.48':9988
- '21#.#93.129.180':9988
- '21#.#93.29.123':9988
- '21#.#93.29.204':9988
- '21#.#93.198.155':9988
- '21#.#93.52.79':9988
- '21#.#93.160.105':9988
- '21#.#93.142.16':9988
- '21#.#93.138.42':9988
- '21#.#93.3.70':9988
- '21#.#93.132.148':9988
- '21#.#93.155.104':9988
- '21#.#93.166.112':9988
- '21#.#93.225.174':9988
- '21#.#93.142.82':9988
- '21#.#93.178.7':9988
- '21#.#93.12.44':9988
- '21#.#93.143.36':9988
- '21#.#93.38.53':9988
- '21#.#93.120.5':9988
- '21#.#93.225.82':9988
- '21#.#93.28.199':9988
- '21#.#93.234.127':9988
- '21#.#93.18.198':9988
- '21#.#93.87.54':9988
- '21#.#93.171.116':9988
- '21#.#93.3.140':9988
- '21#.#93.232.140':9988
- '21#.#93.70.227':9988
- '21#.#93.203.223':9988
- '21#.#93.6.35':9988
- '21#.#93.168.150':139
- '21#.#93.87.94':139
- '21#.#93.15.141':139
- '21#.#93.145.177':139
- '21#.#93.177.87':139
- '21#.#93.242.88':139
- '21#.#93.42.143':139
- '21#.#93.229.10':139
- '21#.#93.97.41':139
- '21#.#93.216.146':139
- '21#.#93.192.215':139
- '21#.#93.118.122':139
- '21#.#93.81.2':139
- '21#.#93.2.28':139
- '21#.#93.56.189':139
- '21#.#93.56.7':139
- '21#.#93.35.106':139
- '21#.#93.198.11':139
- '21#.#93.4.82':139
- '21#.#93.46.147':139
- '21#.#93.58.130':139
- '21#.#93.208.82':139
- '21#.#93.1.23':139
- '21#.#93.45.68':139
- '21#.#93.170.81':139
- '21#.#93.71.168':139
- '21#.#93.218.157':139
- '21#.#93.144.166':139
- '21#.#93.185.6':139
- '21#.#93.13.85':139
- '21#.#93.55.130':139
- '21#.#93.63.249':139
- '21#.#93.136.35':139
- '21#.#93.43.226':139
- '21#.#93.125.10':139
- '21#.#93.154.205':139
- '21#.#93.203.87':139
- '21#.#93.97.21':139
- '21#.#93.159.13':139
- '21#.#93.92.222':139
- '21#.#93.172.221':139
- '21#.#93.197.98':139
- '21#.#93.176.221':139
- '21#.#93.152.43':139
- '21#.#93.86.93':139
- '21#.#93.15.106':139
- '21#.#93.9.108':139
- '21#.#93.168.170':139
- '21#.#93.42.91':139
- '21#.#93.190.197':139
- '21#.#93.76.217':139
- '21#.#93.6.35':139
- '21#.#93.34.123':139
- '21#.#93.87.54':139
- '21#.#93.29.204':139
- '21#.#93.219.120':139
- '21#.#93.120.5':139
- '21#.#93.234.127':139
- '21#.#93.143.36':139
- '21#.#93.36.194':139
- '21#.#93.171.116':139
- '21#.#93.177.56':139
- '21#.#93.5.231':139
- '21#.#93.63.5':139
- '21#.#93.3.70':139
- '21#.#93.203.223':139
- '21#.#93.198.155':139
- '21#.#93.91.129':139
- '21#.#93.79.185':139
- '21#.#93.65.179':139
- '21#.#93.180.155':139
- '21#.#93.28.199':139
- '21#.#93.240.63':139
- '21#.#93.225.82':139
- '21#.#93.129.180':139
- '21#.#93.82.205':139
- '21#.#93.166.112':139
- '21#.#93.155.104':139
- '21#.#93.110.182':139
- '21#.#93.160.105':139
- '21#.#93.142.82':139
- '21#.#93.178.7':139
- '21#.#93.52.79':139
- '21#.#93.38.53':139
- '21#.#93.221.160':139
- '21#.#93.225.174':139
- '21#.#93.18.198':139
- '21#.#93.232.140':139
- '21#.#93.3.140':139
- '21#.#93.132.148':139
- '21#.#93.15.163':139
- '21#.#93.142.16':139
- '21#.#93.29.123':139
- '21#.#93.146.89':139
- '21#.#93.90.48':139
- '21#.#93.138.42':139
- '21#.#93.70.227':139
- '21#.#93.147.228':139
- '21#.#93.145.89':139
- '21#.#93.12.44':139
- '21#.#93.104.190':139
- '21#.#93.252.253':139
- '21#.#93.177.56':445
- '21#.#93.120.5':445
- '21#.#93.28.199':445
- '21#.#93.3.70':445
- '21#.#93.91.129':445
- '21#.#93.129.180':445
- '21#.#93.82.205':445
- '21#.#93.234.127':445
- '21#.#93.143.36':445
- '21#.#93.180.155':445
- '21#.#93.63.5':445
- '21#.#93.203.223':445
- '21#.#93.79.185':445
- '21#.#93.34.123':445
- '21#.#93.87.54':445
- '21#.#93.5.231':445
- '21#.#93.225.82':445
- '21#.#93.198.155':445
- '21#.#93.171.116':445
- '21#.#93.132.148':445
- '21#.#93.29.204':445
- '21#.#93.240.63':445
- '21#.#93.6.35':445
- '21#.#93.219.120':445
- '21#.#93.65.179':445
- '21#.#93.15.163':445
- '21#.#93.142.82':445
- '21#.#93.155.104':445
- '21#.#93.3.140':445
- '21#.#93.70.227':445
- '21#.#93.104.190':445
- '21#.#93.29.123':445
- '21#.#93.38.53':445
- '21#.#93.221.160':445
- '21#.#93.225.174':445
- '21#.#93.110.182':445
- '21#.#93.147.228':445
- '21#.#93.145.89':445
- '21#.#93.160.105':445
- '21#.#93.36.194':445
- '21#.#93.166.112':445
- '21#.#93.90.48':445
- '21#.#93.12.44':445
- '21#.#93.138.42':445
- '21#.#93.146.89':445
- '21#.#93.178.7':445
- '21#.#93.52.79':445
- '21#.#93.232.140':445
- '21#.#93.18.198':445
- '21#.#93.252.253':445
- '21#.#93.142.16':445
