Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER47f3.dir00\svchost.exe.mdmp 16325836412029512
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %TEMP%\WER47f3.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '82.##.13.190':445
- '82.##.157.80':445
- '82.##.140.211':445
- '82.#5.95.69':445
- '82.#5.16.27':445
- '82.##.126.225':445
- '82.##.33.240':445
- '82.##.239.37':445
- '82.##.141.169':445
- '82.##.131.66':9988
- '82.##.53.239':9988
- '82.#5.91.35':9988
- '82.##.21.216':9988
- '82.#5.23.67':9988
- '82.#5.48.29':9988
- '82.##.150.85':445
- '82.##.243.90':9988
- '82.##.91.176':9988
- '82.##.123.232':445
- '82.##.198.250':445
- '82.##.190.89':445
- '82.#5.50.5':445
- '82.##.40.103':445
- '82.##.245.174':445
- '82.##.91.223':445
- '82.##.255.174':445
- '82.##.107.215':445
- '82.##.50.220':445
- '82.##.70.239':445
- '82.##.211.33':445
- '82.##.36.139':445
- '82.##.40.254':445
- '82.##.193.86':445
- '82.##.113.102':445
- '82.##.200.214':445
- '82.##.202.212':445
- '82.##.91.223':9988
- '82.#5.16.27':9988
- '82.##.255.174':9988
- '82.##.31.166':9988
- '82.##.140.211':9988
- '82.##.113.102':9988
- '82.##.131.100':9988
- '82.#5.95.69':9988
- '82.##.40.254':9988
- '82.##.190.89':9988
- '82.##.239.37':9988
- '82.##.157.80':9988
- '82.##.164.59':9988
- '82.#5.50.5':9988
- '82.##.245.174':9988
- '82.##.107.215':9988
- '82.##.70.239':9988
- '82.##.36.139':9988
- '82.##.123.232':9988
- '82.##.50.220':9988
- '82.##.74.250':9988
- '82.##.33.240':9988
- '82.##.211.33':9988
- '82.##.40.103':9988
- '82.##.248.48':9988
- '82.##.28.253':9988
- '82.##.114.90':9988
- '82.##.198.250':9988
- '82.##.200.214':9988
- '82.#5.73.18':9988
- '82.##.141.169':9988
- '82.##.153.115':9988
- '82.##.248.177':9988
- '82.#5.64.50':9988
- '82.##.150.85':9988
- '82.##.193.86':9988
- '82.##.202.212':9988
- '82.##.248.177':445
- '82.##.91.223':139
- '82.##.164.59':139
- '82.##.213.235':139
- '82.##.123.232':139
- '82.##.74.250':139
- '82.##.115.48':139
- '82.##.245.174':139
- '82.##.223.71':139
- '82.##.107.215':139
- '82.##.113.102':139
- '82.##.200.214':139
- '82.##.255.174':139
- '82.##.40.103':139
- '82.##.126.225':139
- '82.##.50.220':139
- '82.##.198.250':139
- '82.##.157.80':139
- '82.##.202.212':139
- '82.#5.2.31':139
- '82.##.31.166':139
- '82.#5.23.67':139
- '82.##.131.66':139
- '82.##.53.239':139
- '82.##.248.48':139
- '82.#5.73.18':139
- '82.##.114.90':139
- '82.##.243.90':139
- '82.##.153.115':139
- '82.##.248.177':139
- '82.#5.91.35':139
- '82.##.28.253':139
- '82.##.131.100':139
- '82.#5.48.29':139
- '82.#5.64.50':139
- '82.##.91.176':139
- '82.##.21.216':139
- '82.##.36.139':139
- '82.##.91.176':445
- '82.#5.48.29':445
- '82.##.243.90':445
- '82.##.21.216':445
- '82.#5.64.50':445
- '82.##.131.66':445
- '82.##.31.166':445
- '82.#5.2.31':445
- '82.#5.23.67':445
- '82.##.164.59':445
- '82.##.28.253':445
- '82.##.213.235':445
- '82.##.74.250':445
- '82.##.223.71':445
- '82.##.153.115':445
- '82.##.115.48':445
- '82.##.131.100':445
- '82.#5.91.35':445
- '82.##.70.239':139
- '82.#5.16.27':139
- '82.##.40.254':139
- '82.##.239.37':139
- '82.#5.50.5':139
- '82.##.13.190':139
- '82.##.190.89':139
- '82.#5.95.69':139
- '82.##.193.86':139
- '82.##.114.90':445
- '82.#5.73.18':445
- '82.##.248.48':445
- '82.##.53.239':445
- '82.##.33.240':139
- '82.##.150.85':139
- '82.##.141.169':139
- '82.##.140.211':139
- '82.##.211.33':139
