Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER2328.dir00\svchost.exe.mdmp 16325836412031112
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Сетевая активность:
Подключается к:
- '62.##.102.92':445
- '62.##.155.21':445
- '62.##.142.194':9988
- '62.#5.37.62':445
- '62.#5.62.45':445
- '62.##.214.141':445
- '62.##.145.27':445
- '62.#5.46.52':445
- '62.##.207.76':445
- '62.#5.213.0':9988
- '62.##.217.235':9988
- '62.##.78.185':9988
- '62.##.100.157':9988
- '62.##.126.33':9988
- '62.##.135.18':9988
- '62.##.207.132':9988
- '62.#5.24.30':9988
- '62.#5.36.2':9988
- '62.##.181.244':445
- '62.##.51.156':445
- '62.##.126.30':445
- '62.##.129.252':445
- '62.##.125.109':445
- '62.##.226.71':445
- '62.##.209.105':445
- '62.#5.24.30':445
- '62.##.105.203':445
- '62.##.192.167':445
- '62.##.33.112':445
- '62.##.126.33':445
- '62.##.66.102':445
- '62.##.155.91':445
- '62.##.235.89':445
- '62.#5.61.86':445
- '62.##.66.113':445
- '62.##.206.92':445
- '62.#5.86.10':445
- '62.##.80.190':9988
- '62.##.177.236':9988
- '62.##.25.237':9988
- '62.##.102.92':9988
- '62.##.129.252':9988
- '62.##.66.113':9988
- '62.##.230.77':9988
- '62.##.155.21':9988
- '62.##.66.102':9988
- '62.##.162.116':9988
- '62.#5.37.62':9988
- '62.##.207.76':9988
- '62.#5.62.45':9988
- '62.#5.82.43':9988
- '62.##.214.141':9988
- '62.##.209.105':9988
- '62.##.125.109':9988
- '62.#5.61.86':9988
- '62.##.81.179':9988
- '62.##.33.112':9988
- '62.##.105.203':9988
- '62.##.192.167':9988
- '62.##.126.30':9988
- '62.##.191.52':9988
- '62.##.206.92':9988
- '62.##.105.70':9988
- '62.#5.94.12':9988
- '62.##.104.82':9988
- '62.#5.53.12':9988
- '62.##.145.27':9988
- '62.##.125.78':9988
- '62.##.51.156':9988
- '62.#5.86.10':9988
- '62.##.235.89':9988
- '62.#5.1.36':9988
- '62.##.126.161':9988
- '62.##.226.71':9988
- '62.##.155.91':9988
- '62.#5.24.30':139
- '62.##.192.167':139
- '62.##.162.116':139
- '62.##.81.179':139
- '62.##.25.237':139
- '62.##.209.105':139
- '62.##.105.203':139
- '62.##.226.71':139
- '62.##.177.236':139
- '62.#5.86.10':139
- '62.##.126.30':139
- '62.##.206.92':139
- '62.#5.61.86':139
- '62.##.125.109':139
- '62.##.129.252':139
- '62.##.142.194':139
- '62.##.66.113':139
- '62.##.51.156':139
- '62.##.125.78':139
- '62.##.80.190':139
- '62.##.104.82':139
- '62.##.217.235':139
- '62.#5.36.2':139
- '62.#5.213.0':139
- '62.#5.1.36':139
- '62.##.135.18':139
- '62.##.126.161':139
- '62.##.207.132':139
- '62.##.191.52':139
- '62.#5.53.12':139
- '62.#5.82.43':139
- '62.#5.15.85':139
- '62.##.105.70':139
- '62.##.230.77':139
- '62.##.100.157':139
- '62.#5.94.12':139
- '62.##.78.185':139
- '62.##.33.112':139
- '62.##.191.52':445
- '62.##.217.235':445
- '62.##.230.77':445
- '62.#5.94.12':445
- '62.##.78.185':445
- '62.#5.36.2':445
- '62.##.80.190':445
- '62.##.105.70':445
- '62.##.100.157':445
- '62.##.142.194':445
- '62.##.25.237':445
- '62.##.162.116':445
- '62.##.177.236':445
- '62.##.81.179':445
- '62.#5.15.85':445
- '62.#5.53.12':445
- '62.##.125.78':445
- '62.#5.82.43':445
- '62.##.104.82':445
- '62.##.214.141':139
- '62.##.145.27':139
- '62.#5.46.52':139
- '62.##.207.76':139
- '62.##.181.244':139
- '62.##.235.89':139
- '62.##.126.33':139
- '62.##.66.102':139
- '62.##.155.91':139
- '62.##.126.161':445
- '62.##.135.18':445
- '62.#5.213.0':445
- '62.#5.1.36':445
- '62.##.207.132':445
- '62.##.102.92':139
- '62.##.155.21':139
- '62.#5.37.62':139
- '62.#5.62.45':139
