Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER349d.dir00\svchost.exe.mdmp 16325836412032612
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER349d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#32.80.120':445
- '20#.#32.231.162':445
- '20#.#32.65.252':445
- '20#.#32.76.219':445
- '20#.#32.243.232':445
- '20#.#32.101.199':445
- '20#.#32.64.189':445
- '20#.#32.27.136':445
- '20#.#32.58.46':445
- '20#.#32.107.238':445
- '20#.#32.22.0':445
- '20#.#32.190.146':9988
- '20#.#32.64.46':9988
- '20#.#32.45.13':445
- '20#.#32.11.4':445
- '20#.#32.116.172':445
- '20#.#32.227.27':445
- '20#.#32.146.240':445
- '20#.#32.239.238':445
- '20#.#32.238.3':445
- '20#.#32.5.158':445
- '20#.#32.190.146':445
- '20#.#32.60.46':445
- '20#.#32.154.23':445
- '20#.#32.64.46':445
- '20#.#32.50.118':445
- '20#.#32.148.163':445
- '20#.#32.10.135':445
- '20#.#32.221.26':445
- '20#.#32.137.148':445
- '20#.#32.23.167':445
- '20#.#32.54.1':445
- '20#.#32.22.122':445
- '20#.#32.78.176':445
- '20#.#32.58.46':9988
- '20#.#32.50.15':139
- '20#.#32.234.68':139
- '20#.#32.36.115':139
- '20#.#32.230.247':139
- '20#.#32.123.139':139
- '20#.#32.167.242':139
- '20#.#32.13.31':139
- '20#.#32.31.195':139
- '20#.#32.11.20':139
- '20#.#32.162.19':445
- '20#.#32.162.19':139
- '20#.#32.16.76':139
- '20#.#32.174.192':139
- '20#.#32.190.40':139
- '20#.#32.90.19':139
- '20#.#32.126.34':139
- '20#.#32.148.245':139
- '20#.#32.238.3':9988
- '20#.#32.23.167':9988
- '20#.#32.78.176':9988
- '20#.#32.51.238':9988
- '20#.#32.60.46':9988
- '20#.#32.64.189':9988
- '20#.#32.10.135':9988
- '20#.#32.49.69':9988
- '20#.#32.137.148':9988
- '20#.#32.35.37':139
- '20#.#32.4.216':139
- '20#.#32.75.97':139
- '20#.#32.43.99':139
- '20#.#32.61.186':139
- '20#.#32.1.162':139
- '20#.#32.112.14':139
- '20#.#32.62.5':139
- '20#.#32.70.119':445
- '20#.#32.154.23':139
- '20#.#32.64.46':139
- '20#.#32.146.240':139
- '20#.#32.239.238':139
- '20#.#32.70.119':139
- '20#.#32.119.1':139
- '20#.#32.190.146':139
- '20#.#32.60.46':139
- '20#.#32.5.158':139
- '20#.#32.22.122':139
- '20#.#32.78.176':139
- '20#.#32.148.163':139
- '20#.#32.10.135':139
- '20#.#32.50.118':139
- '20#.#32.238.3':139
- '20#.#32.23.167':139
- '20#.#32.54.1':139
- '20#.#32.94.131':139
- '20#.#32.68.224':139
- '20#.#32.100.66':139
- '20#.#32.66.114':139
- '20#.#32.49.69':139
- '20#.#32.51.238':139
- '20#.#32.250.141':139
- '20#.#32.6.145':139
- '20#.#32.5.91':139
- '20#.#32.125.14':139
- '20#.#32.14.158':139
- '20#.#32.222.167':139
- '20#.#32.96.125':139
- '20#.#32.24.133':139
- '20#.#32.29.196':139
- '20#.#32.158.16':139
- '20#.#32.93.78':139
- '20#.#32.137.148':139
- '20#.#32.66.114':445
- '20#.#32.94.131':445
- '20#.#32.5.91':445
- '20#.#32.100.66':445
- '20#.#32.51.238':445
- '20#.#32.6.145':445
- '20#.#32.68.224':445
- '20#.#32.250.141':445
- '20#.#32.29.196':445
- '20#.#32.96.125':445
- '20#.#32.125.14':445
- '20#.#32.119.1':445
- '20#.#32.222.167':445
- '20#.#32.93.78':445
- '20#.#32.24.133':445
- '20#.#32.14.158':445
- '20#.#32.158.16':445
- '20#.#32.231.162':139
- '20#.#32.64.189':139
- '20#.#32.76.219':139
- '20#.#32.80.120':139
- '20#.#32.101.199':139
- '20#.#32.221.26':139
- '20#.#32.27.136':139
- '20#.#32.243.232':139
- '20#.#32.65.252':139
- '20#.#32.22.0':139
- '20#.#32.116.172':139
- '20#.#32.49.69':445
- '20#.#32.107.238':139
- '20#.#32.11.4':139
- '20#.#32.58.46':139
- '20#.#32.227.27':139
- '20#.#32.45.13':139
