Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER3ff3.dir00\svchost.exe.mdmp 16325836412030616
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER3ff3.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '62.##1.65.73':9988
- '62.##1.34.138':9988
- '62.##1.67.38':9988
- '62.##1.111.116':9988
- '62.##1.65.158':9988
- '62.##1.208.243':9988
- '62.##1.113.247':9988
- '62.##1.98.250':9988
- '62.##1.99.50':9988
- '62.##1.132.182':9988
- '62.##1.212.199':139
- '62.##1.26.224':139
- '62.##1.140.68':139
- '62.##1.174.144':139
- '62.##1.130.218':139
- '62.##1.114.184':9988
- '62.#21.3.46':9988
- '62.##1.17.53':9988
- '62.##1.224.83':139
- '62.##1.83.160':139
- '62.##1.112.68':445
- '62.##1.124.47':445
- '62.##1.184.171':445
- '62.##1.80.25':445
- '62.##1.116.114':445
- '62.##1.203.86':445
- '62.##1.51.218':445
- '62.##1.38.223':445
- '62.##1.83.226':445
- '62.##1.67.38':445
- '62.##1.92.133':445
- '62.##1.114.184':445
- '62.##1.197.165':445
- '62.##1.17.53':445
- '62.##1.9.145':445
- '62.##1.65.158':445
- '62.##1.155.246':445
- '62.##1.190.155':445
- '62.##1.111.116':445
- '62.##1.28.95':445
- '62.##1.62.96':139
- '62.##1.186.38':139
- '62.##1.164.251':139
- '62.##1.30.153':139
- '62.##1.212.239':139
- '62.##1.240.161':139
- '62.##1.86.180':139
- '62.##1.221.40':139
- '62.##1.81.103':139
- '62.##1.78.130':139
- '62.##1.100.12':139
- '62.##1.74.85':445
- '62.##1.74.108':445
- '62.##1.140.68':445
- '62.##1.86.180':445
- '62.##1.130.218':445
- '62.##1.57.250':139
- '62.##1.231.217':139
- '62.##1.45.226':139
- '62.##1.44.157':139
- '62.##1.166.165':139
- '62.##1.54.117':139
- '62.#21.5.60':139
- '62.##1.131.98':139
- '62.##1.113.239':139
- '62.##1.202.56':139
- '62.##1.42.63':139
- '62.##1.53.43':139
- '62.##1.132.53':139
- '62.##1.117.16':139
- '62.##1.99.239':139
- '62.##1.66.33':139
- '62.##1.56.74':139
- '62.##1.244.177':139
- '62.##1.71.75':139
- '62.##1.10.227':139
- '62.##1.93.113':139
- '62.##1.98.174':139
- '62.##1.120.130':139
- '62.##1.236.56':139
- '62.##1.108.157':139
- '62.#21.5.10':445
- '62.##1.104.204':139
- '62.##1.113.247':139
- '62.##1.39.42':139
- '62.##1.51.218':139
- '62.#21.3.46':139
- '62.##1.199.26':139
- '62.##1.131.31':139
- '62.##1.91.185':139
- '62.##1.65.73':139
- '62.##1.197.41':139
- '62.##1.92.133':139
- '62.##1.67.38':139
- '62.##1.65.158':139
- '62.##1.112.68':139
- '62.##1.124.47':139
- '62.#21.5.10':139
- '62.##1.177.77':139
- '62.##1.83.226':139
- '62.##1.38.223':139
- '62.##1.203.86':139
- '62.##1.98.250':139
- '62.##1.208.243':139
- '62.##1.132.182':139
- '62.##1.248.213':139
- '62.##1.148.231':139
- '62.##1.148.188':139
- '62.##1.52.101':139
- '62.##1.4.137':139
- '62.##1.99.50':139
- '62.##1.39.87':139
- '62.##1.80.203':139
- '62.##1.232.42':139
- '62.##1.26.93':139
- '62.##1.14.26':139
- '62.##1.39.145':139
- '62.##1.57.11':139
- '62.##1.212.104':139
- '62.##1.183.58':139
- '62.##1.34.138':139
- '62.##1.72.197':139
- '62.##1.155.246':139
- '62.##1.80.203':445
- '62.##1.183.58':445
- '62.##1.26.93':445
- '62.##1.14.26':445
- '62.##1.39.145':445
- '62.##1.148.188':445
- '62.##1.132.182':445
- '62.##1.57.11':445
- '62.##1.232.42':445
- '62.##1.34.138':445
- '62.##1.39.42':445
- '62.##1.104.204':445
- '62.##1.113.247':445
- '62.##1.177.77':445
- '62.#21.3.46':445
- '62.##1.199.26':445
- '62.##1.131.31':445
- '62.##1.91.185':445
- '62.##1.65.73':445
- '62.##1.197.41':445
- '62.##1.197.165':139
- '62.##1.111.116':139
- '62.##1.17.53':139
- '62.##1.28.95':139
- '62.##1.80.25':139
- '62.##1.9.145':139
- '62.##1.184.171':139
- '62.##1.190.155':139
- '62.##1.116.114':139
- '62.##1.114.184':139
- '62.##1.212.104':445
- '62.##1.52.101':445
- '62.##1.248.213':445
- '62.##1.72.197':445
- '62.##1.99.50':445
- '62.##1.4.137':445
- '62.##1.208.243':445
- '62.##1.148.231':445
- '62.##1.39.87':445
- '62.##1.98.250':445
