Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERbdda.dir00\svchost.exe.hdmp 16325836412029900
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERbdda.dir00\svchost.exe.mdmp 16325836412031972
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERbdda.dir00\svchost.exe.mdmp
- %TEMP%\WERbdda.dir00\svchost.exe.hdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '21#.#4.144.239':445
- '21#.#4.2.234':445
- '21#.#4.144.221':445
- '21#.#4.53.230':445
- '21#.#4.78.63':445
- '21#.#4.90.92':445
- '21#.#4.5.115':445
- '21#.#4.249.229':445
- '21#.#4.104.252':445
- '21#.#4.43.212':445
- '21#.#4.59.90':445
- '21#.#4.50.64':9988
- '21#.#4.165.51':445
- '21#.#4.66.171':445
- '21#.#4.252.253':445
- '21#.#4.92.71':445
- '21#.#4.35.253':445
- '21#.#4.159.84':445
- '21#.#4.37.177':445
- '21#.#4.47.127':445
- '21#.#4.144.28':445
- '21#.#4.252.174':445
- '21#.#4.53.104':445
- '21#.#4.78.153':445
- '21#.#4.79.93':445
- '21#.#4.50.64':445
- '21#.24.0.46':445
- '21#.#4.150.149':445
- '21#.#4.95.169':445
- '21#.24.9.39':445
- '21#.#4.135.154':445
- '21#.#4.224.190':445
- '21#.#4.183.250':445
- '21#.#4.163.244':445
- '21#.#4.39.130':139
- '21#.#4.187.95':139
- '21#.#4.44.184':139
- '21#.#4.192.17':139
- '21#.#4.108.238':139
- '21#.#4.203.81':139
- '21#.#4.112.202':139
- '21#.#4.52.109':139
- '21#.#4.197.189':139
- '21#.#4.32.150':139
- '21#.#4.210.206':445
- '21#.#4.226.59':445
- '21#.#4.226.59':139
- '21#.#4.163.224':139
- '21#.#4.223.197':139
- '21#.#4.210.206':139
- '21#.#4.14.244':139
- '21#.#4.40.231':139
- '21#.#4.100.180':139
- '21#.#4.183.206':139
- '21#.#4.206.228':139
- '21#.#4.25.74':139
- '21#.#4.93.102':9988
- '21#.#4.180.13':139
- '21#.#4.13.115':139
- '21#.#4.213.183':139
- '21#.#4.123.49':139
- '21#.#4.104.211':139
- '21#.#4.169.111':139
- '21#.#4.242.162':139
- '21#.#4.43.47':139
- '21#.#4.206.120':139
- '21#.#4.48.61':139
- '21#.#4.141.207':139
- '21#.#4.47.142':445
- '21#.#4.79.93':139
- '21#.#4.152.33':139
- '21#.#4.47.142':139
- '21#.#4.78.153':139
- '21#.#4.37.177':139
- '21#.#4.114.9':139
- '21#.24.5.61':139
- '21#.#4.252.174':139
- '21#.#4.95.169':139
- '21#.#4.224.190':139
- '21#.#4.249.229':139
- '21#.#4.90.92':139
- '21#.24.9.39':139
- '21#.#4.163.244':139
- '21#.#4.50.64':139
- '21#.#4.135.154':139
- '21#.#4.47.127':139
- '21#.#4.8.149':139
- '21#.#4.144.28':139
- '21#.#4.115.182':139
- '21#.#4.89.167':139
- '21#.#4.159.84':139
- '21#.#4.96.75':139
- '21#.#4.154.137':139
- '21#.#4.185.22':139
- '21#.#4.137.246':139
- '21#.#4.47.140':139
- '21#.#4.93.102':139
- '21#.#4.53.104':139
- '21#.#4.148.248':139
- '21#.#4.184.105':139
- '21#.#4.7.192':139
- '21#.#4.38.218':139
- '21#.#4.127.251':139
- '21#.#4.148.248':445
- '21#.#4.115.182':445
- '21#.#4.7.192':445
- '21#.#4.184.105':445
- '21#.#4.114.9':445
- '21#.#4.93.102':445
- '21#.#4.8.149':445
- '21#.#4.185.22':445
- '21#.#4.47.140':445
- '21#.24.5.61':445
- '21#.#4.89.167':445
- '21#.#4.96.75':445
- '21#.#4.154.137':445
- '21#.#4.137.246':445
- '21#.#4.38.218':445
- '21#.#4.152.33':445
- '21#.#4.127.251':445
- '21#.24.0.46':139
- '21#.#4.144.221':139
- '21#.#4.66.171':139
- '21#.#4.104.252':139
- '21#.#4.252.253':139
- '21#.#4.183.250':139
- '21#.#4.150.149':139
- '21#.#4.78.63':139
- '21#.#4.59.90':139
- '21#.#4.53.230':139
- '21#.#4.144.239':139
- '21#.#4.92.71':139
- '21#.#4.43.212':139
- '21#.#4.5.115':139
- '21#.#4.35.253':139
- '21#.#4.2.234':139
- '21#.#4.165.51':139
