Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER6e90.dir00\svchost.exe.mdmp 16325836412030796
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %TEMP%\WER6e90.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '21#.#36.78.229':445
- '21#.#36.184.192':445
- '21#.#36.93.172':445
- '21#.#36.39.22':445
- '21#.#36.203.193':445
- '21#.#36.20.37':445
- '21#.#36.115.226':445
- '21#.#36.22.46':445
- '21#.#36.127.63':445
- '21#.#36.175.187':445
- '21#.#36.9.213':445
- '21#.#36.160.251':445
- '21#.#36.67.208':445
- '21#.#36.155.96':445
- '21#.#36.203.169':445
- '21#.#36.140.221':445
- '21#.#36.193.67':445
- '21#.#36.215.176':445
- '21#.#36.15.71':445
- '21#.#36.37.2':445
- '21#.#36.148.64':445
- '21#.#36.15.188':445
- '21#.#36.38.135':445
- '21#.#36.41.214':445
- '21#.#36.25.253':445
- '21#.#36.152.161':445
- '21#.#36.9.43':445
- '21#.#36.181.88':445
- '21#.#36.64.40':445
- '21#.#36.146.43':445
- '21#.#36.86.198':445
- '21#.#36.207.71':445
- '21#.#36.141.140':445
- '21#.#36.169.75':445
- '21#.#36.98.163':445
- '21#.#36.25.118':9988
- '21#.#36.52.72':9988
- '21#.#36.124.202':139
- '21#.#36.19.81':139
- '21#.#36.94.110':445
- '21#.#36.238.175':445
- '21#.#36.93.172':9988
- '21#.#36.93.28':445
- '21#.#36.12.206':139
- '21#.#36.180.150':139
- '21#.#36.124.219':139
- '21#.#36.151.217':139
- '21#.#36.216.221':139
- '21#.#36.154.147':139
- '21#.#36.126.222':445
- '21#.#36.144.191':139
- '21#.#36.39.25':139
- '21#.#36.16.10':445
- '21#.#36.96.253':445
- '21#.#36.176.129':445
- '21#.#36.237.140':445
- '21#.#36.0.204':445
- '21#.#36.146.25':445
- '21#.#36.65.132':445
- '21#.#36.192.131':445
- '21#.#36.22.33':445
- '21#.#36.255.36':445
- '21#.#36.171.124':445
- '21#.#36.65.80':445
- '21#.#36.29.248':445
- '21#.#36.43.142':445
- '21#.#36.87.160':445
- '21#.#36.69.231':445
- '21#.#36.52.72':445
- '21#.#36.200.192':445
- '21#.#36.237.243':445
- '21#.#36.237.140':139
- '21#.#36.241.183':139
- '21#.#36.203.193':139
- '21#.#36.15.188':139
- '21#.#36.0.204':139
- '21#.#36.187.159':139
- '21#.#36.96.253':139
- '21#.#36.153.184':139
- '21#.#36.115.226':139
- '21#.#36.39.22':139
- '21#.#36.200.192':139
- '21#.#36.140.221':139
- '21#.#36.176.129':139
- '21#.#36.148.64':139
- '21#.#36.37.2':139
- '21#.#36.127.63':139
- '21#.#36.52.72':139
- '21#.#36.146.25':139
- '21#.#36.29.248':139
- '21#.#36.206.202':139
- '21#.#36.202.71':139
- '21#.#36.41.214':139
- '21#.#36.184.192':139
- '21#.#36.207.71':139
- '21#.#36.38.135':139
- '21#.#36.98.103':139
- '21#.#36.15.71':139
- '21#.#36.78.229':139
- '21#.#36.9.43':139
- '21#.#36.67.208':139
- '21#.#36.175.187':139
- '21#.#36.87.160':139
- '21#.#36.25.253':139
- '21#.#36.141.140':139
- '21#.#36.65.132':139
- '21#.#36.64.40':139
- '21#.#36.181.88':139
- '21#.#36.86.198':139
- '21#.#36.65.80':139
- '21#.#36.238.175':139
- '21#.#36.169.75':139
- '21#.#36.98.163':139
- '21#.#36.25.118':139
- '21#.#36.20.37':139
- '21#.#36.98.103':445
- '21#.#36.153.184':445
- '21#.#36.206.202':445
- '21#.#36.241.183':445
- '21#.#36.93.28':139
- '21#.#36.146.43':139
- '21#.#36.202.71':445
- '21#.#36.25.118':445
- '21#.#36.94.110':139
- '21#.#36.9.213':139
- '21#.#36.22.46':139
- '21#.#36.203.169':139
- '21#.#36.93.172':139
- '21#.#36.193.67':139
- '21#.#36.255.36':139
- '21#.#36.22.33':139
- '21#.#36.160.251':139
- '21#.#36.215.176':139
- '21#.#36.171.124':139
- '21#.#36.69.231':139
- '21#.#36.43.142':139
- '21#.#36.16.10':139
- '21#.#36.155.96':139
- '21#.#36.152.161':139
- '21#.#36.192.131':139
- '21#.#36.237.243':139
