Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERa7bf.dir00\svchost.exe.mdmp 16325836412033088
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %TEMP%\WERa7bf.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '21#.#51.81.193':445
- '21#.#51.81.72':445
- '21#.#51.30.110':445
- '21#.#51.161.179':445
- '21#.#51.38.115':445
- '21#.#51.161.243':445
- '21#.#51.202.245':445
- '21#.#51.50.183':445
- '21#.#51.43.197':445
- '21#.#51.242.178':445
- '21#.#51.113.180':445
- '21#.#51.197.47':445
- '21#.#51.66.23':445
- '21#.#51.71.114':445
- '21#.#51.240.83':445
- '21#.#51.8.44':445
- '21#.#51.243.64':445
- '21#.#51.241.127':445
- '21#.#51.205.70':445
- '21#.#51.141.249':445
- '21#.#51.214.37':445
- '21#.#51.185.199':445
- '21#.#51.133.202':445
- '21#.#51.22.3':445
- '21#.#51.239.75':445
- '21#.#51.132.43':445
- '21#.#51.18.163':445
- '21#.#51.65.63':445
- '21#.#51.122.206':445
- '21#.#51.176.167':445
- '21#.#51.167.227':445
- '21#.#51.162.206':445
- '21#.#51.171.211':445
- '21#.#51.139.104':445
- '21#.#51.132.43':9988
- '21#.#51.50.183':9988
- '21#.#51.38.115':9988
- '21#.#51.139.104':9988
- '21#.#51.18.163':9988
- '21#.#51.30.110':9988
- '21#.#51.176.167':9988
- '21#.#51.185.199':9988
- '21#.#51.92.69':9988
- '21#.#51.81.193':9988
- '21#.#51.113.180':9988
- '21#.#51.213.223':9988
- '21#.#51.167.227':9988
- '21#.#51.43.197':9988
- '21#.#51.65.63':9988
- '21#.#51.239.75':9988
- '21#.#51.8.44':9988
- '21#.#51.243.64':9988
- '21#.#51.102.119':9988
- '21#.#51.164.68':9988
- '21#.#51.238.221':9988
- '21#.#51.133.202':9988
- '21#.#51.4.38':445
- '21#.#51.202.245':9988
- '21#.#51.151.43':9988
- '21#.#51.56.105':9988
- '21#.#51.158.213':9988
- '21#.#51.242.178':9988
- '21#.#51.87.225':9988
- '21#.#51.141.249':9988
- '21#.#51.126.78':9988
- '21#.#51.205.70':9988
- '21#.#51.214.37':9988
- '21#.#51.214.37':139
- '21#.#51.241.127':139
- '21#.#51.167.227':139
- '21#.#51.141.249':139
- '21#.#51.239.75':139
- '21#.#51.185.199':139
- '21#.#51.205.70':139
- '21#.#51.22.3':139
- '21#.#51.122.206':139
- '21#.#51.132.43':139
- '21#.#51.243.64':139
- '21#.#51.65.63':139
- '21#.#51.171.211':139
- '21#.#51.176.167':139
- '21#.#51.162.206':139
- '21#.#51.18.163':139
- '21#.#51.133.202':139
- '21#.#51.161.184':139
- '21#.#51.171.221':139
- '21#.#51.87.225':139
- '21#.#51.56.105':139
- '21#.#51.151.43':139
- '21#.#51.238.221':139
- '21#.#51.102.119':139
- '21#.#51.164.68':139
- '21#.#51.126.78':139
- '21#.#51.103.100':139
- '21#.#51.158.213':139
- '21#.#51.213.223':139
- '21#.#51.92.69':139
- '21#.#51.95.40':139
- '21#.#51.186.132':139
- '21#.#51.3.22':139
- '21#.#51.161.243':139
- '21#.#51.161.184':445
- '21#.#51.171.221':445
- '21#.#51.87.225':445
- '21#.#51.56.105':445
- '21#.#51.151.43':445
- '21#.#51.238.221':445
- '21#.#51.164.68':445
- '21#.#51.102.119':445
- '21#.#51.126.78':445
- '21#.#51.103.100':445
- '21#.#51.158.213':445
- '21#.#51.213.223':445
- '21#.#51.92.69':445
- '21#.#51.95.40':445
- '21#.#51.186.132':445
- '21#.#51.3.22':445
- '21#.#51.4.38':139
- '21#.#51.161.179':139
- '21#.#51.81.193':139
- '21#.#51.71.114':139
- '21#.#51.30.110':139
- '21#.#51.50.183':139
- '21#.#51.38.115':139
- '21#.#51.81.72':139
- '21#.#51.202.245':139
- '21#.#51.43.197':139
- '21#.#51.197.47':139
- '21#.#51.113.180':139
- '21#.#51.139.104':139
- '21#.#51.66.23':139
- '21#.#51.8.44':139
- '21#.#51.242.178':139
- '21#.#51.240.83':139
