Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERe59e.dir00\svchost.exe.mdmp 16325836412029712
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %TEMP%\WERe59e.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '68.##5.220.239':445
- '68.##5.33.86':445
- '68.##5.137.216':445
- '68.##5.166.171':445
- '68.##5.248.111':445
- '68.##5.113.130':445
- '68.##5.168.130':445
- '68.##5.135.147':445
- '68.##5.248.84':445
- '68.##5.182.115':445
- '68.##5.132.59':445
- '68.##5.27.108':445
- '68.##5.44.10':9988
- '68.##5.163.82':445
- '68.##5.178.193':445
- '68.#05.1.65':445
- '68.##5.197.12':445
- '68.##5.92.27':445
- '68.##5.63.163':445
- '68.##5.145.128':445
- '68.##5.191.131':445
- '68.##5.83.139':445
- '68.##5.181.237':445
- '68.##5.135.26':445
- '68.#05.56.3':445
- '68.##5.130.27':445
- '68.##5.32.215':445
- '68.##5.62.64':445
- '68.##5.223.132':445
- '68.##5.103.211':445
- '68.##5.168.147':445
- '68.##5.59.170':445
- '68.##5.74.148':445
- '68.##5.90.231':445
- '68.##5.137.197':445
- '68.##5.253.159':445
- '68.##5.122.202':445
- '68.##5.226.22':445
- '68.##5.85.51':445
- '68.##5.166.171':9988
- '68.##5.65.33':9988
- '68.##5.145.128':9988
- '68.##5.59.170':9988
- '68.##5.137.197':9988
- '68.##5.181.237':9988
- '68.##5.83.139':9988
- '68.##5.77.128':9988
- '68.#05.1.65':9988
- '68.##5.33.86':9988
- '68.##5.27.108':9988
- '68.##5.168.147':9988
- '68.##5.226.22':9988
- '68.##5.5.198':9988
- '68.##5.132.59':9988
- '68.##5.248.111':9988
- '68.##5.239.248':9988
- '68.##5.182.115':9988
- '68.##5.74.148':9988
- '68.##5.203.206':9988
- '68.##5.253.159':9988
- '68.##5.113.130':9988
- '68.##5.139.55':9988
- '68.##5.163.82':9988
- '68.##5.85.51':9988
- '68.##5.181.195':9988
- '68.##5.231.185':9988
- '68.##5.222.180':9988
- '68.#05.10.4':9988
- '68.##5.224.135':9988
- '68.##5.191.131':9988
- '68.##5.78.95':9988
- '68.##5.135.26':9988
- '68.##5.32.215':9988
- '68.##5.130.27':9988
- '68.##5.168.130':9988
- '68.##5.180.201':9988
- '68.##5.2.249':9988
- '68.##5.98.165':9988
- '68.##5.135.26':139
- '68.##5.122.202':139
- '68.##5.222.180':139
- '68.##5.108.173':139
- '68.##5.77.128':139
- '68.##5.85.51':139
- '68.##5.139.55':139
- '68.##5.224.135':139
- '68.##5.170.230':139
- '68.#05.56.3':139
- '68.##5.223.132':139
- '68.##5.253.159':139
- '68.##5.145.128':139
- '68.##5.130.27':139
- '68.##5.137.197':139
- '68.##5.203.206':139
- '68.##5.27.108':139
- '68.##5.62.64':139
- '68.##5.32.215':139
- '68.##5.5.198':139
- '68.##5.113.130':139
- '68.##5.248.111':139
- '68.##5.163.82':139
- '68.##5.220.239':139
- '68.##5.182.115':139
- '68.##5.2.249':139
- '68.#05.10.4':139
- '68.##5.103.211':139
- '68.##5.248.84':139
- '68.##5.132.59':139
- '68.##5.135.147':139
- '68.##5.98.165':139
- '68.##5.98.149':139
- '68.##5.83.139':139
- '68.##5.178.193':139
- '68.##5.137.216':139
- '68.##5.78.95':139
- '68.##5.180.201':139
- '68.##5.164.163':139
- '68.##5.139.55':445
- '68.##5.5.198':445
- '68.##5.98.149':445
- '68.##5.98.165':445
- '68.##5.170.230':445
- '68.##5.44.10':139
- '68.##5.231.185':445
- '68.##5.224.135':445
- '68.##5.181.195':139
- '68.##5.180.201':445
- '68.##5.164.163':445
- '68.##5.78.95':445
- '68.##5.65.33':445
- '68.##5.203.206':445
- '68.##5.239.248':445
- '68.##5.2.249':445
- '68.##5.222.180':445
- '68.##5.77.128':445
- '68.##5.108.173':445
- '68.#05.10.4':445
- '68.##5.181.237':139
- '68.##5.65.33':139
- '68.##5.59.170':139
- '68.##5.74.148':139
- '68.##5.191.131':139
- '68.##5.239.248':139
- '68.##5.226.22':139
- '68.##5.168.130':139
- '68.##5.92.27':139
- '68.##5.197.12':139
- '68.##5.166.171':139
- '68.#05.1.65':139
- '68.##5.181.195':445
- '68.##5.44.10':445
- '68.##5.63.163':139
- '68.##5.33.86':139
- '68.##5.90.231':139
- '68.##5.231.185':139
- '68.##5.168.147':139
