Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WERcedc.dir00\svchost.exe.mdmp 16325836412032068
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
Сетевая активность:
Подключается к:
- '80.##3.30.67':139
- '80.##3.128.248':139
- '80.##3.185.30':139
- '80.##3.132.109':445
- '80.##3.91.237':139
- '80.##3.113.138':139
- '80.##3.194.44':139
- '80.##3.177.198':139
- '80.##3.96.33':139
- '80.##3.21.14':139
- '80.##3.29.78':139
- '80.##3.232.246':139
- '80.##3.49.57':445
- '80.##3.115.46':445
- '80.##3.222.110':445
- '80.##3.60.183':445
- '80.##3.183.199':445
- '80.##3.193.113':445
- '80.##3.86.88':139
- '80.##3.232.246':445
- '80.##3.86.88':445
- '80.##3.241.113':139
- '80.##3.113.250':139
- '80.##3.233.85':445
- '80.##3.107.56':445
- '80.##3.66.242':9988
- '80.##3.211.191':9988
- '80.##3.175.116':9988
- '80.##3.86.35':445
- '80.##3.57.191':445
- '80.##3.228.112':445
- '80.##3.49.58':445
- '80.##3.251.9':445
- '80.##3.119.224':445
- '80.##3.193.113':139
- '80.##3.158.71':139
- '80.##3.61.103':139
- '80.##3.24.88':139
- '80.##3.205.154':139
- '80.##3.202.154':139
- '80.##3.60.183':139
- '80.##3.115.46':139
- '80.##3.8.129':139
- '80.##3.222.110':139
- '80.##3.183.199':139
- '80.##3.49.57':139
- '80.##3.61.103':445
- '80.##3.11.117':139
- '80.##3.117.161':139
- '80.##3.41.109':139
- '80.##3.142.132':139
- '80.##3.63.147':139
- '80.##3.178.34':139
- '80.##3.163.249':139
- '80.##3.222.204':445
- '80.##3.208.182':139
- '80.##3.44.40':139
- '80.##3.82.223':139
- '80.##3.116.81':139
- '80.##3.31.15':139
- '80.##3.202.183':139
- '80.##3.81.128':139
- '80.##3.177.60':445
- '80.##3.210.44':445
- '80.##3.145.160':139
- '80.##3.230.200':139
- '80.##3.23.55':139
- '80.##3.94.107':139
- '80.##3.38.134':139
- '80.##3.179.169':139
- '80.##3.21.14':445
- '80.##3.29.78':445
- '80.##3.128.248':445
- '80.##3.185.30':445
- '80.##3.30.67':445
- '80.##3.194.44':445
- '80.##3.24.88':445
- '80.##3.158.71':445
- '80.##3.177.198':445
- '80.##3.202.154':445
- '80.##3.205.154':445
- '80.##3.91.237':445
- '80.##3.227.178':139
- '80.##3.197.113':139
- '80.##3.233.227':139
- '80.##3.222.204':139
- '80.##3.25.188':139
- '80.##3.34.112':139
- '80.##3.113.250':445
- '80.##3.241.113':445
- '80.##3.210.44':139
- '80.##3.177.60':139
- '80.##3.225.179':139
- '80.##3.112.196':445
- '80.##3.161.227':139
- '80.##3.174.214':139
- '80.##3.154.242':139
- '80.##3.120.106':139
- '80.##3.218.144':139
- '80.##3.133.76':139
- '80.##3.180.197':139
- '80.##3.250.83':139
- '80.##3.186.80':139
- '80.##3.193.158':139
- '80.#63.8.54':139
- '80.##3.206.161':139
- '80.##3.112.196':139
- '80.##3.42.137':139
- '80.##3.228.112':139
- '80.##3.49.58':139
- '80.##3.57.191':139
- '80.##3.235.217':139
- '80.##3.231.126':139
- '80.##3.214.79':139
- '80.##3.201.230':139
- '80.##3.175.116':139
- '80.##3.116.202':139
- '80.##3.180.7':139
- '80.##3.41.184':139
- '80.##3.205.40':139
- '80.##3.107.108':139
- '80.##3.200.10':139
- '80.##3.179.248':139
- '80.##3.18.145':139
- '80.##3.191.147':139
- '80.##3.211.191':139
- '80.##3.143.159':139
- '80.##3.216.169':139
- '80.##3.74.107':139
- '80.##3.93.133':139
- '80.##3.39.224':139
- '80.##3.177.181':139
- '80.##3.97.97':139
- '80.##3.15.229':139
- '80.##3.17.200':139
- '80.##3.44.140':139
- '80.##3.61.150':139
- '80.##3.66.242':139
- '80.##3.136.18':139
- '80.##3.16.105':139
- '80.##3.119.224':139
- '80.#63.8.54':445
- '80.##3.186.80':445
- '80.##3.193.158':445
- '80.##3.161.227':445
- '80.##3.133.76':445
- '80.##3.180.197':445
- '80.##3.177.181':445
- '80.##3.93.133':445
- '80.##3.15.229':445
- '80.##3.250.83':445
- '80.##3.97.97':445
- '80.##3.174.214':445
- '80.##3.116.202':445
- '80.##3.201.230':445
- '80.##3.175.116':445
- '80.##3.42.137':445
- '80.##3.235.217':445
- '80.##3.231.126':445
- '80.##3.218.144':445
- '80.##3.154.242':445
- '80.##3.120.106':445
- '80.##3.206.161':445
- '80.##3.214.79':445
- '80.##3.18.145':445
- '80.##3.143.159':445
- '80.##3.216.169':445
- '80.##3.41.184':445
- '80.##3.179.248':445
- '80.##3.211.191':445
- '80.##3.86.35':139
- '80.##3.251.9':139
- '80.##3.233.85':139
- '80.##3.191.147':445
- '80.##3.107.56':139
- '80.##3.180.7':445
- '80.##3.16.105':445
- '80.##3.66.242':445
- '80.##3.136.18':445
- '80.##3.39.224':445
- '80.##3.17.200':445
- '80.##3.44.140':445
- '80.##3.200.10':445
- '80.##3.205.40':445
- '80.##3.107.108':445
- '80.##3.61.150':445
- '80.##3.74.107':445
