Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
- %WINDIR%\Tasks\SCHEDLGU.TXT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERa207.dir00\svchost.exe.mdmp 16325836412033088
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa207.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '88.##7.161.16':445
- '88.##7.3.241':445
- '88.##7.165.0':445
- '88.##7.126.43':445
- '88.##7.214.3':445
- '88.##7.10.100':445
- '88.##7.219.30':445
- '88.##7.220.209':445
- '88.##7.37.119':445
- '88.##7.116.112':9988
- '88.##7.17.160':9988
- '88.##7.5.215':9988
- '88.##7.215.97':9988
- '88.##7.144.232':9988
- '88.##7.46.126':9988
- '88.##7.204.107':9988
- '88.##7.84.153':9988
- '88.##7.220.209':9988
- '88.##7.116.112':445
- '88.##7.116.7':445
- '88.##7.243.138':445
- '88.##7.193.164':445
- '88.##7.5.215':445
- '88.##7.126.207':445
- '88.##7.86.198':445
- '88.##7.216.163':445
- '88.##7.40.200':445
- '88.##7.67.71':445
- '88.##7.150.149':445
- '88.##7.88.189':445
- '88.##7.108.108':445
- '88.##7.138.181':445
- '88.##7.172.250':445
- '88.##7.32.117':445
- '88.##7.215.97':445
- '88.##7.52.194':445
- '88.##7.4.138':445
- '88.##7.223.214':139
- '88.##7.223.42':139
- '88.##7.186.207':139
- '88.##7.77.102':139
- '88.##7.122.63':139
- '88.##7.51.115':139
- '88.##7.142.5':139
- '88.##7.105.5':139
- '88.##7.90.162':139
- '88.##7.70.61':139
- '88.##7.33.254':139
- '88.##7.32.150':139
- '88.##7.64.168':139
- '88.##7.52.112':139
- '88.##7.148.85':139
- '88.##7.131.186':139
- '88.##7.58.249':139
- '88.##7.40.222':139
- '88.#37.5.61':139
- '88.##7.10.100':9988
- '88.##7.107.97':9988
- '88.##7.191.246':139
- '88.##7.103.246':9988
- '88.##7.149.58':9988
- '88.##7.161.79':9988
- '88.##7.244.107':9988
- '88.##7.243.138':9988
- '88.##7.222.218':9988
- '88.##7.28.163':139
- '88.##7.163.144':139
- '88.##7.154.11':139
- '88.##7.134.168':139
- '88.##7.17.172':139
- '88.##7.193.82':139
- '88.##7.184.6':139
- '88.##7.40.111':139
- '88.##7.193.82':445
- '88.##7.5.215':139
- '88.##7.67.71':139
- '88.##7.86.198':139
- '88.##7.40.200':139
- '88.##7.161.79':139
- '88.##7.222.218':139
- '88.##7.22.30':139
- '88.##7.216.163':139
- '88.##7.92.138':139
- '88.##7.4.138':139
- '88.##7.52.194':139
- '88.##7.138.181':139
- '88.##7.32.117':139
- '88.##7.193.164':139
- '88.##7.243.138':139
- '88.##7.126.207':139
- '88.##7.215.97':139
- '88.##7.116.7':139
- '88.##7.204.107':139
- '88.##7.103.246':139
- '88.##7.243.107':139
- '88.##7.17.160':139
- '88.##7.126.71':139
- '88.##7.107.97':139
- '88.##7.149.58':139
- '88.##7.123.211':139
- '88.##7.84.153':139
- '88.##7.107.243':139
- '88.##7.144.232':139
- '88.##7.46.126':139
- '88.##7.12.247':139
- '88.##7.43.116':139
- '88.##7.25.92':139
- '88.##7.174.52':139
- '88.##7.30.99':139
- '88.##7.244.107':139
- '88.##7.138.47':139
- '88.##7.144.232':445
- '88.##7.126.71':445
- '88.##7.25.92':445
- '88.##7.174.52':445
- '88.##7.244.107':445
- '88.##7.103.246':445
- '88.##7.84.153':445
- '88.##7.138.47':445
- '88.##7.17.160':445
- '88.##7.222.218':445
- '88.##7.22.30':445
- '88.##7.92.138':445
- '88.##7.161.79':445
- '88.##7.12.247':445
- '88.##7.46.126':445
- '88.##7.43.116':445
- '88.##7.204.107':445
- '88.##7.30.99':445
- '88.##7.149.58':445
- '88.##7.116.112':139
- '88.##7.161.16':139
- '88.##7.37.119':139
- '88.##7.219.30':139
- '88.##7.10.100':139
- '88.##7.150.149':139
- '88.##7.172.250':139
- '88.##7.108.108':139
- '88.##7.88.189':139
- '88.##7.107.97':445
- '88.##7.107.243':445
- '88.##7.243.107':445
- '88.##7.123.211':445
- '88.##7.126.43':139
- '88.##7.220.209':139
- '88.##7.214.3':139
- '88.##7.165.0':139
- '88.##7.3.241':139
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
