Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERde8d.dir00\svchost.exe.mdmp 16325836412032820
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %TEMP%\WERde8d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '22#.#4.145.144':445
- '22#.#4.131.127':445
- '22#.#4.75.182':445
- '22#.#4.243.144':445
- '22#.#4.127.116':445
- '22#.#4.34.53':445
- '22#.#4.29.124':445
- '22#.#4.3.173':445
- '22#.#4.221.100':445
- '22#.#4.147.237':9988
- '22#.#4.182.51':9988
- '22#.#4.168.61':9988
- '22#.#4.67.24':9988
- '22#.#4.227.137':9988
- '22#.#4.19.194':445
- '22#.#4.238.248':445
- '22#.#4.118.163':9988
- '22#.#4.239.25':9988
- '22#.#4.103.168':445
- '22#.#4.66.16':445
- '22#.#4.2.120':445
- '22#.#4.187.106':445
- '22#.#4.59.40':445
- '22#.#4.67.24':445
- '22#.#4.145.79':445
- '22#.#4.190.167':445
- '22#.#4.79.183':445
- '22#.#4.100.189':445
- '22#.#4.168.61':445
- '22#.#4.175.99':445
- '22#.74.88.4':445
- '22#.#4.189.90':445
- '22#.#4.81.159':445
- '22#.#4.75.154':445
- '22#.#4.180.243':445
- '22#.#4.85.74':445
- '22#.#4.75.182':9988
- '22#.#4.85.74':9988
- '22#.#4.69.64':9988
- '22#.#4.204.21':9988
- '22#.#4.59.40':9988
- '22#.#4.238.248':9988
- '22#.#4.175.99':9988
- '22#.#4.131.127':9988
- '22#.#4.66.16':9988
- '22#.#4.191.21':9988
- '22#.#4.81.159':9988
- '22#.#4.3.173':9988
- '22#.#4.180.243':9988
- '22#.#4.79.183':9988
- '22#.#4.87.220':9988
- '22#.#4.187.188':9988
- '22#.#4.71.35':9988
- '22#.#4.58.129':9988
- '22#.#4.189.205':9988
- '22#.#4.217.179':9988
- '22#.74.88.4':9988
- '22#.#4.29.124':9988
- '22#.#4.234.92':9988
- '22#.#4.189.90':9988
- '22#.#4.75.154':9988
- '22#.#4.118.52':9988
- '22#.#4.119.71':9988
- '22#.#4.34.53':9988
- '22#.#4.44.21':9988
- '22#.#4.19.194':9988
- '22#.#4.103.168':9988
- '22#.#4.187.106':9988
- '22#.#4.225.118':9988
- '22#.#4.190.167':9988
- '22#.#4.2.120':9988
- '22#.#4.89.146':9988
- '22#.#4.139.213':445
- '22#.#4.67.24':139
- '22#.#4.79.183':139
- '22#.#4.59.40':139
- '22#.#4.190.167':139
- '22#.#4.145.79':139
- '22#.#4.239.25':139
- '22#.#4.189.205':139
- '22#.#4.191.21':139
- '22#.#4.139.213':139
- '22#.#4.85.74':139
- '22#.#4.81.159':139
- '22#.#4.168.61':139
- '22#.#4.180.243':139
- '22#.#4.75.154':139
- '22#.#4.103.168':139
- '22#.#4.66.16':139
- '22#.#4.2.120':139
- '22#.#4.187.106':139
- '22#.#4.187.188':139
- '22#.#4.234.92':139
- '22#.#4.89.146':139
- '22#.#4.147.237':139
- '22#.#4.227.137':139
- '22#.#4.204.21':139
- '22#.#4.69.64':139
- '22#.#4.87.220':139
- '22#.#4.182.51':139
- '22#.#4.118.52':139
- '22#.#4.119.71':139
- '22#.#4.44.21':139
- '22#.#4.225.118':139
- '22#.#4.71.35':139
- '22#.#4.251.22':139
- '22#.#4.217.179':139
- '22#.#4.58.129':139
- '22#.#4.118.163':139
- '22#.#4.89.146':445
- '22#.#4.217.179':445
- '22#.#4.118.163':445
- '22#.#4.251.22':445
- '22#.#4.147.237':445
- '22#.#4.227.137':445
- '22#.#4.182.51':445
- '22#.#4.187.188':445
- '22#.#4.234.92':445
- '22#.#4.189.205':445
- '22#.#4.225.118':445
- '22#.#4.239.25':445
- '22#.#4.191.21':445
- '22#.#4.44.21':445
- '22#.#4.71.35':445
- '22#.#4.58.129':445
- '22#.#4.118.52':445
- '22#.#4.119.71':445
- '22#.#4.221.100':139
- '22#.#4.34.53':139
- '22#.#4.127.116':139
- '22#.#4.3.173':139
- '22#.#4.29.124':139
- '22#.#4.100.189':139
- '22#.#4.189.90':139
- '22#.74.88.4':139
- '22#.#4.175.99':139
- '22#.#4.204.21':445
- '22#.#4.19.194':139
- '22#.#4.87.220':445
- '22#.#4.69.64':445
- '22#.#4.238.248':139
- '22#.#4.145.144':139
- '22#.#4.131.127':139
- '22#.#4.75.182':139
- '22#.#4.243.144':139
