Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER1393.dir00\svchost.exe.mdmp 16325836412031972
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '89.##.83.184':445
- '89.#5.1.29':445
- '89.##.141.103':445
- '89.##.81.244':445
- '89.##.171.120':445
- '89.##.21.243':445
- '89.#5.47.0':445
- '89.#5.45.36':445
- '89.#5.212.7':445
- '89.#5.33.33':139
- '89.##.155.14':139
- '89.#5.1.115':139
- '89.##.200.86':139
- '89.##.107.39':139
- '89.#5.51.59':445
- '89.##.143.143':445
- '89.#5.26.67':139
- '89.##.100.161':139
- '89.##.143.28':445
- '89.#5.73.18':445
- '89.##.193.239':445
- '89.##.164.247':445
- '89.##.166.161':445
- '89.##.111.96':445
- '89.#5.33.48':445
- '89.##.54.129':445
- '89.#5.30.54':445
- '89.#5.64.15':445
- '89.##.135.140':445
- '89.#5.52.46':445
- '89.##.114.83':445
- '89.##.251.118':445
- '89.##.22.151':445
- '89.##.190.248':445
- '89.##.117.110':445
- '89.##.31.226':445
- '89.##.21.243':139
- '89.#5.47.0':139
- '89.#5.45.36':139
- '89.#5.212.7':139
- '89.#5.52.46':139
- '89.##.135.140':139
- '89.##.251.118':139
- '89.##.114.83':139
- '89.#5.64.15':139
- '89.#5.51.59':139
- '89.##.143.143':139
- '89.##.124.225':445
- '89.##.58.242':445
- '89.##.141.103':139
- '89.#5.1.29':139
- '89.##.171.120':139
- '89.##.81.244':139
- '89.##.83.184':139
- '89.##.111.96':139
- '89.#5.33.48':139
- '89.##.54.129':139
- '89.#5.30.54':139
- '89.##.228.41':139
- '89.##.76.249':139
- '89.#5.36.93':139
- '89.#5.19.83':139
- '89.##.88.122':139
- '89.##.22.151':139
- '89.##.190.248':139
- '89.##.117.110':139
- '89.##.31.226':139
- '89.##.193.239':139
- '89.#5.73.18':139
- '89.##.166.161':139
- '89.##.164.247':139
- '89.##.143.28':139
- '89.##.228.41':445
- '89.#5.11.85':139
- '89.#5.39.35':139
- '89.##.84.174':139
- '89.##.230.182':139
- '89.#5.24.70':139
- '89.##.226.131':139
- '89.#5.62.92':139
- '89.#5.1.37':139
- '89.#5.78.54':139
- '89.##.63.121':139
- '89.##.86.196':139
- '89.##.24.132':139
- '89.#5.215.8':139
- '89.##.37.191':139
- '89.##.132.160':139
- '89.##.199.216':139
- '89.##.18.209':139
- '89.##.149.137':139
- '89.##.241.193':139
- '89.##.151.98':139
- '89.##.86.169':139
- '89.#5.19.87':139
- '89.##.45.151':139
- '89.##.137.52':139
- '89.##.161.137':139
- '89.##.234.44':139
- '89.##.52.234':139
- '89.##.52.106':139
- '89.##.71.223':139
- '89.##.62.130':139
- '89.##.224.172':139
- '89.##.195.76':139
- '89.##.114.114':139
- '89.##.169.95':139
- '89.##.78.123':139
- '89.##.135.97':139
- '89.##.124.49':139
- '89.##.102.177':139
- '89.#5.26.67':445
- '89.##.100.161':445
- '89.##.48.230':139
- '89.##.72.164':139
- '89.#5.20.96':139
- '89.##.149.20':139
- '89.##.155.149':139
- '89.##.76.249':445
- '89.#5.36.93':445
- '89.#5.19.83':445
- '89.##.88.122':445
- '89.#5.1.115':445
- '89.##.155.14':445
- '89.##.107.39':445
- '89.##.200.86':445
- '89.#5.33.33':445
- '89.##.74.214':445
- '89.#5.69.1':445
- '89.#5.20.96':445
- '89.#5.6.156':445
- '89.##.17.100':139
- '89.##.239.234':139
- '89.##.64.239':139
- '89.#5.50.17':139
- '89.#5.39.36':139
- '89.#5.69.1':139
- '89.##.124.49':445
- '89.#5.6.156':139
- '89.##.74.214':139
- '89.##.102.177':445
- '89.##.155.149':445
- '89.##.72.164':445
- '89.##.48.230':445
- '89.##.149.20':445
- '89.##.103.86':139
- '89.#5.111.4':139
- '89.##.80.141':139
- '89.##.88.233':139
- '89.##.130.170':139
- '89.##.224.191':445
- '89.##.213.128':445
- '89.##.66.161':139
- '89.#5.60.26':445
- '89.##.14.194':139
- '89.##.85.114':139
- '89.#5.21.14':139
- '89.##.94.193':139
- '89.#5.71.75':139
- '89.##.105.58':139
- '89.##.158.193':139
- '89.#5.54.68':139
- '89.##.226.211':139
- '89.##.101.157':445
- '89.##.156.232':445
- '89.##.35.179':445
- '89.#5.10.78':445
- '89.##.72.207':445
- '89.#5.90.96':445
- '89.#5.78.76':445
- '89.##.136.123':445
- '89.##.159.21':445
- '89.##.132.246':445
- '89.#5.79.4':445
- '89.##.43.202':445
- '89.##.117.38':445
- '89.##.129.79':445
- '89.#5.50.80':445
- '89.##.225.241':445
- '89.##.130.147':445
- '89.##.144.114':445
- '89.##.225.241':139
- '89.##.35.179':139
- '89.##.144.114':139
- '89.#5.50.80':139
- '89.#5.10.78':139
- '89.##.72.207':139
- '89.##.136.123':139
- '89.##.101.157':139
- '89.##.156.232':139
- '89.##.43.202':139
- '89.#5.60.26':139
- '89.##.224.191':139
- '89.##.213.128':139
- '89.##.117.38':139
- '89.##.129.79':139
- '89.##.130.147':139
- '89.##.132.246':139
- '89.#5.79.4':139
- '89.##.226.101':139
- '89.##.109.105':139
- '89.##.11.148':139
- '89.##.209.97':139
- '89.##.202.244':139
- '89.#5.97.2':139
- '89.##.99.168':139
- '89.##.236.19':139
- '89.#5.2.236':139
- '89.#5.78.76':139
- '89.##.157.64':139
- '89.##.159.21':139
- '89.#5.90.96':139
- '89.#5.8.197':139
- '89.#5.34.48':139
- '89.##.117.102':139
- '89.##.124.193':139
- '89.##.47.116':139
- '89.##.157.64':445
- '89.#5.10.78':9988
- '89.##.108.164':139
- '89.##.117.102':9988
- '89.##.35.179':9988
- '89.##.155.45':139
- '89.##.155.45':445
- '89.##.110.168':445
- '89.##.110.168':139
- '89.##.108.164':445
- '89.##.156.232':9988
- '89.##.225.241':9988
- '89.##.144.114':9988
- '89.##.72.207':9988
- '89.##.101.157':9988
- '89.##.124.193':9988
- '89.#5.90.96':9988
- '89.#5.50.80':9988
- '89.#5.8.197':9988
- '89.#5.41.93':445
- '89.##.13.167':445
- '89.##.58.242':139
- '89.##.249.62':445
- '89.##.97.248':445
- '89.##.190.31':445
- '89.##.233.204':445
- '89.#5.3.26':445
- '89.##.81.177':445
- '89.##.13.167':139
- '89.##.97.248':139
- '89.##.249.62':139
- '89.#5.41.93':139
- '89.#5.3.26':139
- '89.##.233.204':139
- '89.##.124.225':139
- '89.##.81.177':139
- '89.##.190.31':139
- '89.#5.2.236':445
- '89.#5.97.2':445
- '89.##.202.244':445
- '89.##.236.19':445
- '89.##.99.168':445
- '89.##.14.194':445
- '89.##.85.114':445
- '89.#5.21.14':445
- '89.##.94.193':445
- '89.##.47.116':445
- '89.#5.34.48':445
- '89.#5.8.197':445
- '89.##.124.193':445
- '89.##.117.102':445
- '89.##.226.101':445
- '89.##.109.105':445
- '89.##.11.148':445
- '89.##.209.97':445
- '89.##.43.202':9988
- '89.#5.60.26':9988
- '89.##.130.170':445
- '89.##.66.161':445
- '89.##.132.246':9988
- '89.#5.78.76':9988
- '89.##.157.64':9988
- '89.##.129.79':9988
- '89.#5.79.4':9988
- '89.##.105.58':445
- '89.##.226.211':445
- '89.#5.71.75':445
- '89.#5.54.68':445
- '89.##.158.193':445
- '89.##.103.86':445
- '89.#5.111.4':445
- '89.##.80.141':445
- '89.##.88.233':445
