Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd3cc.dir00\svchost.exe.mdmp 16325836412032248
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERd3cc.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '12#.#88.200.188':445
- '12#.#88.188.126':445
- '12#.#88.21.151':445
- '12#.#88.77.12':445
- '12#.#88.126.97':445
- '12#.#88.94.45':445
- '12#.#88.228.240':445
- '12#.#88.97.39':445
- '12#.#88.1.236':445
- '12#.#88.1.236':9988
- '12#.#88.144.249':9988
- '12#.#88.103.219':9988
- '12#.#88.57.250':9988
- '12#.#88.66.71':9988
- '12#.#88.125.75':445
- '12#.#88.9.53':445
- '12#.#88.96.193':9988
- '12#.#88.116.76':445
- '12#.#88.72.79':445
- '12#.#88.66.71':445
- '12#.#88.145.158':445
- '12#.#88.82.150':445
- '12#.#88.131.94':445
- '12#.#88.206.163':445
- '12#.#88.136.253':445
- '12#.#88.111.1':445
- '12#.#88.20.80':445
- '12#.#88.175.230':445
- '12#.#88.144.249':445
- '12#.#88.241.66':445
- '12#.#88.49.250':445
- '12#.#88.199.76':445
- '12#.#88.155.62':445
- '12#.#88.164.44':445
- '12#.#88.130.204':445
- '12#.#88.172.205':445
- '12#.#88.188.126':9988
- '12#.#88.131.94':9988
- '12#.#88.21.151':9988
- '12#.#88.228.240':9988
- '12#.#88.126.97':9988
- '12#.#88.136.253':9988
- '12#.#88.199.76':9988
- '12#.#88.241.66':9988
- '12#.#88.130.204':9988
- '12#.#88.116.76':9988
- '12#.#88.94.45':9988
- '12#.#88.125.75':9988
- '12#.#88.9.53':9988
- '12#.#88.77.12':9988
- '12#.#88.200.188':9988
- '12#.#88.82.150':9988
- '12#.#88.172.205':9988
- '12#.#88.97.39':9988
- '12#.#88.5.64':9988
- '12#.#88.52.152':9988
- '12#.#88.17.153':9988
- '12#.#88.158.208':9988
- '12#.#88.64.69':9988
- '12#.#88.50.79':9988
- '12#.#88.70.5':9988
- '12#.#88.93.121':9988
- '12#.#88.191.93':9988
- '12#.#88.111.1':9988
- '12#.#88.155.62':9988
- '12#.#88.175.230':9988
- '12#.#88.145.158':9988
- '12#.#88.164.44':9988
- '12#.#88.211.6':9988
- '12#.#88.31.50':9988
- '12#.#88.206.163':9988
- '12#.#88.181.5':9988
- '12#.#88.111.1':139
- '12#.#88.20.80':139
- '12#.#88.66.71':139
- '12#.#88.131.94':139
- '12#.#88.206.163':139
- '12#.#88.211.6':139
- '12#.#88.17.153':139
- '12#.#88.136.253':139
- '12#.#88.158.208':139
- '12#.#88.130.204':139
- '12#.#88.172.205':139
- '12#.#88.144.249':139
- '12#.#88.199.76':139
- '12#.#88.155.62':139
- '12#.#88.82.150':139
- '12#.#88.72.79':139
- '12#.#88.164.44':139
- '12#.#88.145.158':139
- '12#.#88.52.152':139
- '12#.#88.83.21':139
- '12#.#88.191.93':139
- '12#.#88.57.250':139
- '12#.#88.64.69':139
- '12#.#88.103.219':139
- '12#.#88.93.121':139
- '12#.#88.253.58':139
- '12#.#88.70.5':139
- '12#.#88.181.5':139
- '12#.#88.176.253':139
- '12#.#88.31.50':139
- '12#.#88.212.98':139
- '12#.#88.96.193':139
- '12#.#88.5.64':139
- '12#.#88.50.79':139
- '12#.#88.115.40':139
- '12#.#88.229.30':139
- '12#.#88.50.79':445
- '12#.#88.191.93':445
- '12#.#88.229.30':445
- '12#.#88.5.64':445
- '12#.#88.57.250':445
- '12#.#88.93.121':445
- '12#.#88.253.58':445
- '12#.#88.103.219':445
- '12#.#88.70.5':445
- '12#.#88.17.153':445
- '12#.#88.31.50':445
- '12#.#88.158.208':445
- '12#.#88.211.6':445
- '12#.#88.212.98':445
- '12#.#88.96.193':445
- '12#.#88.115.40':445
- '12#.#88.181.5':445
- '12#.#88.176.253':445
- '12#.#88.97.39':139
- '12#.#88.1.236':139
- '12#.#88.188.126':139
- '12#.#88.126.97':139
- '12#.#88.94.45':139
- '12#.#88.49.250':139
- '12#.#88.175.230':139
- '12#.#88.228.240':139
- '12#.#88.241.66':139
- '12#.#88.83.21':445
- '12#.#88.116.76':139
- '12#.#88.52.152':445
- '12#.#88.64.69':445
- '12#.#88.125.75':139
- '12#.#88.77.12':139
- '12#.#88.200.188':139
- '12#.#88.9.53':139
- '12#.#88.21.151':139
