Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER5094.dir00\svchost.exe.mdmp 16325836412032412
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER5094.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '58.##2.185.187':445
- '58.##2.26.97':445
- '58.##2.75.26':445
- '58.##2.186.80':445
- '58.##2.74.186':445
- '58.##2.43.161':445
- '58.##2.88.182':445
- '58.##2.45.189':445
- '58.##2.10.138':445
- '58.##2.78.220':9988
- '58.#92.6.16':445
- '58.##2.27.43':9988
- '58.##2.29.35':9988
- '58.##2.142.63':445
- '58.##2.63.140':445
- '58.##2.213.239':445
- '58.##2.175.141':445
- '58.##2.44.217':445
- '58.##2.161.79':445
- '58.##2.21.223':445
- '58.##2.69.250':445
- '58.##2.228.48':445
- '58.##2.66.46':445
- '58.##2.13.138':445
- '58.##2.223.71':445
- '58.##2.78.220':445
- '58.##2.95.252':445
- '58.##2.24.244':445
- '58.##2.243.133':445
- '58.##2.146.137':445
- '58.##2.83.24':445
- '58.##2.17.214':445
- '58.##2.69.38':445
- '58.##2.134.208':445
- '58.##2.28.121':445
- '58.##2.74.186':9988
- '58.##2.43.161':9988
- '58.##2.88.182':9988
- '58.##2.146.137':9988
- '58.##2.161.79':9988
- '58.##2.69.38':9988
- '58.##2.24.244':9988
- '58.##2.28.121':9988
- '58.##2.26.97':9988
- '58.##2.142.63':9988
- '58.##2.175.141':9988
- '58.##2.213.239':9988
- '58.#92.6.16':9988
- '58.##2.75.26':9988
- '58.##2.185.187':9988
- '58.##2.186.80':9988
- '58.##2.10.138':9988
- '58.##2.228.48':9988
- '58.##2.86.187':9988
- '58.##2.63.140':9988
- '58.#92.84.8':9988
- '58.#92.0.61':9988
- '58.##2.83.24':9988
- '58.##2.243.133':9988
- '58.##2.45.189':9988
- '58.##2.44.217':9988
- '58.##2.251.209':9988
- '58.##2.211.67':9988
- '58.##2.63.36':9988
- '58.##2.13.138':9988
- '58.##2.223.71':9988
- '58.##2.187.12':9988
- '58.#92.4.14':9988
- '58.##2.120.198':9988
- '58.##2.79.251':9988
- '58.##2.21.223':139
- '58.##2.223.71':139
- '58.##2.228.48':139
- '58.##2.161.79':139
- '58.##2.13.138':139
- '58.##2.82.91':139
- '58.##2.78.220':139
- '58.##2.66.46':139
- '58.##2.69.250':139
- '58.##2.243.133':139
- '58.##2.134.208':139
- '58.##2.83.24':139
- '58.##2.24.244':139
- '58.##2.69.38':139
- '58.##2.95.252':139
- '58.##2.28.121':139
- '58.##2.17.214':139
- '58.##2.120.198':139
- '58.##2.122.125':139
- '58.#92.0.61':139
- '58.##2.12.34':139
- '58.##2.33.169':139
- '58.#92.4.14':139
- '58.##2.216.201':139
- '58.##2.27.43':139
- '58.##2.43.20':139
- '58.##2.187.12':139
- '58.##2.79.251':139
- '58.##2.251.209':139
- '58.##2.63.36':139
- '58.##2.211.67':139
- '58.#92.84.8':139
- '58.##2.86.187':139
- '58.##2.29.35':139
- '58.##2.92.175':139
- '58.##2.12.34':445
- '58.##2.33.169':445
- '58.##2.86.187':445
- '58.##2.187.12':445
- '58.##2.43.20':445
- '58.#92.0.61':445
- '58.##2.122.125':445
- '58.##2.216.201':445
- '58.#92.84.8':445
- '58.##2.63.36':445
- '58.##2.211.67':445
- '58.##2.82.91':445
- '58.##2.120.198':445
- '58.##2.29.35':445
- '58.##2.92.175':445
- '58.##2.79.251':445
- '58.##2.251.209':445
- '58.#92.4.14':445
- '58.##2.88.182':139
- '58.##2.45.189':139
- '58.##2.185.187':139
- '58.##2.26.97':139
- '58.##2.44.217':139
- '58.##2.146.137':139
- '58.##2.74.186':139
- '58.##2.43.161':139
- '58.##2.186.80':139
- '58.##2.213.239':139
- '58.##2.175.141':139
- '58.##2.27.43':445
- '58.#92.6.16':139
- '58.##2.10.138':139
- '58.##2.75.26':139
- '58.##2.142.63':139
- '58.##2.63.140':139
