Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER9be0.dir00\svchost.exe.mdmp 16325836412032084
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER9be0.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '58.#.69.212':9988
- '58.#.164.101':9988
- '58.#.65.123':9988
- '58.#.105.82':9988
- '58.#.113.236':9988
- '58.#.6.154':9988
- '58.#.153.74':9988
- '58.#.61.180':9988
- '58.#.229.178':9988
- '58.#.53.14':9988
- '58.#.131.151':9988
- '58.#.65.82':9988
- '58.#.154.133':9988
- '58.#.134.68':9988
- '58.#.195.6':9988
- '58.#.137.152':9988
- '58.#.169.253':9988
- '58.#.60.91':9988
- '58.#.8.127':9988
- '58.#.85.168':9988
- '58.#.155.87':9988
- '58.#.180.196':9988
- '58.#.131.105':9988
- '58.#.74.96':9988
- '58.#.167.155':9988
- '58.#.162.176':9988
- '58.#.135.98':9988
- '58.#.104.211':9988
- '58.#.141.20':9988
- '58.#.105.79':9988
- '58.#.248.4':9988
- '58.#.6.154':445
- '58.#.153.74':445
- '58.#.74.96':445
- '58.#.152.33':9988
- '58.#.90.197':9988
- '58.#.120.203':9988
- '58.#.208.176':9988
- '58.#.21.152':9988
- '58.#.109.30':9988
- '58.#.155.124':9988
- '58.#.100.185':9988
- '58.#.47.195':9988
- '58.#.2.141':9988
- '58.#.124.79':9988
- '58.#.39.64':9988
- '58.#.98.101':9988
- '58.#.201.136':9988
- '58.#.61.85':9988
- '58.#.64.193':9988
- '58.#.33.0':139
- '58.#.173.83':139
- '58.#.159.211':139
- '58.#.57.159':139
- '58.#.178.196':139
- '58.#.218.111':139
- '58.#.169.214':139
- '58.#.39.89':139
- '58.#.42.89':139
- '58.#.88.66':139
- '58.#.168.119':139
- '58.#.27.224':139
- '58.#.183.210':139
- '58.#.210.78':139
- '58.#.23.53':139
- '58.#.210.178':139
- '58.#.178.179':139
- '58.#.179.183':139
- '58.#.125.220':139
- '58.#.45.39':139
- '58.#.1.89':139
- '58.#.113.97':139
- '58.#.197.78':139
- '58.#.81.166':139
- '58.#.194.116':139
- '58.#.93.92':139
- '58.#.250.103':139
- '58.#.142.180':139
- '58.#.109.106':139
- '58.#.77.22':139
- '58.#.65.13':139
- '58.#.0.160':9988
- '58.#.24.33':9988
- '58.#.1.34':9988
- '58.#.32.30':139
- '58.#.158.187':139
- '58.#.174.158':9988
- '58.#.20.206':139
- '58.#.111.40':139
- '58.#.28.109':139
- '58.#.202.205':139
- '58.#.9.232':139
- '58.#.196.20':139
- '58.#.17.36':139
- '58.#.129.25':139
- '58.#.25.39':139
- '58.#.4.6':139
- '58.#.140.225':139
- '58.#.75.108':139
- '58.#.134.68':139
- '58.#.60.91':139
- '58.#.155.87':139
- '58.#.47.195':139
- '58.#.104.211':139
- '58.#.201.136':139
- '58.#.164.101':139
- '58.#.24.33':139
- '58.#.90.197':139
- '58.#.208.176':139
- '58.#.65.123':139
- '58.#.195.6':139
- '58.#.154.133':139
- '58.#.61.180':139
- '58.#.180.196':139
- '58.#.74.96':139
- '58.#.1.34':139
- '58.#.69.212':139
- '58.#.113.236':139
- '58.#.53.14':139
- '58.#.64.193':139
- '58.#.8.127':139
- '58.#.131.105':139
- '58.#.105.82':139
- '58.#.65.82':139
- '58.#.131.151':139
- '58.#.0.160':139
- '58.#.152.33':139
- '58.#.169.253':139
- '58.#.162.176':139
- '58.#.229.178':139
- '58.#.105.79':139
- '58.#.39.64':139
- '58.#.21.152':139
- '58.#.137.152':139
- '58.#.174.158':139
- '58.#.109.30':139
- '58.#.141.20':139
- '58.#.61.85':139
- '58.#.85.168':139
- '58.#.167.155':139
- '58.#.155.124':139
- '58.#.124.79':139
- '58.#.98.101':139
- '58.#.100.185':139
- '58.#.2.141':139
- '58.#.120.203':139
- '58.#.248.4':139
- '58.#.135.98':139
- '58.#.153.74':139
- '58.#.208.176':445
- '58.#.60.91':445
- '58.#.155.87':445
- '58.#.104.211':445
- '58.#.201.136':445
- '58.#.134.68':445
- '58.#.24.33':445
- '58.#.167.155':445
- '58.#.90.197':445
- '58.#.65.123':445
- '58.#.195.6':445
- '58.#.164.101':445
- '58.#.180.196':445
- '58.#.61.180':445
- '58.#.105.82':445
- '58.#.1.34':445
- '58.#.69.212':445
- '58.#.154.133':445
- '58.#.113.236':445
- '58.#.64.193':445
- '58.#.47.195':445
- '58.#.131.105':445
- '58.#.8.127':445
- '58.#.53.14':445
- '58.#.65.82':445
- '58.#.229.178':445
- '58.#.169.253':445
- '58.#.162.176':445
- '58.#.100.185':445
- '58.#.2.141':445
- '58.#.131.151':445
- '58.#.39.64':445
- '58.#.137.152':445
- '58.#.6.154':139
- '58.#.109.30':445
- '58.#.152.33':445
- '58.#.0.160':445
- '58.#.61.85':445
- '58.#.105.79':445
- '58.#.85.168':445
- '58.#.155.124':445
- '58.#.124.79':445
- '58.#.141.20':445
- '58.#.174.158':445
- '58.#.98.101':445
- '58.#.21.152':445
- '58.#.120.203':445
- '58.#.248.4':445
- '58.#.135.98':445
