Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER03b0.dir00\svchost.exe.mdmp 16325836412029804
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER03b0.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '12#.#24.105.54':445
- '12#.#24.9.126':445
- '12#.#24.221.173':445
- '12#.#24.164.221':445
- '12#.#24.226.241':445
- '12#.#24.215.80':445
- '12#.#24.10.43':445
- '12#.#24.48.247':445
- '12#.#24.101.185':445
- '12#.#24.57.185':9988
- '12#.#24.26.25':9988
- '12#.#24.65.113':9988
- '12#.#24.113.139':9988
- '12#.#24.91.120':9988
- '12#.#24.224.196':445
- '12#.#24.53.165':445
- '12#.#24.50.203':9988
- '12#.#24.17.34':9988
- '12#.#24.212.17':445
- '12#.#24.30.174':445
- '12#.#24.168.207':445
- '12#.#24.120.151':445
- '12#.#24.173.154':445
- '12#.#24.227.4':445
- '12#.#24.91.120':445
- '12#.#24.62.150':445
- '12#.#24.80.89':445
- '12#.#24.255.70':445
- '12#.#24.218.46':445
- '12#.#24.58.237':445
- '12#.#24.172.163':445
- '12#.#24.241.158':445
- '12#.#24.14.45':445
- '12#.#24.100.212':445
- '12#.#24.19.175':445
- '12#.#24.36.142':445
- '12#.#24.120.151':9988
- '12#.#24.10.43':9988
- '12#.#24.101.185':9988
- '12#.#24.215.80':9988
- '12#.#24.36.142':9988
- '12#.#24.58.237':9988
- '12#.#24.100.125':9988
- '12#.#24.75.3':9988
- '12#.#24.100.212':9988
- '12#.#24.224.196':9988
- '12#.#24.164.221':9988
- '12#.#24.48.247':9988
- '12#.#24.105.54':9988
- '12#.#24.53.165':9988
- '12#.#24.172.163':9988
- '12#.#24.221.173':9988
- '12#.#24.255.70':9988
- '12#.#24.30.174':9988
- '12#.#24.62.150':9988
- '12#.#24.64.186':9988
- '12#.#24.182.216':9988
- '12#.#24.135.21':9988
- '12#.#24.185.5':9988
- '12#.#24.33.93':9988
- '12#.#24.153.203':9988
- '12#.#24.173.154':9988
- '12#.#24.5.184':9988
- '12#.#24.19.175':9988
- '12#.#24.227.4':9988
- '12#.#24.168.207':9988
- '12#.#24.241.158':9988
- '12#.#24.14.45':9988
- '12#.#24.202.23':9988
- '12#.#24.249.61':9988
- '12#.#24.212.17':9988
- '12#.#24.65.63':9988
- '12#.#24.103.1':445
- '12#.#24.80.89':139
- '12#.#24.227.4':139
- '12#.#24.173.154':139
- '12#.#24.62.150':139
- '12#.#24.91.120':139
- '12#.#24.185.5':139
- '12#.#24.5.184':139
- '12#.#24.103.1':139
- '12#.#24.57.185':139
- '12#.#24.36.142':139
- '12#.#24.14.45':139
- '12#.#24.172.163':139
- '12#.#24.19.175':139
- '12#.#24.168.207':139
- '12#.#24.120.151':139
- '12#.#24.30.174':139
- '12#.#24.100.212':139
- '12#.#24.212.17':139
- '12#.#24.26.25':139
- '12#.#24.249.61':139
- '12#.#24.75.198':139
- '12#.#24.33.93':139
- '12#.#24.202.23':139
- '12#.#24.135.21':139
- '12#.#24.64.186':139
- '12#.#24.65.63':139
- '12#.#24.50.203':139
- '12#.#24.17.34':139
- '12#.#24.115.192':139
- '12#.#24.153.203':139
- '12#.#24.65.113':139
- '12#.#24.75.3':139
- '12#.#24.182.216':139
- '12#.#24.100.125':139
- '12#.#24.48.116':139
- '12#.#24.113.139':139
- '12#.#24.113.139':445
- '12#.#24.182.216':445
- '12#.#24.249.61':445
- '12#.#24.64.186':445
- '12#.#24.75.198':445
- '12#.#24.26.25':445
- '12#.#24.135.21':445
- '12#.#24.100.125':445
- '12#.#24.33.93':445
- '12#.#24.185.5':445
- '12#.#24.65.113':445
- '12#.#24.57.185':445
- '12#.#24.5.184':445
- '12#.#24.153.203':445
- '12#.#24.115.192':445
- '12#.#24.48.116':445
- '12#.#24.75.3':445
- '12#.#24.17.34':445
- '12#.#24.101.185':139
- '12#.#24.215.80':139
- '12#.#24.226.241':139
- '12#.#24.48.247':139
- '12#.#24.10.43':139
- '12#.#24.255.70':139
- '12#.#24.241.158':139
- '12#.#24.58.237':139
- '12#.#24.218.46':139
- '12#.#24.202.23':445
- '12#.#24.224.196':139
- '12#.#24.65.63':445
- '12#.#24.50.203':445
- '12#.#24.53.165':139
- '12#.#24.105.54':139
- '12#.#24.9.126':139
- '12#.#24.164.221':139
- '12#.#24.221.173':139
