Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERa465.dir00\svchost.exe.mdmp 16325836412032188
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa465.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '14.##8.192.101':9988
- '14.##8.25.46':9988
- '14.##8.68.21':9988
- '14.##8.23.50':9988
- '14.##8.68.243':9988
- '14.#78.6.50':9988
- '14.##8.243.217':9988
- '14.##8.86.112':9988
- '14.##8.174.237':9988
- '14.##8.227.193':9988
- '14.##8.234.164':9988
- '14.##8.80.25':9988
- '14.##8.221.99':9988
- '14.##8.172.85':9988
- '14.##8.125.253':9988
- '14.##8.112.94':9988
- '14.##8.200.152':9988
- '14.##8.149.192':9988
- '14.##8.52.239':9988
- '14.##8.192.179':9988
- '14.##8.130.18':9988
- '14.##8.192.101':445
- '14.##8.75.140':445
- '14.##8.149.192':445
- '14.##8.255.113':445
- '14.##8.23.50':445
- '14.##8.164.201':445
- '14.##8.129.224':445
- '14.##8.234.164':445
- '14.##8.11.252':445
- '14.##8.212.100':445
- '14.##8.126.109':445
- '14.##8.87.51':445
- '14.##8.68.243':445
- '14.##8.17.53':9988
- '14.##8.76.60':9988
- '14.##8.54.117':9988
- '14.##8.68.21':445
- '14.##8.155.235':445
- '14.##8.176.78':445
- '14.##8.4.136':445
- '14.##8.25.23':445
- '14.##8.9.150':139
- '14.##8.171.47':9988
- '14.##8.110.0':139
- '14.##8.181.189':139
- '14.##8.189.65':139
- '14.##8.155.235':9988
- '14.##8.64.87':9988
- '14.##8.4.136':9988
- '14.##8.87.51':9988
- '14.##8.129.224':9988
- '14.##8.193.181':139
- '14.##8.24.124':139
- '14.##8.53.87':139
- '14.##8.38.176':139
- '14.##8.206.169':139
- '14.##8.178.121':139
- '14.##8.208.253':139
- '14.##8.86.185':139
- '14.##8.14.12':139
- '14.##8.232.176':139
- '14.##8.176.75':139
- '14.##8.218.73':9988
- '14.##8.255.227':9988
- '14.##8.250.228':9988
- '14.##8.212.100':9988
- '14.##8.11.252':9988
- '14.##8.227.196':9988
- '14.##8.164.201':9988
- '14.##8.200.248':9988
- '14.##8.90.188':9988
- '14.##8.82.105':9988
- '14.##8.255.113':9988
- '14.##8.174.52':9988
- '14.##8.161.128':9988
- '14.##8.179.222':9988
- '14.#78.54.2':9988
- '14.##8.80.198':9988
- '14.##8.75.140':9988
- '14.##8.176.78':9988
- '14.##8.126.109':9988
- '14.##8.118.55':9988
- '14.##8.25.23':9988
- '14.##8.250.228':139
- '14.##8.90.188':139
- '14.##8.227.196':139
- '14.##8.25.46':139
- '14.##8.255.227':139
- '14.##8.227.193':139
- '14.##8.174.237':139
- '14.##8.64.87':139
- '14.##8.82.105':139
- '14.##8.171.47':139
- '14.#78.54.2':139
- '14.##8.75.140':139
- '14.##8.11.252':139
- '14.##8.192.101':139
- '14.##8.23.50':139
- '14.##8.149.192':139
- '14.##8.129.224':139
- '14.##8.218.73':139
- '14.##8.164.201':139
- '14.##8.212.100':139
- '14.##8.234.164':139
- '14.##8.221.99':139
- '14.##8.54.117':139
- '14.##8.161.128':139
- '14.##8.243.217':139
- '14.##8.118.55':139
- '14.#78.6.50':139
- '14.##8.192.179':139
- '14.##8.200.152':139
- '14.##8.179.222':139
- '14.##8.17.53':139
- '14.##8.76.60':139
- '14.##8.172.85':139
- '14.##8.86.112':139
- '14.##8.174.52':139
- '14.##8.200.248':139
- '14.##8.80.198':139
- '14.##8.52.239':139
- '14.##8.125.253':139
- '14.##8.130.18':139
- '14.##8.112.94':139
- '14.##8.80.25':139
- '14.##8.174.52':445
- '14.##8.172.85':445
- '14.##8.80.198':445
- '14.##8.174.237':445
- '14.##8.200.248':445
- '14.##8.243.217':445
- '14.##8.130.18':445
- '14.##8.80.25':445
- '14.##8.112.94':445
- '14.##8.86.112':445
- '14.##8.227.193':445
- '14.##8.255.227':445
- '14.##8.250.228':445
- '14.##8.25.46':445
- '14.##8.218.73':445
- '14.#78.54.2':445
- '14.##8.171.47':445
- '14.##8.64.87':445
- '14.##8.82.105':445
- '14.##8.227.196':445
- '14.##8.90.188':445
- '14.##8.4.136':139
- '14.##8.25.23':139
- '14.##8.68.243':139
- '14.##8.179.222':445
- '14.##8.87.51':139
- '14.##8.126.109':139
- '14.##8.255.113':139
- '14.##8.155.235':139
- '14.##8.176.78':139
- '14.##8.68.21':139
- '14.##8.17.53':445
- '14.##8.221.99':445
- '14.##8.161.128':445
- '14.##8.52.239':445
- '14.##8.125.253':445
- '14.##8.76.60':445
- '14.##8.54.117':445
- '14.##8.192.179':445
- '14.##8.200.152':445
- '14.##8.118.55':445
- '14.#78.6.50':445
