Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER830a.dir00\svchost.exe.mdmp 16325836412032500
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER830a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '72.##.87.133':139
- '72.#5.123.1':139
- '72.#5.58.63':139
- '72.##.80.131':139
- '72.#5.90.82':139
- '72.##.27.212':139
- '72.#5.22.73':139
- '72.##.77.214':139
- '72.##.200.38':139
- '72.##.199.186':139
- '72.##.77.199':139
- '72.##.247.93':139
- '72.##.125.253':139
- '72.#5.99.31':139
- '72.##.33.141':445
- '72.##.236.221':445
- '72.##.200.212':139
- '72.##.54.164':445
- '72.#5.129.3':445
- '72.##.189.193':445
- '72.##.165.67':139
- '72.##.115.139':139
- '72.#5.38.6':139
- '72.##.191.114':139
- '72.##.67.229':139
- '72.##.163.136':139
- '72.##.85.102':139
- '72.##.28.225':139
- '72.##.229.210':139
- '72.##.209.100':139
- '72.##.44.251':139
- '72.##.241.123':139
- '72.#5.124.7':139
- '72.##.175.83':139
- '72.##.54.164':139
- '72.#5.129.3':139
- '72.##.189.193':139
- '72.#5.21.67':139
- '72.##.147.42':139
- '72.##.241.54':139
- '72.##.48.116':139
- '72.##.169.34':139
- '72.##.36.181':139
- '72.##.253.62':139
- '72.##.85.156':139
- '72.##.10.133':139
- '72.#5.27.1':139
- '72.#5.48.65':139
- '72.##.78.170':139
- '72.##.190.116':139
- '72.##.239.81':139
- '72.##.209.83':139
- '72.#5.3.189':139
- '72.##.62.163':139
- '72.##.241.54':445
- '72.#5.99.31':445
- '72.##.80.131':445
- '72.#5.90.82':445
- '72.##.115.139':445
- '72.#5.38.6':445
- '72.##.191.114':445
- '72.##.27.212':445
- '72.#5.22.73':445
- '72.##.77.199':445
- '72.##.247.93':445
- '72.##.87.133':445
- '72.#5.123.1':445
- '72.#5.58.63':445
- '72.##.85.102':445
- '72.##.20.136':139
- '72.##.243.46':139
- '72.##.73.234':139
- '72.##.28.253':139
- '72.##.169.25':139
- '72.##.167.58':139
- '72.##.21.234':139
- '72.##.165.67':445
- '72.##.67.229':445
- '72.##.163.136':445
- '72.##.178.149':139
- '72.##.44.184':139
- '72.##.200.212':445
- '72.##.48.116':445
- '72.##.44.251':445
- '72.##.241.123':445
- '72.##.78.170':445
- '72.##.190.116':445
- '72.##.239.81':445
- '72.#5.124.7':445
- '72.##.175.83':445
- '72.#5.21.67':445
- '72.##.147.42':445
- '72.##.28.225':445
- '72.##.229.210':445
- '72.##.209.100':445
- '72.##.62.163':445
- '72.##.199.186':445
- '72.##.85.156':445
- '72.##.10.133':445
- '72.##.125.253':445
- '72.##.77.214':445
- '72.##.200.38':445
- '72.#5.27.1':445
- '72.#5.48.65':445
- '72.##.209.83':445
- '72.#5.3.189':445
- '72.##.169.34':445
- '72.##.36.181':445
- '72.##.253.62':445
- '72.##.33.141':139
- '72.##.198.250':139
- '72.##.52.157':139
- '72.##.213.136':139
- '72.#5.62.7':139
- '72.##.163.132':139
- '72.##.114.52':139
- '72.##.210.114':139
- '72.##.19.254':139
- '72.##.110.242':139
- '72.#5.59.59':139
- '72.##.254.47':139
- '72.#5.59.26':139
- '72.##.26.113':139
- '72.#5.51.62':139
- '72.##.191.169':139
- '72.#5.54.25':139
- '72.##.176.141':139
- '72.##.223.10':445
- '72.##.82.150':445
- '72.##.78.231':445
- '72.##.94.185':139
- '72.#5.96.57':139
- '72.##.161.175':139
- '72.##.250.152':139
- '72.##.139.107':139
- '72.##.91.185':139
- '72.##.127.235':139
- '72.##.68.164':139
- '72.#5.25.33':139
- '72.##.184.34':139
- '72.##.139.154':139
- '72.##.79.138':139
- '72.#5.42.4':139
- '72.##.223.10':139
- '72.##.78.231':139
- '72.##.82.150':139
- '72.##.205.83':139
- '72.##.210.214':139
- '72.##.218.217':139
- '72.#5.2.38':139
- '72.##.74.190':139
- '72.##.230.188':139
- '72.##.25.152':139
- '72.##.84.120':139
- '72.##.233.91':139
- '72.#5.39.24':139
- '72.##.238.125':139
- '72.#5.1.170':139
- '72.##.242.110':139
- '72.##.242.155':139
- '72.##.240.214':139
- '72.##.169.209':139
- '72.##.209.242':139
- '72.##.116.30':139
- '72.##.210.214':445
- '72.#5.51.62':445
- '72.#5.62.7':445
- '72.##.163.132':445
- '72.#5.96.57':445
- '72.##.161.175':445
- '72.##.250.152':445
- '72.##.114.52':445
- '72.##.210.114':445
- '72.##.254.47':445
- '72.#5.59.26':445
- '72.##.198.250':445
- '72.##.52.157':445
- '72.##.213.136':445
- '72.##.127.235':445
- '72.##.184.34':9988
- '72.##.116.30':9988
- '72.##.205.83':9988
- '72.##.236.221':139
- '72.##.19.254':9988
- '72.##.78.231':9988
- '72.#5.59.26':9988
- '72.##.139.107':445
- '72.##.91.185':445
- '72.##.94.185':445
- '72.##.191.169':445
- '72.#5.54.25':445
- '72.##.176.141':445
- '72.##.74.190':445
- '72.##.139.154':445
- '72.##.79.138':445
- '72.##.242.110':445
- '72.##.242.155':445
- '72.##.240.214':445
- '72.#5.42.4':445
- '72.#5.25.33':445
- '72.##.218.217':445
- '72.##.184.34':445
- '72.##.68.164':445
- '72.#5.2.38':445
- '72.##.205.83':445
- '72.##.116.30':445
- '72.#5.59.59':445
- '72.##.233.91':445
- '72.#5.39.24':445
- '72.##.26.113':445
- '72.##.19.254':445
- '72.##.110.242':445
- '72.##.238.125':445
- '72.#5.1.170':445
- '72.##.169.209':445
- '72.##.209.242':445
- '72.##.230.188':445
- '72.##.25.152':445
- '72.##.84.120':445
