Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc870.dir00\svchost.exe.mdmp 16325836412032496
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERc870.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#16.6.35':9988
- '20#.#16.207.209':9988
- '20#.#16.205.52':9988
- '20#.#16.49.102':9988
- '20#.#16.183.33':9988
- '20#.#16.137.191':9988
- '20#.#16.148.153':9988
- '20#.#16.176.70':9988
- '20#.#16.56.100':9988
- '20#.#16.133.192':9988
- '20#.#16.164.127':9988
- '20#.#16.128.252':9988
- '20#.#16.16.208':9988
- '20#.#16.46.178':9988
- '20#.#16.128.147':9988
- '20#.#16.200.200':9988
- '20#.#16.91.82':9988
- '20#.#16.119.197':9988
- '20#.#16.29.39':9988
- '20#.#16.217.175':9988
- '20#.#16.26.102':9988
- '20#.#16.112.69':9988
- '20#.#16.80.174':445
- '20#.#16.86.222':445
- '20#.#16.239.177':445
- '20#.#16.255.178':445
- '20#.#16.94.239':445
- '20#.#16.37.121':445
- '20#.#16.38.11':445
- '20#.#16.41.164':445
- '20#.#16.30.149':445
- '20#.#16.173.182':445
- '20#.#16.182.194':445
- '20#.#16.57.253':9988
- '20#.#16.193.163':9988
- '20#.#16.239.9':9988
- '20#.#16.255.178':9988
- '20#.#16.142.20':9988
- '20#.#16.163.198':9988
- '20#.#16.81.25':445
- '20#.#16.32.90':445
- '20#.#16.235.11':9988
- '20#.#16.58.34':9988
- '20#.#16.142.251':9988
- '20#.#16.203.225':139
- '20#.#16.164.37':139
- '20#.#16.30.204':139
- '20#.#16.68.198':139
- '20#.#16.110.105':139
- '20#.#16.193.61':139
- '20#.#16.9.39':139
- '20#.#16.39.130':139
- '20#.#16.19.229':139
- '20#.#16.68.52':139
- '20#.#16.140.91':139
- '20#.#16.16.4':139
- '20#.#16.121.53':139
- '20#.#16.162.120':139
- '20#.#16.149.151':139
- '20#.#16.111.149':139
- '20#.#16.54.8':139
- '20#.#16.16.120':139
- '20#.#16.8.28':139
- '20#.#16.49.17':139
- '20#.#16.149.120':139
- '20#.#16.138.215':139
- '20#.#16.182.194':9988
- '20#.#16.80.174':9988
- '20#.#16.32.90':9988
- '20#.#16.239.177':9988
- '20#.#16.81.25':9988
- '20#.#16.41.164':9988
- '20#.#16.14.132':9988
- '20#.#16.109.42':9988
- '20#.#16.209.117':9988
- '20#.#16.222.179':9988
- '20#.#16.41.134':9988
- '20#.#16.37.121':9988
- '20#.#16.86.222':9988
- '20#.#16.94.239':9988
- '20#.#16.129.247':139
- '20#.#16.1.53':139
- '20#.#16.173.182':9988
- '20#.#16.168.164':9988
- '20#.#16.192.232':9988
- '20#.#16.157.220':9988
- '20#.#16.30.149':9988
- '20#.#16.38.11':9988
- '20#.#16.209.117':445
- '20#.#16.142.20':139
- '20#.#16.109.42':139
- '20#.#16.16.208':139
- '20#.#16.46.178':139
- '20#.#16.200.200':139
- '20#.#16.157.220':139
- '20#.#16.29.39':139
- '20#.#16.235.11':139
- '20#.#16.91.82':139
- '20#.#16.26.102':139
- '20#.#16.205.52':139
- '20#.#16.30.149':139
- '20#.#16.38.11':139
- '20#.#16.182.194':139
- '20#.#16.37.121':139
- '20#.#16.173.182':139
- '20#.#16.41.164':139
- '20#.#16.41.134':139
- '20#.#16.128.147':139
- '20#.#16.14.132':139
- '20#.#16.209.117':139
- '20#.#16.222.179':139
- '20#.#16.239.9':139
- '20#.#16.163.198':139
- '20#.#16.57.253':139
- '20#.#16.137.191':139
- '20#.#16.142.251':139
- '20#.#16.192.232':139
- '20#.#16.164.127':139
- '20#.#16.56.100':139
- '20#.#16.168.164':139
- '20#.#16.133.192':139
- '20#.#16.148.153':139
- '20#.#16.207.209':139
- '20#.#16.49.102':139
- '20#.#16.128.252':139
- '20#.#16.58.34':139
- '20#.#16.6.35':139
- '20#.#16.119.197':139
- '20#.#16.217.175':139
- '20#.#16.176.70':139
- '20#.#16.193.163':139
- '20#.#16.112.69':139
- '20#.#16.183.33':139
- '20#.#16.235.11':445
- '20#.#16.58.34':445
- '20#.#16.29.39':445
- '20#.#16.205.52':445
- '20#.#16.91.82':445
- '20#.#16.6.35':445
- '20#.#16.119.197':445
- '20#.#16.112.69':445
- '20#.#16.49.102':445
- '20#.#16.128.252':445
- '20#.#16.207.209':445
- '20#.#16.128.147':445
- '20#.#16.46.178':445
- '20#.#16.41.134':445
- '20#.#16.222.179':445
- '20#.#16.14.132':445
- '20#.#16.200.200':445
- '20#.#16.157.220':445
- '20#.#16.26.102':445
- '20#.#16.142.20':445
- '20#.#16.16.208':445
- '20#.#16.109.42':445
- '20#.#16.192.232':445
- '20#.#16.81.25':139
- '20#.#16.163.198':445
- '20#.#16.168.164':445
- '20#.#16.148.153':445
- '20#.#16.32.90':139
- '20#.#16.80.174':139
- '20#.#16.86.222':139
- '20#.#16.239.177':139
- '20#.#16.255.178':139
- '20#.#16.94.239':139
- '20#.#16.217.175':445
- '20#.#16.137.191':445
- '20#.#16.176.70':445
- '20#.#16.183.33':445
- '20#.#16.193.163':445
- '20#.#16.142.251':445
- '20#.#16.239.9':445
- '20#.#16.164.127':445
- '20#.#16.133.192':445
- '20#.#16.56.100':445
- '20#.#16.57.253':445
