Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER6457.dir00\svchost.exe.mdmp 16325836412032636
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER6457.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '89.##.87.162':445
- '89.##.162.174':445
- '89.##.201.143':445
- '89.##.108.158':445
- '89.##.246.52':445
- '89.##.253.93':445
- '89.##.73.132':445
- '89.##.41.246':445
- '89.#3.47.86':445
- '89.##.146.57':9988
- '89.##.62.229':9988
- '89.##.43.171':9988
- '89.##.217.235':9988
- '89.#3.47.67':445
- '89.##.197.182':445
- '89.#3.29.66':9988
- '89.##.190.135':445
- '89.#3.65.3':445
- '89.##.43.171':445
- '89.##.228.254':445
- '89.##.50.244':445
- '89.#3.64.43':445
- '89.##.113.113':445
- '89.##.56.124':445
- '89.##.66.146':445
- '89.##.222.157':445
- '89.#3.87.24':445
- '89.#3.38.99':445
- '89.#3.99.54':445
- '89.##.142.46':445
- '89.##.181.157':445
- '89.##.214.56':445
- '89.#3.29.66':445
- '89.##.53.248':445
- '89.#3.50.80':445
- '89.##.222.157':9988
- '89.#3.50.80':9988
- '89.##.181.157':9988
- '89.##.142.46':9988
- '89.#3.99.54':9988
- '89.##.56.124':9988
- '89.#3.23.46':9988
- '89.##.214.56':9988
- '89.##.228.254':9988
- '89.#3.65.3':9988
- '89.##.87.162':9988
- '89.#3.47.86':9988
- '89.##.108.158':9988
- '89.#3.47.67':9988
- '89.##.201.143':9988
- '89.##.41.246':9988
- '89.##.197.182':9988
- '89.##.190.135':9988
- '89.##.147.67':9988
- '89.#3.81.12':9988
- '89.##.162.174':9988
- '89.#3.62.74':9988
- '89.##.115.229':9988
- '89.##.75.107':9988
- '89.##.114.103':9988
- '89.##.246.52':9988
- '89.##.249.102':9988
- '89.##.139.153':9988
- '89.##.233.157':9988
- '89.##.167.160':9988
- '89.##.50.244':9988
- '89.##.78.157':9988
- '89.##.90.206':9988
- '89.##.116.69':9988
- '89.#3.63.78':9988
- '89.#3.37.96':9988
- '89.#3.37.96':445
- '89.##.222.157':139
- '89.##.113.113':139
- '89.##.228.254':139
- '89.##.66.146':139
- '89.#3.23.46':139
- '89.##.147.67':139
- '89.##.56.124':139
- '89.#3.37.96':139
- '89.##.43.171':139
- '89.#3.50.80':139
- '89.##.214.56':139
- '89.#3.99.54':139
- '89.##.53.248':139
- '89.##.50.244':139
- '89.#3.64.43':139
- '89.#3.29.66':139
- '89.#3.87.24':139
- '89.##.167.160':139
- '89.##.78.157':139
- '89.##.214.26':139
- '89.##.62.229':139
- '89.#3.63.78':139
- '89.##.146.57':139
- '89.##.115.229':139
- '89.##.217.235':139
- '89.#3.10.26':139
- '89.#3.62.74':139
- '89.##.249.102':139
- '89.##.114.103':139
- '89.##.90.206':139
- '89.##.233.157':139
- '89.##.75.107':139
- '89.##.139.153':139
- '89.#3.81.12':139
- '89.##.116.69':139
- '89.#3.38.99':139
- '89.#3.62.74':445
- '89.##.62.229':445
- '89.##.75.107':445
- '89.##.139.153':445
- '89.##.214.26':445
- '89.##.217.235':445
- '89.#3.63.78':445
- '89.##.78.157':445
- '89.##.116.69':445
- '89.##.167.160':445
- '89.##.90.206':445
- '89.#3.23.46':445
- '89.##.147.67':445
- '89.##.114.103':445
- '89.#3.81.12':445
- '89.##.233.157':445
- '89.##.249.102':445
- '89.#3.10.26':445
- '89.##.41.246':139
- '89.##.246.52':139
- '89.##.162.174':139
- '89.##.73.132':139
- '89.##.142.46':139
- '89.##.181.157':139
- '89.##.253.93':139
- '89.#3.65.3':139
- '89.##.87.162':139
- '89.##.190.135':139
- '89.#3.47.67':139
- '89.##.115.229':445
- '89.##.146.57':445
- '89.##.201.143':139
- '89.##.108.158':139
- '89.##.197.182':139
- '89.#3.47.86':139
