Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERb113.dir00\svchost.exe.mdmp 16325836412032388
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERb113.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '67.#5.79.16':139
- '67.##.70.178':139
- '67.##.182.138':139
- '67.##.135.128':139
- '67.##.39.195':139
- '67.##.131.242':139
- '67.#5.0.40':139
- '67.##.138.40':139
- '67.##.178.72':139
- '67.##.83.152':139
- '67.##.103.150':139
- '67.##.171.13':139
- '67.##.138.228':139
- '67.##.247.120':139
- '67.##.154.164':139
- '67.##.35.233':139
- '67.##.46.206':139
- '67.##.32.156':139
- '67.##.87.181':139
- '67.#5.69.84':139
- '67.#5.78.59':139
- '67.##.187.113':139
- '67.##.188.120':139
- '67.#5.84.92':139
- '67.##.92.161':139
- '67.##.207.214':139
- '67.##.51.145':139
- '67.##.44.217':139
- '67.##.161.43':139
- '67.#5.51.46':139
- '67.##.57.115':139
- '67.##.127.51':139
- '67.##.196.78':139
- '67.#5.7.7':9988
- '67.##.248.38':9988
- '67.##.117.248':9988
- '67.##.98.114':139
- '67.##.172.123':139
- '67.##.87.217':139
- '67.##.150.212':139
- '67.##.52.114':139
- '67.##.202.241':139
- '67.##.220.203':139
- '67.##.203.200':139
- '67.##.108.30':139
- '67.##.113.36':139
- '67.##.91.199':139
- '67.##.162.221':139
- '67.##.197.239':139
- '67.##.244.107':139
- '67.#5.34.86':139
- '67.##.126.161':139
- '67.##.57.222':139
- '67.##.39.195':445
- '67.##.131.242':445
- '67.#5.79.16':445
- '67.##.187.113':445
- '67.##.188.120':445
- '67.##.135.128':445
- '67.##.70.178':445
- '67.##.171.13':445
- '67.##.138.228':445
- '67.##.138.40':445
- '67.##.182.138':445
- '67.#5.0.40':445
- '67.##.103.150':445
- '67.##.32.156':445
- '67.##.87.181':445
- '67.##.247.120':445
- '67.##.168.71':445
- '67.##.57.222':445
- '67.##.46.206':445
- '67.##.154.164':445
- '67.##.92.161':445
- '67.##.207.214':445
- '67.#5.78.59':445
- '67.##.35.233':445
- '67.#5.69.84':445
- '67.#5.84.92':445
- '67.##.57.115':445
- '67.##.127.51':445
- '67.##.51.145':445
- '67.##.162.221':445
- '67.##.197.239':445
- '67.#5.51.46':445
- '67.##.44.217':445
- '67.##.172.123':445
- '67.##.87.217':445
- '67.##.168.71':139
- '67.##.161.43':445
- '67.##.196.78':445
- '67.##.98.114':445
- '67.##.203.200':445
- '67.##.108.30':445
- '67.##.150.212':445
- '67.##.178.72':445
- '67.##.83.152':445
- '67.##.220.203':445
- '67.##.52.114':445
- '67.#5.34.86':445
- '67.##.126.161':445
- '67.##.91.199':445
- '67.##.202.241':445
- '67.##.113.36':445
- '67.##.244.107':445
- '67.#5.80.20':9988
- '67.#5.80.20':139
- '67.##.19.246':139
- '67.##.87.205':139
- '67.##.117.248':139
- '67.##.241.78':139
- '67.#5.79.80':139
- '67.##.19.104':139
- '67.#5.35.44':139
- '67.##.106.140':139
- '67.#5.24.98':139
- '67.#5.91.21':139
- '67.##.214.244':139
- '67.##.160.52':139
- '67.##.94.218':139
- '67.##.248.38':139
- '67.##.38.143':139
- '67.#5.29.1':445
- '67.#5.218.6':139
- '67.#5.7.7':139
- '67.##.142.243':139
- '67.##.202.252':139
- '67.##.164.35':139
- '67.##.243.183':139
- '67.##.198.125':139
- '67.##.29.204':139
- '67.##.85.202':139
- '67.##.11.195':139
- '67.#5.161.7':139
- '67.##.44.229':139
- '67.##.32.222':139
- '67.##.222.182':139
- '67.##.183.111':139
- '67.##.132.102':139
- '67.##.230.234':139
- '67.##.234.199':139
- '67.#5.29.1':139
- '67.#5.0.231':139
- '67.##.199.199':139
- '67.#5.18.78':139
- '67.#5.4.122':139
- '67.##.171.192':139
- '67.##.36.188':139
- '67.##.137.34':139
- '67.##.87.230':139
- '67.#5.41.13':139
- '67.##.152.150':139
- '67.##.241.105':139
- '67.##.226.107':139
- '67.##.160.221':139
- '67.#5.155.3':139
- '67.##.118.142':139
- '67.##.42.100':139
- '67.##.234.199':445
- '67.##.117.248':445
- '67.##.241.78':445
- '67.#5.80.20':445
- '67.##.243.183':445
- '67.##.164.35':445
- '67.#5.79.80':445
- '67.##.19.246':445
- '67.##.214.244':445
- '67.##.160.52':445
- '67.#5.35.44':445
- '67.##.87.205':445
- '67.##.19.104':445
- '67.#5.91.21':445
- '67.#5.218.6':445
- '67.#5.7.7':445
- '67.##.94.218':445
- '67.##.160.221':9988
- '67.##.230.234':9988
- '67.##.42.100':9988
- '67.##.248.38':445
- '67.##.29.204':445
- '67.##.85.202':445
- '67.##.202.252':445
- '67.##.38.143':445
- '67.##.142.243':445
- '67.##.198.125':445
- '67.##.222.182':445
- '67.##.183.111':445
- '67.##.11.195':445
- '67.##.226.107':445
- '67.##.160.221':445
- '67.##.32.222':445
- '67.#5.161.7':445
- '67.#5.0.231':445
- '67.##.199.199':445
- '67.##.230.234':445
- '67.##.44.229':445
- '67.#5.18.78':445
- '67.##.132.102':445
- '67.##.87.230':445
- '67.#5.41.13':445
- '67.#5.4.122':445
- '67.##.106.140':445
- '67.#5.24.98':445
- '67.##.137.34':445
- '67.##.171.192':445
- '67.##.42.100':445
- '67.##.118.142':445
- '67.##.241.105':445
- '67.##.36.188':445
- '67.##.152.150':445
- '67.#5.155.3':445
