Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER8435.dir00\svchost.exe.mdmp 16325836412032124
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER8435.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '59.##.106.229':445
- '59.##.167.207':445
- '59.##.162.224':9988
- '59.##.250.88':9988
- '59.#0.137.2':445
- '59.##.184.17':445
- '59.#0.18.16':445
- '59.##.96.196':445
- '59.#0.191.7':445
- '59.##.11.211':9988
- '59.##.20.175':9988
- '59.#0.87.65':9988
- '59.#0.63.91':9988
- '59.##.15.141':9988
- '59.##.107.58':9988
- '59.#0.53.0':9988
- '59.##.239.60':9988
- '59.#0.84.69':9988
- '59.#0.6.152':445
- '59.##.74.164':445
- '59.#0.18.2':445
- '59.##.139.89':445
- '59.#0.6.132':445
- '59.##.203.23':445
- '59.##.144.228':445
- '59.##.214.179':445
- '59.##.42.148':445
- '59.##.68.169':445
- '59.##.207.207':445
- '59.##.239.60':445
- '59.##.119.34':445
- '59.##.125.254':445
- '59.##.60.115':445
- '59.##.235.229':445
- '59.##.84.150':445
- '59.##.12.229':445
- '59.##.30.150':445
- '59.##.180.207':9988
- '59.##.30.150':9988
- '59.##.96.196':9988
- '59.##.106.229':9988
- '59.##.184.17':9988
- '59.#0.137.2':9988
- '59.##.60.115':9988
- '59.##.125.254':9988
- '59.#0.191.7':9988
- '59.#0.203.7':9988
- '59.##.224.52':9988
- '59.#0.0.24':9988
- '59.##.211.62':9988
- '59.##.156.166':9988
- '59.##.167.207':9988
- '59.#0.18.16':9988
- '59.##.207.207':9988
- '59.##.119.34':9988
- '59.##.84.150':9988
- '59.#0.6.152':9988
- '59.##.130.36':9988
- '59.##.103.178':9988
- '59.##.141.73':9988
- '59.##.214.179':9988
- '59.##.132.36':9988
- '59.##.92.158':9988
- '59.##.206.19':9988
- '59.#0.36.68':9988
- '59.#0.1.12':9988
- '59.#0.6.132':9988
- '59.##.139.89':9988
- '59.##.235.229':9988
- '59.##.74.164':9988
- '59.#0.18.2':9988
- '59.##.68.169':9988
- '59.##.42.148':9988
- '59.##.203.23':9988
- '59.##.144.228':9988
- '59.##.141.73':445
- '59.##.214.179':139
- '59.##.141.73':139
- '59.##.68.169':139
- '59.##.144.228':139
- '59.#0.84.69':139
- '59.##.67.157':139
- '59.##.156.166':139
- '59.##.132.36':139
- '59.#0.36.68':139
- '59.##.84.150':139
- '59.##.139.89':139
- '59.##.30.150':139
- '59.##.235.229':139
- '59.#0.6.132':139
- '59.##.203.23':139
- '59.##.42.148':139
- '59.##.74.164':139
- '59.#0.18.2':139
- '59.##.130.36':139
- '59.##.206.19':139
- '59.##.250.88':139
- '59.#0.203.7':139
- '59.##.20.175':139
- '59.#0.0.24':139
- '59.##.180.207':139
- '59.#0.87.65':139
- '59.##.103.178':139
- '59.##.15.141':139
- '59.##.162.224':139
- '59.##.224.52':139
- '59.##.107.58':139
- '59.##.92.158':139
- '59.#0.53.0':139
- '59.##.211.62':139
- '59.#0.63.91':139
- '59.#0.1.12':139
- '59.##.11.211':139
- '59.##.12.229':139
- '59.#0.1.12':445
- '59.##.11.211':445
- '59.##.224.52':445
- '59.#0.53.0':445
- '59.##.211.62':445
- '59.##.103.178':445
- '59.#0.87.65':445
- '59.#0.63.91':445
- '59.#0.203.7':445
- '59.#0.36.68':445
- '59.##.67.157':445
- '59.#0.84.69':445
- '59.##.132.36':445
- '59.##.130.36':445
- '59.##.92.158':445
- '59.##.162.224':445
- '59.##.156.166':445
- '59.##.107.58':445
- '59.##.250.88':445
- '59.#0.18.16':139
- '59.#0.6.152':139
- '59.#0.191.7':139
- '59.##.184.17':139
- '59.##.119.34':139
- '59.##.239.60':139
- '59.##.60.115':139
- '59.##.125.254':139
- '59.##.207.207':139
- '59.##.15.141':445
- '59.##.206.19':445
- '59.##.180.207':445
- '59.##.20.175':445
- '59.#0.0.24':445
- '59.#0.137.2':139
- '59.##.96.196':139
- '59.##.106.229':139
- '59.##.167.207':139
