Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER2c71.dir00\svchost.exe.mdmp 16325836412032340
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER2c71.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Сетевая активность:
Подключается к:
- '65.##4.15.24':9988
- '65.##4.57.65':445
- '65.##4.110.205':9988
- '65.##4.186.186':9988
- '65.##4.4.166':445
- '65.##4.9.174':445
- '65.##4.56.200':445
- '65.##4.254.148':445
- '65.##4.128.171':445
- '65.##4.68.185':9988
- '65.##4.150.11':9988
- '65.##4.58.20':9988
- '65.##4.64.215':9988
- '65.##4.215.37':9988
- '65.##4.203.174':9988
- '65.##4.210.47':9988
- '65.##4.24.178':9988
- '65.##4.131.200':9988
- '65.##4.155.61':9988
- '65.##4.234.88':445
- '65.##4.131.200':445
- '65.##4.43.228':445
- '65.##4.22.43':445
- '65.##4.227.120':445
- '65.##4.114.128':445
- '65.##4.9.234':445
- '65.##4.210.47':445
- '65.##4.58.20':445
- '65.##4.150.11':445
- '65.##4.180.32':445
- '65.##4.122.97':445
- '65.##4.88.162':445
- '65.##4.60.244':445
- '65.##4.187.128':445
- '65.#14.6.18':445
- '65.##4.215.37':445
- '65.##4.152.84':445
- '65.##4.121.22':445
- '65.##4.38.18':9988
- '65.#14.6.18':9988
- '65.##4.234.88':9988
- '65.##4.180.32':9988
- '65.##4.121.22':9988
- '65.##4.118.111':9988
- '65.##4.60.244':9988
- '65.##4.111.100':9988
- '65.##4.10.80':9988
- '65.##4.114.128':9988
- '65.##4.22.43':9988
- '65.##4.132.159':9988
- '65.##4.199.44':9988
- '65.##4.187.128':9988
- '65.##4.9.234':9988
- '65.##4.32.26':9988
- '65.##4.26.174':9988
- '65.##4.232.197':9988
- '65.##4.178.27':9988
- '65.##4.88.162':9988
- '65.##4.95.136':9988
- '65.##4.177.47':9988
- '65.##4.122.97':9988
- '65.##4.56.200':9988
- '65.##4.57.65':9988
- '65.##4.43.228':9988
- '65.##4.23.118':9988
- '65.##4.235.20':9988
- '65.#14.17.8':9988
- '65.##4.177.46':9988
- '65.##4.4.166':9988
- '65.##4.227.120':9988
- '65.##4.152.84':9988
- '65.##4.128.171':9988
- '65.##4.9.174':9988
- '65.##4.103.144':9988
- '65.##4.20.204':9988
- '65.##4.254.148':9988
- '65.##4.111.100':445
- '65.##4.111.100':139
- '65.##4.186.186':139
- '65.##4.150.11':139
- '65.##4.9.234':139
- '65.##4.232.197':139
- '65.##4.118.111':139
- '65.##4.68.185':139
- '65.##4.15.24':139
- '65.##4.23.118':139
- '65.#14.6.18':139
- '65.##4.121.22':139
- '65.##4.22.43':139
- '65.##4.131.200':139
- '65.##4.227.120':139
- '65.##4.43.228':139
- '65.##4.114.128':139
- '65.##4.215.37':139
- '65.##4.210.47':139
- '65.##4.58.20':139
- '65.##4.177.47':139
- '65.##4.110.205':139
- '65.##4.199.44':139
- '65.##4.132.159':139
- '65.##4.177.46':139
- '65.##4.64.215':139
- '65.##4.155.61':139
- '65.##4.10.80':139
- '65.##4.95.136':139
- '65.##4.38.18':139
- '65.##4.203.174':139
- '65.##4.178.27':139
- '65.##4.103.144':139
- '65.##4.20.204':139
- '65.##4.24.178':139
- '65.#14.17.8':139
- '65.##4.235.20':139
- '65.##4.32.26':139
- '65.##4.26.174':139
- '65.##4.178.27':445
- '65.##4.177.46':445
- '65.##4.203.174':445
- '65.##4.24.178':445
- '65.#14.17.8':445
- '65.##4.26.174':445
- '65.##4.10.80':445
- '65.##4.95.136':445
- '65.##4.32.26':445
- '65.##4.20.204':445
- '65.##4.186.186':445
- '65.##4.103.144':445
- '65.##4.15.24':445
- '65.##4.232.197':445
- '65.##4.23.118':445
- '65.##4.68.185':445
- '65.##4.64.215':445
- '65.##4.132.159':445
- '65.##4.118.111':445
- '65.##4.254.148':139
- '65.##4.88.162':139
- '65.##4.180.32':139
- '65.##4.128.171':139
- '65.##4.187.128':139
- '65.##4.56.200':139
- '65.##4.234.88':139
- '65.##4.152.84':139
- '65.##4.60.244':139
- '65.##4.9.174':139
- '65.##4.38.18':445
- '65.##4.199.44':445
- '65.##4.155.61':445
- '65.##4.177.47':445
- '65.##4.235.20':445
- '65.##4.57.65':139
- '65.##4.122.97':139
- '65.##4.110.205':445
- '65.##4.4.166':139
