Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1156 -dm 7 7 %TEMP%\WERb64f.dir00\svchost.exe.mdmp 16325836412029524
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERb64f.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '22#.#43.217.133':445
- '22#.#43.251.215':445
- '22#.#43.70.12':445
- '22#.#43.82.78':445
- '22#.#43.231.27':445
- '22#.#43.237.119':445
- '22#.#43.88.244':445
- '22#.#43.65.250':445
- '22#.#43.115.218':445
- '22#.#43.25.32':445
- '22#.#43.119.106':9988
- '22#.#43.182.75':9988
- '22#.#43.106.150':9988
- '22#.#43.23.219':9988
- '22#.#43.251.215':9988
- '22#.#43.184.143':9988
- '22#.#43.172.167':9988
- '22#.#43.25.49':9988
- '22#.#43.96.11':9988
- '22#.#43.19.172':445
- '22#.#43.172.119':445
- '22#.#43.25.49':445
- '22#.#43.10.20':445
- '22#.#43.16.160':445
- '22#.#43.124.96':445
- '22#.#43.189.162':445
- '22#.#43.102.9':445
- '22#.#43.61.254':445
- '22#.#43.162.149':445
- '22#.#43.154.150':445
- '22#.#43.216.176':445
- '22#.#43.235.51':445
- '22#.#43.222.236':445
- '22#.#43.156.248':445
- '22#.#43.208.181':445
- '22#.#43.185.127':445
- '22#.#43.189.75':445
- '22#.#43.84.175':445
- '22#.#43.43.0':9988
- '22#.#43.237.119':9988
- '22#.#43.111.87':9988
- '22#.#43.61.254':9988
- '22#.#43.189.162':9988
- '22#.#43.222.236':9988
- '22#.#43.84.175':9988
- '22#.#43.146.133':9988
- '22#.#43.189.75':9988
- '22#.#43.88.244':9988
- '22#.#43.115.218':9988
- '22#.#43.217.133':9988
- '22#.#43.25.32':9988
- '22#.#43.70.12':9988
- '22#.#43.235.51':9988
- '22#.#43.82.78':9988
- '22#.#43.231.27':9988
- '22#.#43.178.216':9988
- '22#.#43.65.250':9988
- '22#.#43.208.181':9988
- '22#.#43.0.154':9988
- '22#.#43.32.132':9988
- '22#.#43.102.9':9988
- '22#.#43.36.227':9988
- '22#.#43.10.24':9988
- '22#.#43.11.220':9988
- '22#.#43.219.126':9988
- '22#.#43.120.30':9988
- '22#.#43.149.185':9988
- '22#.#43.162.238':9988
- '22#.#43.162.149':9988
- '22#.#43.185.127':9988
- '22#.#43.216.176':9988
- '22#.#43.10.20':9988
- '22#.#43.71.86':9988
- '22#.#43.47.115':9988
- '22#.#43.172.119':9988
- '22#.#43.124.96':9988
- '22#.#43.67.188':9988
- '22#.#43.124.96':139
- '22#.#43.189.162':139
- '22#.#43.102.9':139
- '22#.#43.61.254':139
- '22#.#43.162.238':139
- '22#.#43.10.24':139
- '22#.#43.0.154':139
- '22#.#43.178.216':139
- '22#.#43.47.115':139
- '22#.#43.16.160':139
- '22#.#43.208.181':139
- '22#.#43.185.127':139
- '22#.#43.189.75':139
- '22#.#43.84.175':139
- '22#.#43.162.149':139
- '22#.#43.19.172':139
- '22#.#43.172.119':139
- '22#.#43.25.49':139
- '22#.#43.10.20':139
- '22#.#43.220.28':139
- '22#.#43.146.133':139
- '22#.#43.182.75':139
- '22#.#43.96.11':139
- '22#.#43.11.220':139
- '22#.#43.172.167':139
- '22#.#43.119.106':139
- '22#.#43.111.87':139
- '22#.#43.184.143':139
- '22#.#43.67.188':139
- '22#.#43.71.86':139
- '22#.#43.43.0':139
- '22#.#43.32.132':139
- '22#.#43.106.150':139
- '22#.#43.120.30':139
- '22#.#43.219.126':139
- '22#.#43.149.185':139
- '22#.#43.36.227':139
- '22#.#43.23.219':139
- '22#.#43.156.248':139
- '22#.#43.219.126':445
- '22#.#43.149.185':445
- '22#.#43.36.227':445
- '22#.#43.23.219':445
- '22#.#43.67.188':445
- '22#.#43.220.28':445
- '22#.#43.96.11':445
- '22#.#43.11.220':445
- '22#.#43.111.87':445
- '22#.#43.120.30':445
- '22#.#43.47.115':445
- '22#.#43.10.24':445
- '22#.#43.162.238':445
- '22#.#43.178.216':445
- '22#.#43.0.154':445
- '22#.#43.71.86':445
- '22#.#43.43.0':445
- '22#.#43.32.132':445
- '22#.#43.106.150':445
- '22#.#43.115.218':139
- '22#.#43.237.119':139
- '22#.#43.231.27':139
- '22#.#43.65.250':139
- '22#.#43.88.244':139
- '22#.#43.154.150':139
- '22#.#43.216.176':139
- '22#.#43.235.51':139
- '22#.#43.222.236':139
- '22#.#43.251.215':139
- '22#.#43.146.133':445
- '22#.#43.184.143':445
- '22#.#43.182.75':445
- '22#.#43.119.106':445
- '22#.#43.172.167':445
- '22#.#43.70.12':139
- '22#.#43.217.133':139
- '22#.#43.25.32':139
- '22#.#43.82.78':139
