Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERa803.dir00\svchost.exe.mdmp 16325836412032108
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa803.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '14.##1.83.14':445
- '14.##1.227.172':445
- '14.##1.42.236':445
- '14.##1.167.82':445
- '14.##1.53.96':445
- '14.##1.22.163':445
- '14.##1.181.19':445
- '14.##1.234.210':445
- '14.##1.23.138':445
- '14.##1.159.73':9988
- '14.##1.189.27':9988
- '14.##1.132.126':9988
- '14.##1.89.63':9988
- '14.##1.220.137':9988
- '14.#51.13.6':445
- '14.##1.51.107':445
- '14.##1.181.19':9988
- '14.##1.223.226':9988
- '14.##1.38.20':445
- '14.##1.140.42':445
- '14.##1.66.155':445
- '14.##1.154.188':445
- '14.##1.206.107':445
- '14.##1.216.52':445
- '14.##1.151.142':445
- '14.##1.80.158':445
- '14.##1.44.16':445
- '14.##1.108.9':445
- '14.##1.26.69':445
- '14.##1.65.253':445
- '14.##1.251.46':445
- '14.##1.80.206':445
- '14.##1.210.114':445
- '14.##1.155.43':445
- '14.##1.133.74':445
- '14.##1.88.187':445
- '14.##1.234.210':9988
- '14.##1.0.252':9988
- '14.##1.80.206':9988
- '14.##1.251.46':9988
- '14.##1.167.82':9988
- '14.##1.210.114':9988
- '14.##1.88.187':9988
- '14.##1.227.172':9988
- '14.##1.155.43':9988
- '14.##1.22.163':9988
- '14.##1.53.248':9988
- '14.##1.42.236':9988
- '14.#51.13.6':9988
- '14.##1.51.107':9988
- '14.##1.33.190':9988
- '14.##1.26.69':9988
- '14.##1.83.14':9988
- '14.##1.53.96':9988
- '14.##1.221.202':9988
- '14.##1.112.38':9988
- '14.##1.151.142':9988
- '14.##1.21.207':9988
- '14.##1.28.53':9988
- '14.##1.127.159':9988
- '14.##1.178.224':9988
- '14.##1.126.170':9988
- '14.##1.204.144':9988
- '14.##1.65.253':9988
- '14.##1.66.155':9988
- '14.##1.216.52':9988
- '14.##1.133.74':9988
- '14.##1.206.107':9988
- '14.##1.80.158':9988
- '14.##1.38.20':9988
- '14.##1.154.188':9988
- '14.##1.44.16':9988
- '14.##1.21.207':445
- '14.##1.44.16':139
- '14.##1.216.52':139
- '14.##1.206.107':139
- '14.##1.80.158':139
- '14.##1.151.142':139
- '14.##1.53.248':139
- '14.##1.0.252':139
- '14.##1.21.207':139
- '14.##1.33.190':139
- '14.##1.88.187':139
- '14.##1.210.114':139
- '14.##1.80.206':139
- '14.##1.133.74':139
- '14.##1.155.43':139
- '14.##1.38.20':139
- '14.##1.140.42':139
- '14.##1.66.155':139
- '14.##1.154.188':139
- '14.#51.2.23':139
- '14.##1.127.159':139
- '14.##1.104.73':139
- '14.##1.89.63':139
- '14.##1.220.137':139
- '14.##1.223.226':139
- '14.##1.137.250':139
- '14.##1.28.53':139
- '14.##1.189.27':139
- '14.##1.159.73':139
- '14.##1.112.38':139
- '14.##1.221.202':139
- '14.##1.11.81':139
- '14.##1.204.144':139
- '14.##1.26.214':139
- '14.##1.178.224':139
- '14.##1.132.126':139
- '14.##1.126.170':139
- '14.##1.178.224':445
- '14.##1.104.73':445
- '14.##1.126.170':445
- '14.##1.26.214':445
- '14.##1.28.53':445
- '14.##1.189.27':445
- '14.##1.137.250':445
- '14.##1.89.63':445
- '14.##1.220.137':445
- '14.##1.0.252':445
- '14.##1.221.202':445
- '14.##1.33.190':445
- '14.##1.53.248':445
- '14.##1.11.81':445
- '14.##1.204.144':445
- '14.##1.132.126':445
- '14.##1.159.73':445
- '14.##1.112.38':445
- '14.##1.23.138':139
- '14.##1.181.19':139
- '14.##1.53.96':139
- '14.##1.234.210':139
- '14.##1.22.163':139
- '14.##1.108.9':139
- '14.##1.26.69':139
- '14.##1.65.253':139
- '14.##1.251.46':139
- '14.##1.223.226':445
- '14.#51.13.6':139
- '14.#51.2.23':445
- '14.##1.127.159':445
- '14.##1.51.107':139
- '14.##1.83.14':139
- '14.##1.227.172':139
- '14.##1.42.236':139
- '14.##1.167.82':139
