Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERa364.dir00\svchost.exe.mdmp 16325836412032280
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERa364.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '21#.#83.212.59':139
- '21#.#83.4.31':139
- '21#.#83.185.123':139
- '21#.#83.52.132':139
- '21#.#83.177.177':139
- '21#.#83.6.137':139
- '21#.#83.123.74':139
- '21#.#83.139.56':139
- '21#.#83.139.229':139
- '21#.#83.228.10':139
- '21#.#83.74.145':139
- '21#.#83.146.64':139
- '21#.#83.117.5':139
- '21#.#83.173.157':139
- '21#.#83.5.48':139
- '21#.#83.217.157':139
- '21#.#83.51.168':139
- '21#.#83.9.158':139
- '21#.#83.255.147':139
- '21#.#83.253.148':139
- '21#.#83.223.68':139
- '21#.#83.15.203':139
- '21#.#83.203.226':139
- '21#.#83.169.87':139
- '21#.#83.48.116':139
- '21#.#83.56.125':139
- '21#.#83.10.239':139
- '21#.#83.27.106':139
- '21#.#83.59.74':139
- '21#.#83.252.152':139
- '21#.#83.196.176':139
- '21#.#83.60.113':139
- '21#.#83.211.6':139
- '21#.#83.44.14':139
- '21#.#83.179.6':9988
- '21#.#83.9.43':9988
- '21#.#83.57.205':9988
- '21#.#83.73.59':139
- '21#.#83.9.218':9988
- '21#.#83.82.225':9988
- '21#.#83.150.53':139
- '21#.#83.35.62':139
- '21#.#83.4.166':139
- '21#.#83.189.125':139
- '21#.#83.140.36':139
- '21#.#83.87.209':139
- '21#.#83.34.147':139
- '21#.#83.85.188':139
- '21#.#83.53.154':139
- '21#.#83.16.147':139
- '21#.#83.104.223':139
- '21#.#83.58.250':139
- '21#.#83.97.164':139
- '21#.#83.113.52':139
- '21#.#83.52.132':445
- '21#.#83.177.177':445
- '21#.#83.6.137':445
- '21#.#83.223.68':445
- '21#.#83.15.203':445
- '21#.#83.203.226':445
- '21#.#83.212.59':445
- '21#.#83.74.145':445
- '21#.#83.146.64':445
- '21#.#83.117.5':445
- '21#.#83.4.31':445
- '21#.#83.185.123':445
- '21#.#83.123.74':445
- '21#.#83.51.168':445
- '21#.#83.9.158':445
- '21#.#83.255.147':445
- '21#.#83.187.83':445
- '21#.#83.124.137':445
- '21#.#83.113.52':445
- '21#.#83.173.157':445
- '21#.#83.169.87':445
- '21#.#83.48.116':445
- '21#.#83.56.125':445
- '21#.#83.5.48':445
- '21#.#83.217.157':445
- '21#.#83.253.148':445
- '21#.#83.139.56':445
- '21#.#83.196.176':445
- '21#.#83.60.113':445
- '21#.#83.211.6':445
- '21#.#83.85.188':445
- '21#.#83.53.154':445
- '21#.#83.16.147':445
- '21#.#83.27.106':445
- '21#.#83.73.59':445
- '21#.#83.187.83':139
- '21#.#83.124.137':139
- '21#.#83.59.74':445
- '21#.#83.252.152':445
- '21#.#83.44.14':445
- '21#.#83.189.125':445
- '21#.#83.140.36':445
- '21#.#83.87.209':445
- '21#.#83.139.229':445
- '21#.#83.228.10':445
- '21#.#83.10.239':445
- '21#.#83.150.53':445
- '21#.#83.104.223':445
- '21#.#83.58.250':445
- '21#.#83.97.164':445
- '21#.#83.35.62':445
- '21#.#83.4.166':445
- '21#.#83.34.147':445
- '21#.#83.248.63':9988
- '21#.#83.188.83':139
- '21#.#83.109.189':139
- '21#.#83.60.38':139
- '21#.#83.11.177':139
- '21#.#83.191.158':139
- '21#.#83.121.188':139
- '21#.#83.198.74':139
- '21#.#83.242.173':139
- '21#.#83.179.6':139
- '21#.#83.9.43':139
- '21#.#83.63.59':139
- '21#.#83.210.203':139
- '21#.#83.51.13':139
- '21#.#83.56.144':139
- '21#.#83.50.68':139
- '21#.#83.152.207':139
- '21#.#83.192.180':445
- '21#.#83.86.199':445
- '21#.#83.163.0':139
- '21#.#83.33.215':139
- '21#.#83.144.12':139
- '21#.#83.196.105':139
- '21#.#83.9.218':139
- '21#.#83.234.106':139
- '21#.#83.147.213':139
- '21#.#83.82.225':139
- '21#.#83.33.94':139
- '21#.#83.118.154':139
- '21#.#83.44.82':139
- '21#.#83.56.223':139
- '21#.#83.205.63':139
- '21#.#83.30.69':139
- '21#.#83.234.117':139
- '21#.#83.158.103':139
- '21#.#83.192.180':139
- '21#.#83.86.199':139
- '21#.#83.87.59':139
- '21#.#83.167.79':139
- '21#.#83.51.111':139
- '21#.#83.71.126':139
- '21#.#83.255.63':139
- '21#.#83.250.18':139
- '21#.#83.23.141':139
- '21#.#83.116.9':139
- '21#.#83.17.16':139
- '21#.#83.35.100':139
- '21#.#83.99.60':139
- '21#.#83.58.130':139
- '21#.#83.145.58':139
- '21#.#83.57.205':139
- '21#.#83.87.80':139
- '21#.#83.248.63':139
- '21#.#83.125.150':139
- '21#.#83.51.111':445
- '21#.#83.11.177':445
- '21#.#83.191.158':445
- '21#.#83.121.188':445
- '21#.#83.144.12':445
- '21#.#83.196.105':445
- '21#.#83.9.218':445
- '21#.#83.188.83':445
- '21#.#83.63.59':445
- '21#.#83.210.203':445
- '21#.#83.51.13':445
- '21#.#83.109.189':445
- '21#.#83.60.38':445
- '21#.#83.198.74':445
- '21#.#83.234.117':9988
- '21#.#83.86.199':9988
- '21#.#83.163.0':445
- '21#.#83.58.130':9988
- '21#.#83.205.63':9988
- '21#.#83.56.223':9988
- '21#.#83.56.144':445
- '21#.#83.234.106':445
- '21#.#83.147.213':445
- '21#.#83.82.225':445
- '21#.#83.50.68':445
- '21#.#83.152.207':445
- '21#.#83.33.215':445
- '21#.#83.242.173':445
- '21#.#83.205.63':445
- '21#.#83.30.69':445
- '21#.#83.234.117':445
- '21#.#83.58.130':445
- '21#.#83.145.58':445
- '21#.#83.57.205':445
- '21#.#83.118.154':445
- '21#.#83.87.59':445
- '21#.#83.167.79':445
- '21#.#83.56.223':445
- '21#.#83.158.103':445
- '21#.#83.44.82':445
- '21#.#83.71.126':445
- '21#.#83.116.9':445
- '21#.#83.17.16':445
- '21#.#83.35.100':445
- '21#.#83.179.6':445
- '21#.#83.9.43':445
- '21#.#83.33.94':445
- '21#.#83.255.63':445
- '21#.#83.87.80':445
- '21#.#83.248.63':445
- '21#.#83.125.150':445
- '21#.#83.250.18':445
- '21#.#83.23.141':445
- '21#.#83.99.60':445
