Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERbaeb.dir00\svchost.exe.mdmp 16325836412032192
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERbaeb.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '68.##0.123.32':445
- '68.##0.123.47':445
- '68.##0.116.137':9988
- '68.##0.244.250':9988
- '68.##0.25.252':445
- '68.##0.239.160':445
- '68.##0.244.250':445
- '68.##0.71.225':445
- '68.##0.13.236':445
- '68.##0.160.2':9988
- '68.##0.23.120':9988
- '68.##0.94.121':9988
- '68.##0.212.120':9988
- '68.##0.87.38':9988
- '68.##0.151.225':9988
- '68.##0.42.31':9988
- '68.##0.63.176':9988
- '68.##0.140.197':9988
- '68.##0.75.155':9988
- '68.##0.151.15':445
- '68.##0.22.140':445
- '68.##0.77.83':445
- '68.##0.32.159':445
- '68.##0.16.182':445
- '68.##0.63.176':445
- '68.##0.39.24':445
- '68.##0.73.132':445
- '68.#50.10.0':445
- '68.##0.211.103':445
- '68.##0.64.192':445
- '68.##0.169.48':445
- '68.##0.69.144':445
- '68.##0.28.223':445
- '68.##0.232.31':445
- '68.##0.221.237':445
- '68.##0.44.76':445
- '68.##0.135.122':445
- '68.##0.54.137':445
- '68.##0.135.122':9988
- '68.##0.169.48':9988
- '68.##0.13.236':9988
- '68.##0.69.144':9988
- '68.##0.221.237':9988
- '68.##0.51.250':9988
- '68.##0.30.221':9988
- '68.##0.123.47':9988
- '68.##0.44.76':9988
- '68.##0.239.160':9988
- '68.##0.89.137':9988
- '68.##0.90.159':9988
- '68.##0.28.223':9988
- '68.##0.211.103':9988
- '68.##0.47.228':9988
- '68.##0.123.32':9988
- '68.##0.45.108':9988
- '68.##0.180.221':9988
- '68.##0.25.252':9988
- '68.##0.32.159':9988
- '68.##0.77.83':9988
- '68.##0.138.161':9988
- '68.#50.10.0':9988
- '68.##0.27.105':9988
- '68.##0.129.107':9988
- '68.##0.102.139':9988
- '68.##0.31.122':9988
- '68.##0.241.133':9988
- '68.##0.22.140':9988
- '68.##0.64.192':9988
- '68.##0.16.182':9988
- '68.##0.232.31':9988
- '68.##0.39.24':9988
- '68.##0.73.132':9988
- '68.##0.54.137':9988
- '68.##0.151.15':9988
- '68.##0.255.192':9988
- '68.##0.48.118':9988
- '68.##0.39.24':139
- '68.##0.48.118':139
- '68.#50.10.0':139
- '68.##0.63.176':139
- '68.##0.129.107':139
- '68.##0.241.133':139
- '68.##0.87.38':139
- '68.##0.255.192':139
- '68.##0.212.120':139
- '68.##0.73.132':139
- '68.##0.44.76':139
- '68.##0.211.103':139
- '68.##0.54.137':139
- '68.##0.221.237':139
- '68.##0.77.83':139
- '68.##0.22.140':139
- '68.##0.16.182':139
- '68.##0.32.159':139
- '68.##0.151.15':139
- '68.##0.180.221':139
- '68.##0.138.161':139
- '68.##0.116.137':139
- '68.##0.47.228':139
- '68.##0.30.221':139
- '68.##0.160.2':139
- '68.##0.31.122':139
- '68.##0.90.159':139
- '68.##0.42.31':139
- '68.##0.75.155':139
- '68.##0.23.120':139
- '68.##0.94.121':139
- '68.##0.51.250':139
- '68.##0.140.197':139
- '68.##0.45.108':139
- '68.##0.89.137':139
- '68.##0.27.105':139
- '68.##0.151.225':139
- '68.##0.102.139':139
- '68.##0.102.139':445
- '68.##0.89.137':445
- '68.##0.45.108':445
- '68.##0.151.225':445
- '68.##0.27.105':445
- '68.##0.47.228':445
- '68.##0.90.159':445
- '68.##0.75.155':445
- '68.##0.116.137':445
- '68.##0.94.121':445
- '68.##0.255.192':445
- '68.##0.212.120':445
- '68.##0.48.118':445
- '68.##0.129.107':445
- '68.##0.241.133':445
- '68.##0.140.197':445
- '68.##0.23.120':445
- '68.##0.87.38':445
- '68.##0.51.250':445
- '68.##0.244.250':139
- '68.##0.69.144':139
- '68.##0.13.236':139
- '68.##0.239.160':139
- '68.##0.28.223':139
- '68.##0.232.31':139
- '68.##0.135.122':139
- '68.##0.64.192':139
- '68.##0.169.48':139
- '68.##0.71.225':139
- '68.##0.42.31':445
- '68.##0.138.161':445
- '68.##0.180.221':445
- '68.##0.31.122':445
- '68.##0.160.2':445
- '68.##0.123.47':139
- '68.##0.25.252':139
- '68.##0.30.221':445
- '68.##0.123.32':139
