Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERb1d9.dir00\svchost.exe.mdmp 16325836412030760
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERb1d9.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '12.##8.58.168':9988
- '12.##8.173.170':445
- '12.##8.222.42':9988
- '12.##8.137.253':9988
- '12.##8.241.172':445
- '12.##8.125.13':445
- '12.##8.89.168':445
- '12.##8.141.157':445
- '12.##8.13.197':445
- '12.##8.27.112':9988
- '12.##8.232.12':9988
- '12.##8.119.112':9988
- '12.##8.249.38':9988
- '12.##8.31.248':9988
- '12.##8.33.148':9988
- '12.##8.225.107':9988
- '12.##8.76.33':9988
- '12.##8.86.55':9988
- '12.##8.191.75':9988
- '12.##8.228.52':445
- '12.##8.186.236':445
- '12.##8.114.133':445
- '12.##8.99.150':445
- '12.##8.245.8':445
- '12.##8.40.247':445
- '12.##8.45.52':445
- '12.##8.135.155':445
- '12.##8.155.228':445
- '12.##8.162.129':445
- '12.##8.247.219':445
- '12.##8.130.174':445
- '12.##8.62.157':445
- '12.##8.96.123':445
- '12.##8.192.90':445
- '12.##8.53.204':445
- '12.##8.97.147':445
- '12.##8.157.53':445
- '12.##8.148.15':445
- '12.##8.45.106':445
- '12.##8.104.244':445
- '12.##8.89.224':445
- '12.##8.240.71':445
- '12.##8.22.215':445
- '12.##8.4.218':139
- '12.##8.244.152':139
- '12.##8.68.54':139
- '12.##8.6.198':139
- '12.##8.230.106':445
- '12.##8.4.218':445
- '12.##8.244.152':445
- '12.##8.68.54':445
- '12.##8.6.198':445
- '12.##8.37.65':445
- '12.##8.220.149':445
- '12.##8.32.52':445
- '12.##8.62.39':445
- '12.##8.218.52':445
- '12.##8.159.247':9988
- '12.##8.238.22':9988
- '12.##8.22.215':139
- '12.##8.247.184':9988
- '12.##8.106.80':9988
- '12.##8.76.114':9988
- '12.##8.83.68':9988
- '12.##8.185.27':9988
- '12.##8.221.85':9988
- '12.##8.104.244':139
- '12.##8.218.52':139
- '12.##8.220.149':139
- '12.##8.62.39':139
- '12.##8.37.65':139
- '12.##8.32.52':139
- '12.##8.240.71':139
- '12.##8.45.106':139
- '12.##8.230.106':139
- '12.##8.89.224':139
- '12.##8.217.247':445
- '12.##8.38.76':139
- '12.##8.217.247':139
- '12.##8.228.52':139
- '12.##8.45.52':139
- '12.##8.247.184':139
- '12.##8.238.22':139
- '12.##8.159.247':139
- '12.##8.185.27':139
- '12.##8.106.80':139
- '12.##8.155.228':139
- '12.##8.192.90':139
- '12.##8.114.133':139
- '12.##8.148.15':139
- '12.##8.97.147':139
- '12.##8.186.236':139
- '12.##8.40.247':139
- '12.##8.135.155':139
- '12.##8.245.8':139
- '12.##8.99.150':139
- '12.##8.86.55':139
- '12.##8.83.68':139
- '12.##8.27.112':139
- '12.##8.191.75':139
- '12.##8.76.33':139
- '12.##8.119.112':139
- '12.##8.43.154':139
- '12.##8.225.107':139
- '12.##8.33.148':139
- '12.##8.137.253':139
- '12.##8.249.38':139
- '12.##8.31.248':139
- '12.##8.237.35':139
- '12.##8.76.114':139
- '12.##8.222.42':139
- '12.##8.58.168':139
- '12.##8.201.85':139
- '12.##8.221.85':139
- '12.##8.232.12':139
- '12.##8.232.12':445
- '12.##8.58.168':445
- '12.##8.222.42':445
- '12.##8.221.85':445
- '12.##8.119.112':445
- '12.##8.191.75':445
- '12.##8.137.253':445
- '12.##8.76.33':445
- '12.##8.225.107':445
- '12.##8.249.38':445
- '12.##8.185.27':445
- '12.##8.106.80':445
- '12.##8.38.76':445
- '12.##8.247.184':445
- '12.##8.238.22':445
- '12.##8.76.114':445
- '12.##8.31.248':445
- '12.##8.159.247':445
- '12.##8.237.35':445
- '12.##8.247.219':139
- '12.##8.130.174':139
- '12.##8.141.157':139
- '12.##8.13.197':139
- '12.##8.62.157':139
- '12.##8.53.204':139
- '12.##8.162.129':139
- '12.##8.96.123':139
- '12.##8.157.53':139
- '12.##8.125.13':139
- '12.##8.83.68':445
- '12.##8.33.148':445
- '12.##8.201.85':445
- '12.##8.27.112':445
- '12.##8.86.55':445
- '12.##8.89.168':139
- '12.##8.241.172':139
- '12.##8.43.154':445
- '12.##8.173.170':139
