Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERb605.dir00\svchost.exe.mdmp 16325836412030992
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERb605.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '67.#.164.49':139
- '67.#.181.253':139
- '67.#.10.73':139
- '67.#.246.163':139
- '67.#.158.114':139
- '67.#.81.67':139
- '67.#.67.246':139
- '67.#.197.69':445
- '67.#.70.102':445
- '67.#.213.242':445
- '67.#.129.56':445
- '67.#.72.91':139
- '67.#.78.245':445
- '67.#.210.24':445
- '67.#.190.38':139
- '67.#.118.78':139
- '67.#.81.201':139
- '67.#.199.181':139
- '67.#.80.200':139
- '67.#.37.10':139
- '67.#.10.77':139
- '67.#.84.253':139
- '67.#.35.33':139
- '67.#.99.29':139
- '67.#.44.177':139
- '67.#.156.215':139
- '67.#.130.247':139
- '67.#.184.1':139
- '67.#.156.140':139
- '67.#.70.102':139
- '67.#.213.242':139
- '67.#.39.234':139
- '67.#.197.69':139
- '67.#.78.245':139
- '67.#.210.24':139
- '67.#.129.56':139
- '67.#.52.150':139
- '67.#.50.123':139
- '67.#.109.184':139
- '67.#.80.163':139
- '67.#.41.189':139
- '67.#.8.20':139
- '67.#.85.181':139
- '67.#.122.184':445
- '67.#.80.163':445
- '67.#.52.150':445
- '67.#.50.123':445
- '67.#.85.181':445
- '67.#.39.234':445
- '67.#.41.189':445
- '67.#.8.20':445
- '67.#.121.37':445
- '67.#.95.221':445
- '67.#.107.182':445
- '67.#.8.222':445
- '67.#.109.184':445
- '67.#.94.92':445
- '67.#.56.206':445
- '67.#.147.32':139
- '67.#.133.98':139
- '67.#.177.190':445
- '67.#.120.244':139
- '67.#.233.118':139
- '67.#.244.101':139
- '67.#.95.144':139
- '67.#.25.31':445
- '67.#.11.200':445
- '67.#.37.10':445
- '67.#.91.182':445
- '67.#.190.69':445
- '67.#.69.83':445
- '67.#.83.91':445
- '67.#.149.186':139
- '67.#.229.64':139
- '67.#.146.225':139
- '67.#.32.189':139
- '67.#.37.186':139
- '67.#.212.242':139
- '67.#.54.178':139
- '67.#.46.3':139
- '67.#.43.16':139
- '67.#.142.196':139
- '67.#.216.171':139
- '67.#.196.45':139
- '67.#.176.140':139
- '67.#.9.178':139
- '67.#.193.73':139
- '67.#.181.253':445
- '67.#.10.73':445
- '67.#.72.91':445
- '67.#.164.49':445
- '67.#.81.67':445
- '67.#.67.246':445
- '67.#.246.163':445
- '67.#.91.182':139
- '67.#.25.31':139
- '67.#.11.200':139
- '67.#.83.91':139
- '67.#.177.190':139
- '67.#.190.69':139
- '67.#.69.83':139
- '67.#.158.114':445
- '67.#.81.201':445
- '67.#.199.181':445
- '67.#.130.247':445
- '67.#.118.78':445
- '67.#.10.77':445
- '67.#.84.253':445
- '67.#.80.200':445
- '67.#.99.29':445
- '67.#.44.177':445
- '67.#.190.38':445
- '67.#.35.33':445
- '67.#.184.1':445
- '67.#.156.140':445
- '67.#.156.215':445
- '67.#.94.92':139
- '67.#.156.24':139
- '67.#.111.214':139
- '67.#.54.125':139
- '67.#.19.194':139
- '67.#.121.91':139
- '67.#.24.31':139
- '67.#.175.202':139
- '67.#.254.159':139
- '67.#.215.197':139
- '67.#.118.60':139
- '67.#.216.30':139
- '67.#.71.235':139
- '67.#.174.33':139
- '67.#.197.43':139
- '67.#.9.84':139
- '67.#.17.81':445
- '67.#.217.251':445
- '67.#.229.72':445
- '67.#.138.71':445
- '67.#.157.253':445
- '67.#.211.191':445
- '67.#.53.105':445
- '67.#.95.104':139
- '67.#.65.139':139
- '67.#.12.83':139
- '67.#.39.39':139
- '67.#.1.62':139
- '67.#.240.104':139
- '67.#.68.44':139
- '67.#.251.228':139
- '67.#.134.17':139
- '67.#.35.187':139
- '67.#.246.28':139
- '67.#.19.52':139
- '67.#.229.72':139
- '67.#.211.191':139
- '67.#.157.253':139
- '67.#.67.56':139
- '67.#.187.161':139
- '67.#.42.155':139
- '67.#.71.248':139
- '67.#.99.248':139
- '67.#.217.251':139
- '67.#.17.81':139
- '67.#.188.85':139
- '67.#.154.36':139
- '67.#.116.117':139
- '67.#.168.73':139
- '67.#.181.220':139
- '67.#.4.35':139
- '67.#.38.127':139
- '67.#.106.114':139
- '67.#.53.105':139
- '67.#.138.71':139
- '67.#.16.30':139
- '67.#.44.204':139
- '67.#.205.62':139
- '67.#.5.226':139
- '67.#.65.139':445
- '67.#.12.83':445
- '67.#.9.84':445
- '67.#.95.104':445
- '67.#.240.104':445
- '67.#.68.44':445
- '67.#.39.39':445
- '67.#.156.24':445
- '67.#.111.214':445
- '67.#.54.125':445
- '67.#.19.194':445
- '67.#.121.91':445
- '67.#.24.31':445
- '67.#.175.202':445
- '67.#.1.62':445
- '67.#.107.182':139
- '67.#.122.184':139
- '67.#.95.104':9988
- '67.#.95.221':139
- '67.#.56.206':139
- '67.#.8.222':139
- '67.#.121.37':139
- '67.#.254.159':9988
- '67.#.138.71':9988
- '67.#.188.85':9988
- '67.#.229.72':9988
- '67.#.111.214':9988
- '67.#.53.105':9988
- '67.#.16.30':9988
- '67.#.42.155':445
- '67.#.16.30':445
- '67.#.134.17':445
- '67.#.5.226':445
- '67.#.205.62':445
- '67.#.19.52':445
- '67.#.246.28':445
- '67.#.71.248':445
- '67.#.106.114':445
- '67.#.99.248':445
- '67.#.187.161':445
- '67.#.67.56':445
- '67.#.251.228':445
- '67.#.35.187':445
- '67.#.44.204':445
- '67.#.254.159':445
- '67.#.215.197':445
- '67.#.118.60':445
- '67.#.216.30':445
- '67.#.71.235':445
- '67.#.174.33':445
- '67.#.197.43':445
- '67.#.154.36':445
- '67.#.188.85':445
- '67.#.116.117':445
- '67.#.168.73':445
- '67.#.181.220':445
- '67.#.4.35':445
- '67.#.38.127':445
