Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERc0b5.dir00\svchost.exe.mdmp 16325836412029588
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WERc0b5.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Сетевая активность:
Подключается к:
- '21#.#0.97.44':445
- '21#.#0.100.76':445
- '21#.#0.203.54':9988
- '21#.#0.150.16':9988
- '21#.#0.233.200':445
- '21#.#0.206.109':445
- '21#.#0.136.203':445
- '21#.#0.106.157':445
- '21#.#0.0.182':445
- '21#.#0.5.184':9988
- '21#.#0.134.46':9988
- '21#.#0.155.243':9988
- '21#.#0.27.225':9988
- '21#.#0.83.17':9988
- '21#.#0.131.25':9988
- '21#.#0.198.150':9988
- '21#.#0.61.58':9988
- '21#.20.9.34':9988
- '21#.#0.129.136':9988
- '21#.#0.144.155':445
- '21#.#0.164.210':445
- '21#.#0.155.243':445
- '21#.#0.59.78':445
- '21#.#0.5.184':445
- '21#.#0.56.69':445
- '21#.#0.129.136':445
- '21#.#0.54.59':445
- '21#.#0.46.234':445
- '21#.#0.250.227':445
- '21#.#0.51.51':445
- '21#.#0.247.224':445
- '21#.#0.57.116':445
- '21#.#0.131.25':445
- '21#.#0.217.18':445
- '21#.#0.14.142':445
- '21#.#0.243.13':445
- '21#.20.89.7':445
- '21#.#0.27.225':445
- '21#.#0.164.210':9988
- '21#.#0.144.155':9988
- '21#.#0.194.244':9988
- '21#.#0.46.234':9988
- '21#.#0.82.166':9988
- '21#.#0.116.249':9988
- '21#.#0.59.78':9988
- '21#.#0.184.107':9988
- '21#.#0.51.51':9988
- '21#.#0.119.100':9988
- '21#.#0.158.55':9988
- '21#.#0.104.75':9988
- '21#.#0.100.76':9988
- '21#.#0.220.72':9988
- '21#.#0.56.69':9988
- '21#.20.89.7':9988
- '21#.#0.174.76':9988
- '21#.#0.0.182':9988
- '21#.#0.54.59':9988
- '21#.#0.106.157':9988
- '21#.#0.243.13':9988
- '21#.#0.150.156':9988
- '21#.#0.11.135':9988
- '21#.#0.250.227':9988
- '21#.#0.45.174':9988
- '21#.#0.249.227':9988
- '21#.#0.57.116':9988
- '21#.#0.119.87':9988
- '21#.#0.136.203':9988
- '21#.#0.90.25':9988
- '21#.#0.233.200':9988
- '21#.#0.160.141':9988
- '21#.#0.201.227':9988
- '21#.#0.14.142':9988
- '21#.#0.217.18':9988
- '21#.#0.247.224':9988
- '21#.#0.24.123':9988
- '21#.#0.97.44':9988
- '21#.#0.129.136':139
- '21#.#0.119.87':139
- '21#.#0.46.234':139
- '21#.#0.56.69':139
- '21#.#0.119.100':139
- '21#.#0.104.75':139
- '21#.#0.11.135':139
- '21#.#0.90.25':139
- '21#.#0.82.166':139
- '21#.#0.54.59':139
- '21#.#0.250.227':139
- '21#.#0.59.78':139
- '21#.#0.14.142':139
- '21#.#0.27.225':139
- '21#.#0.144.155':139
- '21#.#0.164.210':139
- '21#.#0.5.184':139
- '21#.#0.155.243':139
- '21#.#0.243.13':139
- '21#.#0.203.54':139
- '21#.#0.134.46':139
- '21#.#0.194.244':139
- '21#.#0.220.72':139
- '21#.#0.24.123':139
- '21#.#0.174.76':139
- '21#.#0.150.16':139
- '21#.20.9.34':139
- '21#.#0.45.174':139
- '21#.#0.61.58':139
- '21#.#0.83.17':139
- '21#.#0.116.249':139
- '21#.#0.160.141':139
- '21#.#0.201.227':139
- '21#.#0.198.150':139
- '21#.#0.184.107':139
- '21#.#0.249.227':139
- '21#.#0.150.156':139
- '21#.#0.158.55':139
- '21#.#0.150.156':445
- '21#.#0.198.150':445
- '21#.#0.158.55':445
- '21#.#0.184.107':445
- '21#.#0.249.227':445
- '21#.#0.24.123':445
- '21#.#0.174.76':445
- '21#.#0.61.58':445
- '21#.#0.194.244':445
- '21#.#0.11.135':445
- '21#.#0.90.25':445
- '21#.#0.82.166':445
- '21#.#0.119.87':445
- '21#.#0.119.100':445
- '21#.#0.160.141':445
- '21#.#0.104.75':445
- '21#.#0.201.227':445
- '21#.#0.116.249':445
- '21#.#0.83.17':445
- '21#.#0.136.203':139
- '21#.#0.57.116':139
- '21#.#0.0.182':139
- '21#.#0.206.109':139
- '21#.#0.131.25':139
- '21#.#0.217.18':139
- '21#.20.89.7':139
- '21#.#0.51.51':139
- '21#.#0.247.224':139
- '21#.#0.97.44':139
- '21#.#0.203.54':445
- '21#.#0.134.46':445
- '21#.#0.220.72':445
- '21#.20.9.34':445
- '21#.#0.150.16':445
- '21#.#0.233.200':139
- '21#.#0.106.157':139
- '21#.#0.45.174':445
- '21#.#0.100.76':139
