Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER1c28.dir00\svchost.exe.mdmp 16325836412032112
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER1c28.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '21#.#43.125.79':9988
- '21#.#43.108.160':9988
- '21#.#43.81.49':9988
- '21#.#43.237.175':9988
- '21#.#43.43.49':9988
- '21#.#43.44.123':9988
- '21#.#43.111.69':9988
- '21#.#43.29.127':9988
- '21#.#43.32.153':9988
- '21#.#43.121.51':9988
- '21#.#43.104.237':9988
- '21#.#43.182.53':9988
- '21#.#43.87.181':9988
- '21#.#43.23.167':9988
- '21#.#43.118.29':9988
- '21#.#43.31.241':9988
- '21#.#43.130.149':9988
- '21#.143.6.4':9988
- '21#.#43.117.202':9988
- '21#.#43.45.172':9988
- '21#.#43.167.118':9988
- '21#.#43.196.155':9988
- '21#.#43.75.155':445
- '21#.#43.231.197':445
- '21#.#43.134.62':445
- '21#.#43.120.220':445
- '21#.#43.151.133':445
- '21#.#43.0.216':445
- '21#.#43.210.181':445
- '21#.#43.125.109':445
- '21#.#43.141.10':445
- '21#.#43.18.38':445
- '21#.#43.174.44':445
- '21#.#43.248.163':9988
- '21#.#43.83.49':9988
- '21#.#43.79.114':9988
- '21#.#43.22.159':9988
- '21#.#43.233.81':9988
- '21#.#43.125.183':9988
- '21#.#43.210.235':445
- '21#.#43.22.44':445
- '21#.#43.47.186':9988
- '21#.#43.132.195':9988
- '21#.#43.164.213':9988
- '21#.#43.23.20':139
- '21#.#43.19.224':139
- '21#.#43.193.22':139
- '21#.#43.17.69':139
- '21#.#43.43.77':139
- '21#.#43.224.198':139
- '21#.#43.101.167':139
- '21#.#43.16.188':139
- '21#.#43.61.102':139
- '21#.#43.245.97':139
- '21#.#43.26.194':139
- '21#.#43.44.161':139
- '21#.#43.215.206':139
- '21#.#43.116.30':139
- '21#.#43.22.212':139
- '21#.#43.58.62':139
- '21#.#43.37.118':139
- '21#.#43.82.108':139
- '21#.#43.15.100':139
- '21#.#43.23.74':139
- '21#.#43.159.165':139
- '21#.#43.75.65':139
- '21#.#43.22.44':9988
- '21#.#43.119.126':9988
- '21#.#43.134.62':9988
- '21#.#43.151.133':9988
- '21#.#43.120.220':9988
- '21#.#43.231.197':9988
- '21#.#43.174.44':9988
- '21#.#43.125.109':9988
- '21#.#43.18.38':9988
- '21#.#43.75.155':9988
- '21#.#43.0.216':9988
- '21#.#43.141.10':9988
- '21#.#43.247.242':9988
- '21#.#43.210.235':9988
- '21#.#43.97.90':139
- '21#.#43.122.50':139
- '21#.#43.210.181':9988
- '21#.#43.27.209':9988
- '21#.#43.48.204':9988
- '21#.#43.223.170':9988
- '21#.#43.69.203':9988
- '21#.#43.129.87':9988
- '21#.#43.118.29':445
- '21#.#43.69.203':139
- '21#.#43.117.202':139
- '21#.#43.164.213':139
- '21#.#43.45.172':139
- '21#.#43.167.118':139
- '21#.#43.129.87':139
- '21#.#43.223.170':139
- '21#.#43.31.241':139
- '21#.#43.196.155':139
- '21#.#43.87.181':139
- '21#.#43.182.53':139
- '21#.#43.141.10':139
- '21#.#43.210.181':139
- '21#.#43.174.44':139
- '21#.#43.0.216':139
- '21#.#43.18.38':139
- '21#.#43.125.109':139
- '21#.#43.83.49':139
- '21#.#43.47.186':139
- '21#.#43.119.126':139
- '21#.#43.118.29':139
- '21#.#43.247.242':139
- '21#.#43.121.51':139
- '21#.#43.32.153':139
- '21#.143.6.4':139
- '21#.#43.79.114':139
- '21#.#43.233.81':139
- '21#.#43.104.237':139
- '21#.#43.108.160':139
- '21#.#43.237.175':139
- '21#.#43.29.127':139
- '21#.#43.48.204':139
- '21#.#43.132.195':139
- '21#.#43.125.183':139
- '21#.#43.81.49':139
- '21#.#43.27.209':139
- '21#.#43.130.149':139
- '21#.#43.23.167':139
- '21#.#43.43.49':139
- '21#.#43.44.123':139
- '21#.#43.125.79':139
- '21#.#43.22.159':139
- '21#.#43.111.69':139
- '21#.#43.248.163':139
- '21#.#43.31.241':445
- '21#.#43.130.149':445
- '21#.#43.223.170':445
- '21#.#43.182.53':445
- '21#.#43.196.155':445
- '21#.#43.23.167':445
- '21#.#43.43.49':445
- '21#.#43.111.69':445
- '21#.#43.81.49':445
- '21#.#43.27.209':445
- '21#.#43.125.183':445
- '21#.#43.47.186':445
- '21#.#43.45.172':445
- '21#.#43.83.49':445
- '21#.#43.247.242':445
- '21#.#43.119.126':445
- '21#.#43.167.118':445
- '21#.#43.129.87':445
- '21#.#43.87.181':445
- '21#.#43.117.202':445
- '21#.#43.164.213':445
- '21#.#43.69.203':445
- '21#.#43.32.153':445
- '21#.#43.210.235':139
- '21#.143.6.4':445
- '21#.#43.132.195':445
- '21#.#43.48.204':445
- '21#.#43.22.44':139
- '21#.#43.75.155':139
- '21#.#43.231.197':139
- '21#.#43.134.62':139
- '21#.#43.120.220':139
- '21#.#43.151.133':139
- '21#.#43.125.79':445
- '21#.#43.79.114':445
- '21#.#43.44.123':445
- '21#.#43.248.163':445
- '21#.#43.22.159':445
- '21#.#43.29.127':445
- '21#.#43.121.51':445
- '21#.#43.237.175':445
- '21#.#43.104.237':445
- '21#.#43.108.160':445
- '21#.#43.233.81':445
