Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa570.dir00\svchost.exe.mdmp 16325836412032160
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa570.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '64.##.184.71':139
- '64.#4.32.66':139
- '64.##.91.142':139
- '64.##.178.251':139
- '64.##.18.163':139
- '64.#4.11.24':139
- '64.##.150.112':139
- '64.##.80.121':139
- '64.##.121.215':139
- '64.#4.63.67':139
- '64.##.119.141':139
- '64.##.249.62':139
- '64.##.145.195':139
- '64.##.40.180':139
- '64.##.209.202':139
- '64.#4.58.7':139
- '64.#4.7.139':139
- '64.##.44.237':139
- '64.##.19.153':139
- '64.#4.43.39':139
- '64.##.123.223':139
- '64.##.137.203':139
- '64.##.110.216':139
- '64.##.142.235':139
- '64.#4.95.56':139
- '64.##.160.91':139
- '64.##.85.156':139
- '64.##.196.57':139
- '64.##.57.131':139
- '64.#4.1.234':139
- '64.##.199.83':139
- '64.#4.83.40':139
- '64.##.17.104':139
- '64.##.180.136':139
- '64.##.244.91':9988
- '64.##.198.145':9988
- '64.##.132.133':139
- '64.#4.64.60':139
- '64.##.11.173':139
- '64.##.253.50':139
- '64.##.118.120':139
- '64.#4.26.43':139
- '64.##.135.232':139
- '64.##.232.94':139
- '64.#4.70.95':139
- '64.##.39.111':139
- '64.#4.75.23':139
- '64.#4.89.11':139
- '64.#4.12.15':139
- '64.#4.74.64':139
- '64.#4.5.181':139
- '64.#4.89.6':139
- '64.#4.11.24':445
- '64.##.184.71':445
- '64.#4.32.66':445
- '64.##.110.216':445
- '64.##.178.251':445
- '64.##.18.163':445
- '64.##.91.142':445
- '64.##.145.195':445
- '64.##.80.121':445
- '64.##.121.215':445
- '64.##.150.112':445
- '64.##.119.141':445
- '64.##.249.62':445
- '64.##.19.153':445
- '64.##.40.180':445
- '64.##.209.202':445
- '64.##.46.123':445
- '64.#4.7.139':445
- '64.##.44.237':445
- '64.#4.58.7':445
- '64.##.160.91':445
- '64.##.123.223':445
- '64.##.137.203':445
- '64.#4.43.39':445
- '64.##.142.235':445
- '64.#4.95.56':445
- '64.#4.83.40':445
- '64.##.85.156':445
- '64.##.196.57':445
- '64.#4.12.15':445
- '64.#4.1.234':445
- '64.##.199.83':445
- '64.##.57.131':445
- '64.##.11.173':445
- '64.##.180.136':445
- '64.##.46.123':139
- '64.##.17.104':445
- '64.##.132.133':445
- '64.#4.64.60':445
- '64.#4.70.95':445
- '64.##.253.50':445
- '64.##.118.120':445
- '64.#4.63.67':445
- '64.##.135.232':445
- '64.##.232.94':445
- '64.#4.26.43':445
- '64.#4.89.6':445
- '64.#4.75.23':445
- '64.#4.89.11':445
- '64.##.39.111':445
- '64.#4.74.64':445
- '64.#4.5.181':445
- '64.##.224.134':9988
- '64.##.145.242':139
- '64.##.11.133':139
- '64.##.175.15':139
- '64.##.32.141':139
- '64.#4.5.35':139
- '64.#4.4.154':139
- '64.##.19.229':139
- '64.##.111.56':139
- '64.##.238.212':139
- '64.##.27.172':139
- '64.##.218.45':139
- '64.##.141.37':139
- '64.##.36.158':139
- '64.##.244.91':139
- '64.##.87.154':139
- '64.##.123.67':139
- '64.##.30.211':445
- '64.#4.25.75':139
- '64.##.86.244':139
- '64.##.28.152':139
- '64.##.142.241':139
- '64.##.166.158':139
- '64.##.247.32':139
- '64.##.168.75':139
- '64.##.198.145':139
- '64.##.146.31':139
- '64.##.60.150':139
- '64.##.30.211':139
- '64.#4.76.11':139
- '64.##.168.214':139
- '64.##.57.224':139
- '64.##.224.134':139
- '64.##.209.119':139
- '64.##.215.194':139
- '64.#4.39.23':139
- '64.##.169.74':139
- '64.##.15.216':139
- '64.##.114.169':139
- '64.##.138.66':139
- '64.##.158.22':139
- '64.##.22.249':139
- '64.##.250.184':139
- '64.##.227.39':139
- '64.##.39.135':139
- '64.##.134.158':139
- '64.##.25.228':139
- '64.#4.26.86':139
- '64.##.150.151':139
- '64.##.185.247':139
- '64.##.217.54':139
- '64.##.190.191':139
- '64.##.116.215':139
- '64.#4.4.154':445
- '64.##.145.242':445
- '64.##.11.133':445
- '64.##.247.32':445
- '64.##.32.141':445
- '64.#4.5.35':445
- '64.##.175.15':445
- '64.##.36.158':445
- '64.##.111.56':445
- '64.##.238.212':445
- '64.##.19.229':445
- '64.##.218.45':445
- '64.##.141.37':445
- '64.##.86.244':445
- '64.##.142.241':445
- '64.##.244.91':445
- '64.##.57.224':9988
- '64.##.150.151':9988
- '64.#4.25.75':445
- '64.##.166.158':445
- '64.##.123.67':445
- '64.##.198.145':445
- '64.##.146.31':445
- '64.##.28.152':445
- '64.##.168.75':445
- '64.##.87.154':445
- '64.##.224.134':445
- '64.#4.39.23':445
- '64.##.60.150':445
- '64.##.185.247':445
- '64.##.168.214':445
- '64.##.57.224':445
- '64.##.209.119':445
- '64.##.114.169':445
- '64.##.215.194':445
- '64.##.138.66':445
- '64.#4.76.11':445
- '64.##.15.216':445
- '64.##.169.74':445
- '64.##.25.228':445
- '64.##.39.135':445
- '64.##.217.54':445
- '64.##.27.172':445
- '64.##.227.39':445
- '64.##.190.191':445
- '64.##.116.215':445
- '64.##.158.22':445
- '64.#4.26.86':445
- '64.##.150.151':445
- '64.##.250.184':445
- '64.##.134.158':445
- '64.##.22.249':445
