Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER196a.dir00\svchost.exe.mdmp 16325836412032336
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER196a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '12.##7.18.154':9988
- '12.##7.29.131':445
- '12.##7.213.241':9988
- '12.##7.107.40':9988
- '12.##7.67.200':445
- '12.##7.186.12':445
- '12.##7.7.169':445
- '12.##7.24.228':445
- '12.#17.7.30':445
- '12.##7.215.107':9988
- '12.##7.51.87':9988
- '12.##7.207.216':9988
- '12.##7.75.98':9988
- '12.##7.16.116':9988
- '12.##7.42.77':9988
- '12.##7.245.157':9988
- '12.##7.48.72':9988
- '12.##7.25.166':9988
- '12.##7.53.119':9988
- '12.##7.237.232':445
- '12.##7.72.48':445
- '12.##7.192.185':445
- '12.##7.97.138':445
- '12.##7.61.221':445
- '12.##7.245.157':445
- '12.##7.167.233':445
- '12.##7.239.154':445
- '12.##7.183.97':445
- '12.##7.37.222':445
- '12.##7.120.149':445
- '12.##7.47.236':445
- '12.##7.12.34':445
- '12.##7.113.128':445
- '12.##7.162.78':445
- '12.##7.194.119':445
- '12.##7.60.136':445
- '12.##7.156.2':445
- '12.##7.78.154':445
- '12.##7.158.197':9988
- '12.##7.37.222':9988
- '12.#17.7.30':9988
- '12.##7.24.228':9988
- '12.##7.67.200':9988
- '12.##7.162.78':9988
- '12.##7.242.55':9988
- '12.##7.183.97':9988
- '12.##7.113.128':9988
- '12.##7.36.72':9988
- '12.##7.197.185':9988
- '12.#17.2.24':9988
- '12.##7.7.169':9988
- '12.##7.239.154':9988
- '12.##7.111.215':9988
- '12.##7.116.107':9988
- '12.##7.237.232':9988
- '12.##7.177.214':9988
- '12.##7.61.221':9988
- '12.##7.97.134':9988
- '12.##7.105.231':9988
- '12.##7.3.234':9988
- '12.##7.97.138':9988
- '12.##7.192.185':9988
- '12.##7.63.29':9988
- '12.##7.36.67':9988
- '12.##7.252.30':9988
- '12.##7.120.149':9988
- '12.##7.78.154':9988
- '12.##7.186.12':9988
- '12.##7.167.233':9988
- '12.##7.47.236':9988
- '12.##7.156.2':9988
- '12.##7.194.119':9988
- '12.##7.29.131':9988
- '12.##7.12.34':9988
- '12.##7.60.136':9988
- '12.##7.72.48':9988
- '12.##7.158.197':445
- '12.##7.158.197':139
- '12.##7.197.185':139
- '12.##7.167.233':139
- '12.##7.245.157':139
- '12.##7.36.67':139
- '12.##7.97.134':139
- '12.##7.177.214':139
- '12.##7.105.231':139
- '12.##7.36.72':139
- '12.##7.183.97':139
- '12.##7.192.185':139
- '12.##7.37.222':139
- '12.##7.156.2':139
- '12.##7.78.154':139
- '12.##7.237.232':139
- '12.##7.72.48':139
- '12.##7.61.221':139
- '12.##7.97.138':139
- '12.##7.239.154':139
- '12.##7.215.107':139
- '12.##7.207.216':139
- '12.##7.116.107':139
- '12.##7.107.40':139
- '12.##7.18.154':139
- '12.##7.252.30':139
- '12.##7.213.241':139
- '12.##7.242.55':139
- '12.##7.25.166':139
- '12.##7.16.116':139
- '12.#17.2.24':139
- '12.##7.48.72':139
- '12.##7.51.87':139
- '12.##7.42.77':139
- '12.##7.75.98':139
- '12.##7.63.29':139
- '12.##7.53.119':139
- '12.##7.111.215':139
- '12.##7.3.234':139
- '12.##7.75.98':445
- '12.##7.63.29':445
- '12.##7.3.234':445
- '12.##7.111.215':445
- '12.##7.53.119':445
- '12.##7.107.40':445
- '12.##7.215.107':445
- '12.##7.16.116':445
- '12.##7.116.107':445
- '12.##7.48.72':445
- '12.##7.36.67':445
- '12.##7.36.72':445
- '12.##7.197.185':445
- '12.##7.105.231':445
- '12.##7.97.134':445
- '12.##7.42.77':445
- '12.#17.2.24':445
- '12.##7.177.214':445
- '12.##7.51.87':445
- '12.##7.12.34':139
- '12.##7.113.128':139
- '12.##7.7.169':139
- '12.##7.186.12':139
- '12.##7.47.236':139
- '12.##7.194.119':139
- '12.##7.60.136':139
- '12.##7.162.78':139
- '12.##7.120.149':139
- '12.##7.24.228':139
- '12.##7.25.166':445
- '12.##7.213.241':445
- '12.##7.242.55':445
- '12.##7.18.154':445
- '12.##7.207.216':445
- '12.##7.67.200':139
- '12.#17.7.30':139
- '12.##7.252.30':445
- '12.##7.29.131':139
