Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERab63.dir00\svchost.exe.mdmp 16325836412032124
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERab63.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '67.##.181.54':445
- '67.#2.54.45':445
- '67.##.44.156':445
- '67.#2.19.68':445
- '67.##.37.152':445
- '67.#2.86.30':445
- '67.##.134.209':445
- '67.##.208.88':445
- '67.##.248.194':445
- '67.#2.50.68':445
- '67.##.102.220':445
- '67.##.81.109':445
- '67.##.196.176':445
- '67.##.176.183':445
- '67.##.184.110':445
- '67.##.175.57':445
- '67.##.22.211':445
- '67.##.107.128':445
- '67.##.119.200':445
- '67.##.53.225':445
- '67.#2.7.170':139
- '67.##.170.128':445
- '67.##.101.140':445
- '67.##.194.220':445
- '67.##.19.150':445
- '67.##.43.118':445
- '67.##.24.214':445
- '67.##.90.208':445
- '67.##.220.239':445
- '67.#2.83.70':445
- '67.##.221.34':445
- '67.##.19.150':139
- '67.##.43.118':139
- '67.##.24.214':139
- '67.##.90.208':139
- '67.##.220.239':139
- '67.#2.83.70':139
- '67.##.221.34':139
- '67.##.175.57':139
- '67.##.181.54':139
- '67.#2.54.45':139
- '67.##.44.156':139
- '67.#2.19.68':139
- '67.##.37.152':139
- '67.#2.86.30':139
- '67.##.134.209':139
- '67.##.194.220':139
- '67.##.127.95':445
- '67.##.205.138':445
- '67.##.169.83':445
- '67.##.193.159':445
- '67.##.24.179':445
- '67.##.244.165':445
- '67.##.165.193':445
- '67.##.117.17':445
- '67.##.22.211':139
- '67.##.107.128':139
- '67.##.119.200':139
- '67.##.53.225':139
- '67.##.212.241':445
- '67.##.170.128':139
- '67.##.101.140':139
- '67.#2.9.58':139
- '67.##.32.195':139
- '67.##.130.77':139
- '67.#2.44.4':139
- '67.##.162.175':139
- '67.##.222.69':139
- '67.##.72.174':139
- '67.#2.40.32':139
- '67.##.243.34':139
- '67.#2.76.4':139
- '67.##.102.163':139
- '67.##.18.136':139
- '67.##.32.121':139
- '67.##.162.71':139
- '67.##.176.10':139
- '67.#2.25.24':139
- '67.##.149.63':139
- '67.##.63.178':139
- '67.##.51.129':139
- '67.##.96.149':139
- '67.##.177.172':139
- '67.#2.100.8':139
- '67.##.199.98':139
- '67.##.240.17':139
- '67.##.169.206':139
- '67.##.107.170':139
- '67.##.204.218':139
- '67.##.185.35':139
- '67.##.41.214':139
- '67.##.136.182':139
- '67.##.117.185':139
- '67.#2.49.1':139
- '67.#2.65.36':139
- '67.#2.38.67':139
- '67.#2.7.170':445
- '67.##.116.109':445
- '67.##.123.21':445
- '67.##.116.134':445
- '67.##.164.84':139
- '67.##.116.109':139
- '67.##.123.21':139
- '67.##.116.134':139
- '67.#2.18.77':139
- '67.#2.84.83':139
- '67.##.194.114':139
- '67.##.252.146':139
- '67.#2.18.77':445
- '67.##.114.10':139
- '67.#2.62.11':139
- '67.##.133.153':139
- '67.#2.253.9':139
- '67.##.128.98':139
- '67.##.50.185':139
- '67.##.77.175':139
- '67.##.132.163':139
- '67.#2.84.83':445
- '67.##.194.114':445
- '67.##.252.146':445
- '67.##.164.84':445
- '67.#2.49.1':445
- '67.#2.65.36':445
- '67.#2.38.67':445
- '67.##.208.88':139
- '67.##.153.103':139
- '67.##.238.28':139
- '67.#2.2.238':139
- '67.#2.88.49':139
- '67.##.83.189':139
- '67.##.202.97':139
- '67.#2.98.88':139
- '67.##.63.188':139
- '67.##.68.229':139
- '67.##.159.243':139
- '67.#2.12.43':139
- '67.##.151.43':139
- '67.##.101.107':139
- '67.##.232.126':139
- '67.##.59.209':139
- '67.#2.90.82':139
- '67.#2.61.23':445
- '67.#2.83.30':445
- '67.#2.30.24':445
- '67.##.184.99':445
- '67.#2.73.52':445
- '67.#2.1.104':445
- '67.##.156.50':445
- '67.#2.1.179':445
- '67.##.11.193':139
- '67.##.149.217':139
- '67.##.125.88':139
- '67.##.241.172':139
- '67.##.150.176':445
- '67.##.177.30':445
- '67.#2.37.4':445
- '67.#2.73.52':139
- '67.#2.1.104':139
- '67.##.184.99':139
- '67.##.127.31':139
- '67.##.117.18':139
- '67.##.149.87':139
- '67.#2.93.89':139
- '67.#2.61.23':139
- '67.#2.1.179':139
- '67.#2.83.30':139
- '67.#2.37.4':139
- '67.##.156.50':139
- '67.##.150.176':139
- '67.##.177.30':139
- '67.#2.30.24':139
- '67.##.46.227':139
- '67.#2.71.89':139
- '67.##.198.170':139
- '67.##.182.128':139
- '67.##.130.120':139
- '67.##.86.122':139
- '67.##.122.86':139
- '67.#2.5.43':139
- '67.#2.90.98':139
- '67.##.56.202':139
- '67.#2.99.51':139
- '67.##.78.100':139
- '67.##.164.56':139
- '67.##.120.193':139
- '67.##.130.186':139
- '67.##.166.164':139
- '67.#2.37.4':9988
- '67.#2.83.30':9988
- '67.##.241.172':445
- '67.#2.71.89':9988
- '67.##.241.172':9988
- '67.#2.98.88':9988
- '67.##.177.30':9988
- '67.##.11.193':445
- '67.##.202.97':445
- '67.#2.98.88':445
- '67.#2.88.49':445
- '67.##.83.189':445
- '67.##.149.217':445
- '67.##.125.88':445
- '67.#2.90.82':445
- '67.##.212.241':139
- '67.##.248.194':139
- '67.#2.50.68':139
- '67.##.102.220':139
- '67.##.81.109':139
- '67.##.196.176':139
- '67.##.176.183':139
- '67.##.184.110':139
- '67.##.24.179':139
- '67.##.205.138':139
- '67.##.169.83':139
- '67.##.117.17':139
- '67.##.127.95':139
- '67.##.244.165':139
- '67.##.165.193':139
- '67.##.193.159':139
- '67.##.130.186':445
- '67.##.166.164':445
- '67.##.56.202':445
- '67.##.120.193':445
- '67.##.198.170':445
- '67.##.182.128':445
- '67.#2.90.98':445
- '67.##.164.56':445
- '67.##.149.87':445
- '67.#2.93.89':445
- '67.##.127.31':445
- '67.##.117.18':445
- '67.#2.99.51':445
- '67.##.78.100':445
- '67.##.46.227':445
- '67.#2.71.89':445
- '67.##.101.107':445
- '67.##.232.126':445
- '67.##.59.209':445
- '67.##.63.188':445
- '67.##.238.28':445
- '67.##.153.103':445
- '67.#2.2.238':445
- '67.##.151.43':445
- '67.##.122.86':445
- '67.#2.5.43':445
- '67.##.130.120':445
- '67.##.86.122':445
- '67.##.68.229':445
- '67.##.159.243':445
- '67.#2.12.43':445
