Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER6534.dir00\svchost.exe.mdmp 16325836412032564
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER6534.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '61.##8.156.161':445
- '61.##8.151.36':445
- '61.##8.1.182':445
- '61.##8.201.102':445
- '61.##8.36.200':445
- '61.##8.115.213':445
- '61.##8.53.77':445
- '61.##8.159.201':445
- '61.##8.159.182':445
- '61.##8.221.11':9988
- '61.##8.123.241':9988
- '61.##8.53.77':9988
- '61.##8.111.54':9988
- '61.##8.65.64':9988
- '61.##8.130.67':445
- '61.##8.188.197':445
- '61.##8.29.165':9988
- '61.##8.30.78':9988
- '61.##8.29.165':445
- '61.##8.150.12':445
- '61.##8.183.129':445
- '61.##8.197.76':445
- '61.##8.111.54':445
- '61.##8.15.108':445
- '61.##8.233.178':445
- '61.##8.219.112':445
- '61.##8.90.156':445
- '61.##8.131.51':445
- '61.##8.45.199':445
- '61.#88.8.15':445
- '61.##8.194.96':445
- '61.##8.121.93':445
- '61.##8.38.150':445
- '61.##8.20.183':445
- '61.##8.6.215':445
- '61.##8.58.19':445
- '61.##8.201.102':9988
- '61.##8.45.199':9988
- '61.##8.159.201':9988
- '61.##8.151.36':9988
- '61.##8.131.51':9988
- '61.##8.45.65':9988
- '61.##8.233.178':9988
- '61.##8.197.76':9988
- '61.##8.38.150':9988
- '61.##8.225.165':9988
- '61.##8.77.207':9988
- '61.#88.8.15':9988
- '61.##8.150.12':9988
- '61.##8.25.184':9988
- '61.##8.194.96':9988
- '61.##8.6.215':9988
- '61.##8.234.82':9988
- '61.##8.1.182':9988
- '61.##8.0.253':9988
- '61.##8.25.23':9988
- '61.##8.120.234':9988
- '61.#88.75.9':9988
- '61.##8.19.46':9988
- '61.##8.131.130':9988
- '61.##8.35.30':9988
- '61.##8.24.133':9988
- '61.##8.72.139':9988
- '61.##8.121.93':9988
- '61.##8.90.156':9988
- '61.##8.58.19':9988
- '61.##8.57.200':9988
- '61.##8.207.187':9988
- '61.##8.95.137':9988
- '61.##8.200.126':9988
- '61.##8.15.108':9988
- '61.##8.219.112':9988
- '61.#88.75.9':445
- '61.##8.90.156':139
- '61.##8.15.108':139
- '61.##8.111.54':139
- '61.##8.219.112':139
- '61.##8.233.178':139
- '61.##8.200.126':139
- '61.##8.45.65':139
- '61.#88.75.9':139
- '61.##8.57.200':139
- '61.##8.58.19':139
- '61.##8.38.150':139
- '61.##8.121.93':139
- '61.##8.6.215':139
- '61.##8.20.183':139
- '61.##8.29.165':139
- '61.##8.150.12':139
- '61.##8.183.129':139
- '61.##8.197.76':139
- '61.##8.24.133':139
- '61.##8.0.253':139
- '61.##8.72.139':139
- '61.##8.123.241':139
- '61.##8.25.184':139
- '61.##8.35.30':139
- '61.##8.77.207':139
- '61.##8.207.187':139
- '61.##8.30.78':139
- '61.##8.65.64':139
- '61.##8.225.165':139
- '61.##8.19.46':139
- '61.##8.95.137':139
- '61.##8.25.23':139
- '61.##8.221.11':139
- '61.##8.131.130':139
- '61.##8.120.234':139
- '61.##8.234.82':139
- '61.##8.131.130':445
- '61.##8.72.139':445
- '61.##8.234.82':445
- '61.##8.221.11':445
- '61.##8.123.241':445
- '61.##8.35.30':445
- '61.##8.30.78':445
- '61.##8.24.133':445
- '61.##8.77.207':445
- '61.##8.45.65':445
- '61.##8.19.46':445
- '61.##8.57.200':445
- '61.##8.200.126':445
- '61.##8.95.137':445
- '61.##8.25.23':445
- '61.##8.120.234':445
- '61.##8.65.64':445
- '61.##8.225.165':445
- '61.##8.159.182':139
- '61.##8.115.213':139
- '61.##8.36.200':139
- '61.##8.159.201':139
- '61.##8.53.77':139
- '61.##8.131.51':139
- '61.##8.45.199':139
- '61.#88.8.15':139
- '61.##8.194.96':139
- '61.##8.207.187':445
- '61.##8.130.67':139
- '61.##8.0.253':445
- '61.##8.25.184':445
- '61.##8.188.197':139
- '61.##8.156.161':139
- '61.##8.151.36':139
- '61.##8.1.182':139
- '61.##8.201.102':139
