Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa67a.dir00\svchost.exe.mdmp 16325836412029792
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa67a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#4.87.104':445
- '20#.#4.128.35':445
- '20#.#4.148.107':445
- '20#.#4.52.96':445
- '20#.#4.120.104':445
- '20#.#4.63.48':445
- '20#.#4.15.214':445
- '20#.#4.68.120':445
- '20#.#4.112.234':445
- '20#.#4.63.48':9988
- '20#.#4.222.27':9988
- '20#.#4.68.120':9988
- '20#.#4.110.154':9988
- '20#.#4.6.183':445
- '20#.#4.138.226':445
- '20#.14.4.91':445
- '20#.14.95.6':445
- '20#.#4.30.71':445
- '20#.#4.56.115':445
- '20#.#4.66.58':445
- '20#.#4.71.168':445
- '20#.#4.97.56':445
- '20#.#4.78.235':445
- '20#.#4.47.117':445
- '20#.#4.252.247':445
- '20#.#4.128.135':445
- '20#.#4.179.246':445
- '20#.#4.85.54':445
- '20#.#4.109.169':445
- '20#.#4.5.118':445
- '20#.#4.2.138':445
- '20#.#4.48.52':445
- '20#.#4.71.30':445
- '20#.#4.109.162':445
- '20#.#4.162.199':445
- '20#.#4.91.47':9988
- '20#.#4.71.168':9988
- '20#.#4.71.30':9988
- '20#.#4.14.60':9988
- '20#.#4.23.16':9988
- '20#.#4.128.135':9988
- '20#.#4.97.56':9988
- '20#.#4.56.115':9988
- '20#.#4.252.247':9988
- '20#.#4.139.176':445
- '20#.#4.12.84':445
- '20#.#4.28.194':445
- '20#.#4.123.126':445
- '20#.#4.48.52':9988
- '20#.#4.162.199':9988
- '20#.#4.75.253':445
- '20#.#4.109.169':9988
- '20#.#4.6.214':9988
- '20#.#4.123.126':139
- '20#.#4.139.176':139
- '20#.#4.191.42':9988
- '20#.#4.28.194':139
- '20#.14.95.6':9988
- '20#.#4.148.107':9988
- '20#.#4.12.84':139
- '20#.#4.75.253':139
- '20#.#4.140.91':9988
- '20#.#4.33.111':9988
- '20#.#4.47.117':9988
- '20#.#4.78.235':9988
- '20#.14.74.8':9988
- '20#.#4.44.218':9988
- '20#.#4.144.118':9988
- '20#.#4.66.165':9988
- '20#.#4.58.192':9988
- '20#.#4.214.33':445
- '20#.#4.252.247':139
- '20#.#4.128.135':139
- '20#.#4.56.115':139
- '20#.#4.66.58':139
- '20#.#4.6.214':139
- '20#.#4.214.33':139
- '20#.#4.78.235':139
- '20#.#4.47.117':139
- '20#.#4.97.56':139
- '20#.#4.109.162':139
- '20#.#4.162.199':139
- '20#.#4.85.54':139
- '20#.#4.109.169':139
- '20#.#4.179.246':139
- '20#.#4.71.168':139
- '20#.#4.48.52':139
- '20#.#4.71.30':139
- '20#.#4.33.111':139
- '20#.#4.238.152':139
- '20#.#4.58.192':139
- '20#.#4.31.23':139
- '20#.#4.42.221':139
- '20#.#4.222.27':139
- '20#.#4.110.154':139
- '20#.#4.191.42':139
- '20#.#4.192.238':139
- '20#.#4.91.47':139
- '20#.#4.1.180':139
- '20#.#4.44.218':139
- '20#.#4.14.60':139
- '20#.#4.66.165':139
- '20#.#4.144.118':139
- '20#.#4.140.91':139
- '20#.14.74.8':139
- '20#.#4.23.16':139
- '20#.#4.192.238':445
- '20#.#4.31.23':445
- '20#.#4.42.221':445
- '20#.#4.140.91':445
- '20#.#4.191.42':445
- '20#.#4.91.47':445
- '20#.#4.58.192':445
- '20#.#4.110.154':445
- '20#.#4.144.118':445
- '20#.#4.14.60':445
- '20#.#4.66.165':445
- '20#.#4.6.214':445
- '20#.#4.33.111':445
- '20#.14.74.8':445
- '20#.#4.23.16':445
- '20#.#4.1.180':445
- '20#.#4.44.218':445
- '20#.#4.238.152':445
- '20#.#4.68.120':139
- '20#.#4.120.104':139
- '20#.#4.128.35':139
- '20#.#4.15.214':139
- '20#.#4.5.118':139
- '20#.#4.2.138':139
- '20#.#4.63.48':139
- '20#.#4.30.71':139
- '20#.#4.87.104':139
- '20#.14.95.6':139
- '20#.#4.6.183':139
- '20#.#4.222.27':445
- '20#.14.4.91':139
- '20#.#4.148.107':139
- '20#.#4.52.96':139
- '20#.#4.138.226':139
- '20#.#4.112.234':139
