Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERcf85.dir00\svchost.exe.mdmp 16325836412032220
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERcf85.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '88.##0.134.127':445
- '88.##0.118.4':445
- '88.##0.110.33':445
- '88.##0.23.135':445
- '88.#90.5.26':445
- '88.##0.222.50':445
- '88.##0.127.117':445
- '88.##0.84.211':445
- '88.##0.106.58':445
- '88.##0.215.14':445
- '88.##0.242.95':445
- '88.##0.250.210':9988
- '88.##0.123.115':445
- '88.##0.247.157':445
- '88.##0.68.135':445
- '88.##0.53.47':445
- '88.##0.26.13':445
- '88.##0.220.209':445
- '88.##0.81.33':445
- '88.##0.218.141':445
- '88.##0.11.98':445
- '88.##0.201.154':445
- '88.##0.204.10':445
- '88.##0.118.227':445
- '88.#90.65.3':445
- '88.##0.180.181':445
- '88.##0.240.48':445
- '88.##0.56.147':445
- '88.##0.8.234':445
- '88.##0.237.11':445
- '88.##0.21.129':445
- '88.##0.97.32':445
- '88.##0.59.84':445
- '88.##0.21.23':445
- '88.##0.222.50':9988
- '88.##0.21.129':9988
- '88.##0.118.227':9988
- '88.##0.56.147':9988
- '88.##0.180.181':9988
- '88.##0.201.154':9988
- '88.##0.91.33':9988
- '88.##0.29.73':9988
- '88.##0.220.209':9988
- '88.##0.21.23':9988
- '88.##0.8.234':9988
- '88.##0.240.48':9988
- '88.##0.118.4':9988
- '88.##0.84.211':9988
- '88.##0.237.11':9988
- '88.##0.59.84':9988
- '88.#90.5.26':9988
- '88.##0.81.33':9988
- '88.##0.247.157':9988
- '88.##0.134.127':9988
- '88.##0.238.68':9988
- '88.##0.242.95':9988
- '88.##0.11.98':9988
- '88.#90.65.3':9988
- '88.##0.127.117':9988
- '88.##0.204.10':9988
- '88.##0.42.102':9988
- '88.##0.26.66':9988
- '88.##0.66.160':9988
- '88.##0.10.54':9988
- '88.##0.232.89':9988
- '88.##0.126.78':9988
- '88.##0.2.182':9988
- '88.##0.76.193':9988
- '88.##0.129.110':9988
- '88.##0.81.33':139
- '88.##0.118.227':139
- '88.##0.11.98':139
- '88.##0.220.209':139
- '88.##0.204.10':139
- '88.##0.10.54':139
- '88.#90.65.3':139
- '88.##0.201.154':139
- '88.##0.218.141':139
- '88.##0.56.147':139
- '88.##0.59.84':139
- '88.##0.237.11':139
- '88.##0.240.48':139
- '88.##0.97.32':139
- '88.##0.180.181':139
- '88.##0.21.23':139
- '88.##0.21.129':139
- '88.##0.29.73':139
- '88.##0.172.129':139
- '88.##0.26.66':139
- '88.##0.129.110':139
- '88.##0.250.210':139
- '88.##0.89.162':139
- '88.##0.232.89':139
- '88.##0.178.232':139
- '88.##0.2.182':139
- '88.##0.32.233':139
- '88.##0.76.193':139
- '88.##0.115.67':139
- '88.##0.91.33':139
- '88.##0.238.68':139
- '88.##0.126.78':139
- '88.##0.66.160':139
- '88.##0.42.102':139
- '88.##0.8.234':139
- '88.##0.172.129':445
- '88.##0.232.89':445
- '88.##0.126.78':445
- '88.##0.26.66':445
- '88.##0.250.210':445
- '88.##0.89.162':445
- '88.##0.29.73':445
- '88.##0.129.110':445
- '88.##0.2.182':445
- '88.##0.91.33':445
- '88.##0.32.233':445
- '88.##0.10.54':445
- '88.##0.115.67':445
- '88.##0.42.102':445
- '88.##0.238.68':445
- '88.##0.76.193':445
- '88.##0.66.160':445
- '88.##0.134.127':139
- '88.##0.127.117':139
- '88.##0.110.33':139
- '88.##0.23.135':139
- '88.##0.84.211':139
- '88.##0.222.50':139
- '88.##0.118.4':139
- '88.#90.5.26':139
- '88.##0.106.58':139
- '88.##0.215.14':139
- '88.##0.242.95':139
- '88.##0.178.232':445
- '88.##0.123.115':139
- '88.##0.247.157':139
- '88.##0.68.135':139
- '88.##0.26.13':139
- '88.##0.53.47':139
