Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERab72.dir00\svchost.exe.mdmp 16325836412029060
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERab72.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '81.#.209.180':445
- '81.#.14.245':445
- '81.#.9.187':445
- '81.#.155.209':445
- '81.#.25.104':445
- '81.#.161.62':445
- '81.#.194.50':445
- '81.#.115.174':445
- '81.#.36.154':445
- '81.#.238.73':445
- '81.#.61.99':445
- '81.#.108.21':445
- '81.#.174.52':445
- '81.#.77.214':445
- '81.#.195.191':445
- '81.#.122.223':445
- '81.#.49.191':445
- '81.#.14.48':445
- '81.#.214.254':445
- '81.#.151.50':445
- '81.#.13.56':139
- '81.#.56.102':445
- '81.#.102.151':445
- '81.#.255.55':445
- '81.#.136.70':445
- '81.#.78.38':445
- '81.#.83.229':445
- '81.#.162.136':445
- '81.#.210.214':445
- '81.#.90.182':445
- '81.#.181.162':445
- '81.#.136.70':139
- '81.#.78.38':139
- '81.#.83.229':139
- '81.#.162.136':139
- '81.#.210.214':139
- '81.#.90.182':139
- '81.#.181.162':139
- '81.#.122.223':139
- '81.#.209.180':139
- '81.#.14.245':139
- '81.#.9.187':139
- '81.#.155.209':139
- '81.#.25.104':139
- '81.#.161.62':139
- '81.#.194.50':139
- '81.#.255.55':139
- '81.#.47.166':445
- '81.#.11.46':445
- '81.#.177.36':445
- '81.#.227.113':445
- '81.#.67.49':445
- '81.#.22.59':445
- '81.#.228.221':445
- '81.#.79.201':445
- '81.#.49.191':139
- '81.#.14.48':139
- '81.#.214.254':139
- '81.#.151.50':139
- '81.#.122.179':445
- '81.#.56.102':139
- '81.#.102.151':139
- '81.#.78.117':139
- '81.#.74.158':139
- '81.#.164.198':139
- '81.#.36.44':139
- '81.#.119.76':139
- '81.#.205.125':139
- '81.#.186.183':139
- '81.#.230.76':139
- '81.#.200.76':139
- '81.#.20.143':139
- '81.#.177.241':139
- '81.#.53.12':139
- '81.#.50.27':139
- '81.#.236.134':139
- '81.#.81.52':139
- '81.#.172.20':139
- '81.#.42.72':139
- '81.#.72.135':139
- '81.#.61.55':139
- '81.#.80.169':139
- '81.#.15.204':139
- '81.#.62.110':139
- '81.#.109.246':139
- '81.#.64.131':139
- '81.#.228.77':139
- '81.#.45.41':139
- '81.#.50.44':139
- '81.#.87.182':139
- '81.#.73.204':139
- '81.#.44.169':139
- '81.#.42.121':139
- '81.#.230.205':139
- '81.#.248.45':139
- '81.#.45.65':139
- '81.#.13.56':445
- '81.#.140.194':445
- '81.#.199.141':445
- '81.#.196.12':445
- '81.#.27.107':139
- '81.#.140.194':139
- '81.#.199.141':139
- '81.#.196.12':139
- '81.#.219.174':139
- '81.#.101.38':139
- '81.#.94.252':139
- '81.#.116.143':139
- '81.#.219.174':445
- '81.#.126.69':139
- '81.#.115.57':139
- '81.#.57.151':139
- '81.#.191.238':139
- '81.#.240.212':139
- '81.#.39.109':139
- '81.#.162.191':139
- '81.#.62.149':139
- '81.#.101.38':445
- '81.#.94.252':445
- '81.#.116.143':445
- '81.#.27.107':445
- '81.#.230.205':445
- '81.#.248.45':445
- '81.#.45.65':445
- '81.#.115.174':139
- '81.#.144.234':139
- '81.#.95.171':139
- '81.#.18.173':139
- '81.#.100.243':139
- '81.#.86.20':139
- '81.#.221.209':139
- '81.#.128.116':139
- '81.#.51.64':139
- '81.#.177.149':139
- '81.#.175.133':139
- '81.#.134.150':139
- '81.#.26.149':139
- '81.#.208.149':139
- '81.#.243.66':139
- '81.#.82.119':139
- '81.#.61.86':139
- '81.#.177.118':445
- '81.#.213.19':445
- '81.#.219.51':445
- '81.#.1.29':445
- '81.#.21.203':445
- '81.#.106.109':445
- '81.#.35.249':445
- '81.#.89.127':445
- '81.#.87.181':139
- '81.#.158.111':139
- '81.#.59.139':139
- '81.#.0.87':139
- '81.#.139.33':445
- '81.#.59.222':445
- '81.#.6.30':445
- '81.#.21.203':139
- '81.#.106.109':139
- '81.#.35.249':139
- '81.#.225.254':139
- '81.#.186.125':139
- '81.#.237.211':139
- '81.#.155.225':139
- '81.#.177.118':139
- '81.#.59.222':139
- '81.#.1.29':139
- '81.#.6.30':139
- '81.#.219.51':139
- '81.#.213.19':139
- '81.#.89.127':139
- '81.#.139.33':139
- '81.#.61.186':139
- '81.#.206.213':139
- '81.#.246.215':139
- '81.#.15.33':139
- '81.#.155.241':139
- '81.#.150.210':139
- '81.#.203.132':139
- '81.#.57.165':139
- '81.#.135.167':139
- '81.#.5.88':139
- '81.#.53.231':139
- '81.#.64.62':139
- '81.#.206.5':139
- '81.#.6.32':139
- '81.#.78.160':139
- '81.#.159.205':139
- '81.#.186.125':9988
- '81.#.177.118':9988
- '81.#.0.87':445
- '81.#.159.205':9988
- '81.#.177.149':9988
- '81.#.213.19':9988
- '81.#.6.30':9988
- '81.#.87.181':445
- '81.#.221.209':445
- '81.#.128.116':445
- '81.#.100.243':445
- '81.#.86.20':445
- '81.#.158.111':445
- '81.#.59.139':445
- '81.#.61.86':445
- '81.#.122.179':139
- '81.#.36.154':139
- '81.#.238.73':139
- '81.#.61.99':139
- '81.#.108.21':139
- '81.#.174.52':139
- '81.#.77.214':139
- '81.#.195.191':139
- '81.#.67.49':139
- '81.#.11.46':139
- '81.#.177.36':139
- '81.#.79.201':139
- '81.#.47.166':139
- '81.#.22.59':139
- '81.#.228.221':139
- '81.#.227.113':139
- '81.#.78.160':445
- '81.#.159.205':445
- '81.#.206.5':445
- '81.#.6.32':445
- '81.#.246.215':445
- '81.#.15.33':445
- '81.#.135.167':445
- '81.#.5.88':445
- '81.#.237.211':445
- '81.#.155.225':445
- '81.#.225.254':445
- '81.#.186.125':445
- '81.#.53.231':445
- '81.#.64.62':445
- '81.#.61.186':445
- '81.#.206.213':445
- '81.#.208.149':445
- '81.#.243.66':445
- '81.#.82.119':445
- '81.#.51.64':445
- '81.#.95.171':445
- '81.#.144.234':445
- '81.#.18.173':445
- '81.#.26.149':445
- '81.#.57.165':445
- '81.#.203.132':445
- '81.#.155.241':445
- '81.#.150.210':445
- '81.#.177.149':445
- '81.#.175.133':445
- '81.#.134.150':445
