Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa85c.dir00\svchost.exe.mdmp 16325836412032044
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERa85c.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '67.##7.83.38':445
- '67.##7.82.112':445
- '67.##7.150.234':9988
- '67.##7.112.239':445
- '67.##7.115.58':445
- '67.##7.57.123':445
- '67.##7.28.102':445
- '67.##7.211.0':445
- '67.##7.185.22':445
- '67.##7.114.35':9988
- '67.##7.74.64':9988
- '67.##7.76.91':9988
- '67.##7.81.174':9988
- '67.##7.157.12':9988
- '67.##7.194.75':9988
- '67.##7.130.1':9988
- '67.##7.157.184':9988
- '67.##7.31.165':9988
- '67.##7.81.174':445
- '67.##7.226.81':445
- '67.##7.222.3':445
- '67.##7.102.93':445
- '67.##7.105.199':445
- '67.##7.166.29':445
- '67.##7.87.184':445
- '67.##7.208.186':445
- '67.##7.10.175':445
- '67.##7.62.191':445
- '67.##7.62.246':445
- '67.##7.149.105':445
- '67.##7.114.35':445
- '67.##7.222.9':445
- '67.#47.26.9':445
- '67.##7.120.207':445
- '67.##7.157.12':445
- '67.##7.212.240':445
- '67.##7.74.64':445
- '67.##7.125.77':9988
- '67.##7.57.123':9988
- '67.##7.28.102':9988
- '67.#47.26.9':9988
- '67.##7.222.9':9988
- '67.##7.149.105':9988
- '67.##7.120.207':9988
- '67.##7.102.93':9988
- '67.##7.212.240':9988
- '67.##7.234.4':9988
- '67.##7.82.112':9988
- '67.##7.112.239':9988
- '67.##7.241.214':9988
- '67.##7.47.77':9988
- '67.##7.83.38':9988
- '67.##7.62.246':9988
- '67.##7.185.22':9988
- '67.##7.115.58':9988
- '67.##7.211.0':9988
- '67.##7.105.199':9988
- '67.##7.72.70':9988
- '67.##7.244.87':9988
- '67.##7.221.198':9988
- '67.##7.13.20':9988
- '67.##7.76.195':9988
- '67.##7.200.42':9988
- '67.##7.27.190':9988
- '67.##7.30.174':9988
- '67.##7.189.176':9988
- '67.##7.222.3':9988
- '67.##7.62.191':9988
- '67.##7.226.81':9988
- '67.##7.166.29':9988
- '67.##7.10.175':9988
- '67.##7.203.167':9988
- '67.##7.134.224':9988
- '67.##7.158.76':9988
- '67.##7.208.186':9988
- '67.##7.87.184':139
- '67.##7.208.186':139
- '67.##7.10.175':139
- '67.##7.62.191':139
- '67.##7.203.167':139
- '67.#47.5.7':139
- '67.##7.134.224':139
- '67.##7.150.234':139
- '67.##7.234.4':139
- '67.##7.120.207':139
- '67.##7.157.12':139
- '67.##7.212.240':139
- '67.##7.74.64':139
- '67.##7.102.93':139
- '67.##7.222.3':139
- '67.##7.166.29':139
- '67.##7.105.199':139
- '67.##7.226.81':139
- '67.##7.194.75':139
- '67.##7.31.165':139
- '67.##7.157.184':139
- '67.##7.244.87':139
- '67.##7.125.77':139
- '67.##7.76.91':139
- '67.##7.13.20':139
- '67.##7.47.77':139
- '67.##7.30.174':139
- '67.##7.241.214':139
- '67.##7.76.195':139
- '67.##7.221.198':139
- '67.##7.130.1':139
- '67.##7.158.76':139
- '67.##7.27.190':139
- '67.##7.200.42':139
- '67.##7.5.101':139
- '67.##7.189.176':139
- '67.##7.72.70':139
- '67.#47.26.9':139
- '67.##7.189.176':445
- '67.##7.72.70':445
- '67.##7.221.198':445
- '67.##7.27.190':445
- '67.##7.244.87':445
- '67.##7.30.174':445
- '67.##7.125.77':445
- '67.##7.5.101':445
- '67.##7.200.42':445
- '67.##7.234.4':445
- '67.#47.5.7':445
- '67.##7.203.167':445
- '67.##7.150.234':445
- '67.##7.194.75':445
- '67.##7.158.76':445
- '67.##7.76.195':445
- '67.##7.134.224':445
- '67.##7.130.1':445
- '67.##7.31.165':445
- '67.##7.57.123':139
- '67.##7.28.102':139
- '67.##7.211.0':139
- '67.##7.185.22':139
- '67.##7.81.174':139
- '67.##7.62.246':139
- '67.##7.149.105':139
- '67.##7.114.35':139
- '67.##7.222.9':139
- '67.##7.13.20':445
- '67.##7.157.184':445
- '67.##7.76.91':445
- '67.##7.47.77':445
- '67.##7.241.214':445
- '67.##7.82.112':139
- '67.##7.115.58':139
- '67.##7.112.239':139
- '67.##7.83.38':139
