Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERca57.dir00\svchost.exe.mdmp 16325836412032216
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERca57.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '19#.#23.35.107':445
- '19#.#23.106.103':445
- '19#.#23.196.234':445
- '19#.#23.208.123':445
- '19#.#23.139.96':445
- '19#.#23.93.243':445
- '19#.#23.215.54':445
- '19#.#23.34.140':445
- '19#.#23.7.162':445
- '19#.#23.27.61':9988
- '19#.#23.163.240':9988
- '19#.#23.7.162':9988
- '19#.#23.147.249':9988
- '19#.#23.130.29':445
- '19#.#23.30.35':445
- '19#.#23.175.203':9988
- '19#.#23.134.242':445
- '19#.#23.29.203':445
- '19#.#23.255.247':445
- '19#.#23.14.96':445
- '19#.#23.159.17':445
- '19#.#23.5.107':445
- '19#.#23.163.240':445
- '19#.#23.213.131':445
- '19#.#23.248.59':445
- '19#.#23.25.217':445
- '19#.#23.97.62':445
- '19#.#23.147.249':445
- '19#.#23.45.214':445
- '19#.#23.203.109':445
- '19#.#23.102.168':445
- '19#.#23.6.142':445
- '19#.#23.254.251':445
- '19#.#23.175.203':445
- '19#.#23.79.5':445
- '19#.#23.175.144':9988
- '19#.#23.203.109':9988
- '19#.#23.102.168':9988
- '19#.#23.34.140':9988
- '19#.#23.215.54':9988
- '19#.#23.6.142':9988
- '19#.#23.97.62':9988
- '19#.#23.45.214':9988
- '19#.#23.79.5':9988
- '19#.#23.29.203':9988
- '19#.#23.130.29':9988
- '19#.#23.30.35':9988
- '19#.#23.8.48':9988
- '19#.#23.106.103':9988
- '19#.#23.208.123':9988
- '19#.#23.139.96':9988
- '19#.#23.196.234':9988
- '19#.#23.35.107':9988
- '19#.#23.14.96':9988
- '19#.#23.196.175':9988
- '19#.#23.133.64':9988
- '19#.#23.36.163':9988
- '19#.#23.205.1':9988
- '19#.#23.101.83':9988
- '19#.#23.16.27':9988
- '19#.#23.1.56':9988
- '19#.#23.32.151':9988
- '19#.#23.56.64':9988
- '19#.#23.248.59':9988
- '19#.#23.207.202':9988
- '19#.#23.159.17':9988
- '19#.#23.255.247':9988
- '19#.#23.243.93':9988
- '19#.#23.41.158':9988
- '19#.#23.112.158':9988
- '19#.#23.80.123':9988
- '19#.#23.112.158':445
- '19#.#23.25.217':139
- '19#.#23.163.240':139
- '19#.#23.255.247':139
- '19#.#23.248.59':139
- '19#.#23.80.123':139
- '19#.#23.243.93':139
- '19#.#23.213.131':139
- '19#.#23.112.158':139
- '19#.#23.14.96':139
- '19#.#23.79.5':139
- '19#.#23.6.142':139
- '19#.#23.45.214':139
- '19#.#23.175.203':139
- '19#.#23.159.17':139
- '19#.#23.5.107':139
- '19#.#23.97.62':139
- '19#.#23.254.251':139
- '19#.#23.41.158':139
- '19#.#23.46.103':139
- '19#.#23.133.64':139
- '19#.#23.16.27':139
- '19#.#23.27.61':139
- '19#.#23.101.83':139
- '19#.#23.32.151':139
- '19#.#23.139.101':139
- '19#.#23.8.48':139
- '19#.#23.175.144':139
- '19#.#23.36.163':139
- '19#.#23.52.147':139
- '19#.#23.207.202':139
- '19#.#23.196.175':139
- '19#.#23.1.56':139
- '19#.#23.56.64':139
- '19#.#23.113.53':139
- '19#.#23.205.1':139
- '19#.#23.147.249':139
- '19#.#23.175.144':445
- '19#.#23.16.27':445
- '19#.#23.1.56':445
- '19#.#23.56.64':445
- '19#.#23.139.101':445
- '19#.#23.46.103':445
- '19#.#23.27.61':445
- '19#.#23.101.83':445
- '19#.#23.205.1':445
- '19#.#23.41.158':445
- '19#.#23.207.202':445
- '19#.#23.80.123':445
- '19#.#23.243.93':445
- '19#.#23.52.147':445
- '19#.#23.113.53':445
- '19#.#23.196.175':445
- '19#.#23.36.163':445
- '19#.#23.8.48':445
- '19#.#23.34.140':139
- '19#.#23.139.96':139
- '19#.#23.106.103':139
- '19#.#23.215.54':139
- '19#.#23.203.109':139
- '19#.#23.102.168':139
- '19#.#23.93.243':139
- '19#.#23.29.203':139
- '19#.#23.35.107':139
- '19#.#23.134.242':139
- '19#.#23.130.29':139
- '19#.#23.32.151':445
- '19#.#23.133.64':445
- '19#.#23.196.234':139
- '19#.#23.208.123':139
- '19#.#23.30.35':139
- '19#.#23.7.162':139
