Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER2824.dir00\svchost.exe.mdmp 16325836412032292
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER2824.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '13#.#93.8.36':445
- '13#.#93.210.22':445
- '13#.#93.155.217':445
- '13#.#93.114.157':445
- '13#.#93.72.230':445
- '13#.#93.230.155':445
- '13#.#93.201.122':445
- '13#.#93.60.118':445
- '13#.#93.233.230':445
- '13#.#93.72.230':9988
- '13#.#93.39.228':9988
- '13#.#93.209.105':9988
- '13#.#93.210.22':9988
- '13#.#93.67.234':9988
- '13#.#93.61.215':445
- '13#.#93.246.246':445
- '13#.#93.60.8':9988
- '13#.#93.123.39':9988
- '13#.#93.57.203':445
- '13#.#93.58.26':445
- '13#.#93.31.188':445
- '13#.#93.90.201':445
- '13#.#93.217.54':445
- '13#.#93.38.107':445
- '13#.#93.227.23':445
- '13#.#93.12.148':445
- '13#.#93.165.141':445
- '13#.#93.208.199':445
- '13#.#93.127.249':445
- '13#.#93.180.14':445
- '13#.#93.125.54':445
- '13#.#93.94.129':445
- '13#.#93.59.46':445
- '13#.#93.21.36':445
- '13#.#93.63.153':445
- '13#.#93.188.13':445
- '13#.#93.142.110':9988
- '13#.#93.125.54':9988
- '13#.#93.127.249':9988
- '13#.#93.201.122':9988
- '13#.#93.180.14':9988
- '13#.#93.208.199':9988
- '13#.#93.31.188':9988
- '13#.#93.59.46':9988
- '13#.#93.94.129':9988
- '13#.#93.90.201':9988
- '13#.#93.61.215':9988
- '13#.#93.155.217':9988
- '13#.#93.114.157':9988
- '13#.#93.246.246':9988
- '13#.#93.188.13':9988
- '13#.#93.233.230':9988
- '13#.#93.230.155':9988
- '13#.#93.8.36':9988
- '13#.#93.60.118':9988
- '13#.#93.186.179':9988
- '13#.#93.189.62':9988
- '13#.#93.227.23':9988
- '13#.#93.240.131':9988
- '13#.#93.51.245':9988
- '13#.#93.33.176':9988
- '13#.#93.151.116':9988
- '13#.#93.18.232':9988
- '13#.#93.83.40':9988
- '13#.#93.12.148':9988
- '13#.#93.57.203':9988
- '13#.#93.58.26':9988
- '13#.#93.165.141':9988
- '13#.#93.217.54':9988
- '13#.#93.208.201':9988
- '13#.#93.30.32':9988
- '13#.#93.38.107':9988
- '13#.#93.240.185':9988
- '13#.#93.165.141':139
- '13#.#93.38.107':139
- '13#.#93.217.54':139
- '13#.#93.12.148':139
- '13#.#93.227.23':139
- '13#.#93.208.201':139
- '13#.#93.189.62':139
- '13#.#93.240.185':139
- '13#.#93.123.39':139
- '13#.#93.188.13':139
- '13#.#93.59.46':139
- '13#.#93.94.129':139
- '13#.#93.63.153':139
- '13#.#93.21.36':139
- '13#.#93.57.203':139
- '13#.#93.58.26':139
- '13#.#93.31.188':139
- '13#.#93.90.201':139
- '13#.#93.87.41':139
- '13#.#93.151.116':139
- '13#.#93.161.244':139
- '13#.#93.123.192':139
- '13#.#93.240.131':139
- '13#.#93.180.180':139
- '13#.#93.60.8':139
- '13#.#93.67.234':139
- '13#.#93.33.176':139
- '13#.#93.186.179':139
- '13#.#93.221.123':139
- '13#.#93.30.32':139
- '13#.#93.83.40':139
- '13#.#93.39.228':139
- '13#.#93.209.105':139
- '13#.#93.18.232':139
- '13#.#93.142.110':139
- '13#.#93.51.245':139
- '13#.#93.127.249':139
- '13#.#93.209.105':445
- '13#.#93.18.232':445
- '13#.#93.142.110':445
- '13#.#93.51.245':445
- '13#.#93.161.244':445
- '13#.#93.151.116':445
- '13#.#93.180.180':445
- '13#.#93.123.192':445
- '13#.#93.87.41':445
- '13#.#93.208.201':445
- '13#.#93.189.62':445
- '13#.#93.240.185':445
- '13#.#93.123.39':445
- '13#.#93.30.32':445
- '13#.#93.221.123':445
- '13#.#93.39.228':445
- '13#.#93.83.40':445
- '13#.#93.186.179':445
- '13#.#93.60.118':139
- '13#.#93.233.230':139
- '13#.#93.210.22':139
- '13#.#93.72.230':139
- '13#.#93.230.155':139
- '13#.#93.125.54':139
- '13#.#93.208.199':139
- '13#.#93.201.122':139
- '13#.#93.180.14':139
- '13#.#93.33.176':445
- '13#.#93.67.234':445
- '13#.#93.60.8':445
- '13#.#93.240.131':445
- '13#.#93.61.215':139
- '13#.#93.114.157':139
- '13#.#93.8.36':139
- '13#.#93.246.246':139
- '13#.#93.155.217':139
