Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1156 -dm 7 7 %TEMP%\WERb609.dir00\svchost.exe.mdmp 16325836412029548
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERb609.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '88.##.118.217':9988
- '88.##.146.107':9988
- '88.##.106.140':9988
- '88.#9.224.8':9988
- '88.##.137.136':9988
- '88.##.247.114':9988
- '88.##.167.64':9988
- '88.##.130.105':9988
- '88.#9.21.71':9988
- '88.##.103.197':9988
- '88.#9.46.76':9988
- '88.#9.74.71':9988
- '88.##.243.58':9988
- '88.##.155.31':9988
- '88.##.252.113':9988
- '88.##.36.187':9988
- '88.##.240.216':9988
- '88.##.250.145':9988
- '88.##.204.30':9988
- '88.##.116.77':9988
- '88.##.27.138':9988
- '88.##.251.180':445
- '88.##.77.171':445
- '88.##.180.42':445
- '88.##.58.174':445
- '88.##.14.159':445
- '88.##.213.86':445
- '88.##.27.138':445
- '88.##.64.213':445
- '88.##.23.101':445
- '88.##.36.187':445
- '88.##.20.190':445
- '88.##.36.107':9988
- '88.#9.77.62':9988
- '88.##.63.198':9988
- '88.#9.76.32':9988
- '88.#9.94.38':9988
- '88.##.113.228':445
- '88.##.28.175':445
- '88.##.63.198':445
- '88.#9.94.38':445
- '88.##.143.30':445
- '88.##.61.158':9988
- '88.##.23.137':139
- '88.#9.15.9':139
- '88.##.203.91':139
- '88.#9.75.9':139
- '88.##.39.204':139
- '88.##.64.213':9988
- '88.##.24.104':9988
- '88.##.180.42':9988
- '88.#9.7.174':139
- '88.##.190.24':139
- '88.#9.1.177':139
- '88.##.132.223':139
- '88.##.133.20':139
- '88.##.145.101':139
- '88.##.133.59':139
- '88.#9.60.92':139
- '88.#9.74.3':139
- '88.##.249.14':139
- '88.##.69.238':139
- '88.##.34.186':139
- '88.##.227.32':139
- '88.##.77.171':9988
- '88.##.58.174':9988
- '88.##.113.228':9988
- '88.##.20.190':9988
- '88.#9.154.7':9988
- '88.##.213.86':9988
- '88.##.23.101':9988
- '88.##.128.175':9988
- '88.#9.30.83':9988
- '88.##.251.180':9988
- '88.##.143.30':9988
- '88.##.160.245':9988
- '88.##.146.254':9988
- '88.##.42.205':9988
- '88.##.147.149':9988
- '88.##.141.42':9988
- '88.##.28.175':9988
- '88.##.14.159':9988
- '88.##.104.230':9988
- '88.##.90.243':9988
- '88.##.133.136':9988
- '88.#9.154.7':445
- '88.##.252.113':139
- '88.##.147.149':139
- '88.##.24.104':139
- '88.##.61.158':139
- '88.##.240.216':139
- '88.##.141.42':139
- '88.##.155.31':139
- '88.#9.46.76':139
- '88.##.250.145':139
- '88.#9.224.8':139
- '88.#9.77.62':139
- '88.##.36.187':139
- '88.##.64.213':139
- '88.##.23.101':139
- '88.##.251.180':139
- '88.##.77.171':139
- '88.#9.30.83':139
- '88.##.116.77':139
- '88.#9.154.7':139
- '88.##.213.86':139
- '88.##.27.138':139
- '88.##.106.140':139
- '88.##.104.230':139
- '88.##.36.107':139
- '88.##.247.114':139
- '88.##.90.243':139
- '88.##.146.254':139
- '88.#9.21.71':139
- '88.##.42.205':139
- '88.##.128.175':139
- '88.#9.76.32':139
- '88.##.103.197':139
- '88.#9.74.71':139
- '88.##.130.105':139
- '88.##.146.107':139
- '88.##.243.58':139
- '88.##.160.245':139
- '88.##.204.30':139
- '88.##.118.217':139
- '88.##.133.136':139
- '88.##.167.64':139
- '88.##.137.136':139
- '88.##.180.42':139
- '88.##.160.245':445
- '88.#9.74.71':445
- '88.##.243.58':445
- '88.##.155.31':445
- '88.##.141.42':445
- '88.##.137.136':445
- '88.##.133.136':445
- '88.##.167.64':445
- '88.##.146.107':445
- '88.##.130.105':445
- '88.#9.46.76':445
- '88.##.61.158':445
- '88.##.240.216':445
- '88.#9.77.62':445
- '88.#9.30.83':445
- '88.##.116.77':445
- '88.##.250.145':445
- '88.#9.224.8':445
- '88.##.147.149':445
- '88.##.24.104':445
- '88.##.252.113':445
- '88.##.143.30':139
- '88.##.63.198':139
- '88.#9.94.38':139
- '88.#9.76.32':445
- '88.##.42.205':445
- '88.##.58.174':139
- '88.##.14.159':139
- '88.##.20.190':139
- '88.##.113.228':139
- '88.##.28.175':139
- '88.##.106.140':445
- '88.##.247.114':445
- '88.##.36.107':445
- '88.##.103.197':445
- '88.##.204.30':445
- '88.##.118.217':445
- '88.##.104.230':445
- '88.##.128.175':445
- '88.##.146.254':445
- '88.##.90.243':445
- '88.#9.21.71':445
