Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER59a1.dir00\svchost.exe.mdmp 16325836412032112
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER59a1.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '63.##1.246.90':139
- '63.##1.143.94':9988
- '63.##1.69.199':139
- '63.##1.246.90':445
- '63.##1.68.244':9988
- '63.##1.239.247':445
- '63.##1.143.94':445
- '63.##1.171.104':9988
- '63.##1.64.179':445
- '63.##1.10.69':139
- '63.##1.101.59':139
- '63.##1.16.114':139
- '63.##1.148.85':139
- '63.##1.66.72':139
- '63.##1.114.51':139
- '63.##1.160.129':139
- '63.##1.107.62':139
- '63.##1.174.223':139
- '63.##1.99.168':139
- '63.##1.253.189':445
- '63.##1.178.78':445
- '63.##1.251.207':445
- '63.##1.191.15':445
- '63.##1.26.201':445
- '63.##1.42.10':445
- '63.##1.67.40':445
- '63.##1.143.80':445
- '63.##1.222.201':445
- '63.#51.62.5':445
- '63.##1.255.105':445
- '63.##1.8.241':445
- '63.##1.84.220':445
- '63.##1.110.251':445
- '63.##1.38.84':445
- '63.##1.55.254':445
- '63.##1.192.120':445
- '63.##1.154.135':445
- '63.##1.20.152':445
- '63.##1.128.249':445
- '63.##1.181.246':139
- '63.##1.104.119':139
- '63.##1.209.233':139
- '63.##1.233.181':139
- '63.##1.83.234':139
- '63.##1.244.0':139
- '63.##1.77.162':139
- '63.##1.136.75':139
- '63.##1.124.132':139
- '63.##1.28.210':139
- '63.##1.71.155':139
- '63.##1.68.67':139
- '63.##1.70.243':139
- '63.##1.243.127':139
- '63.##1.18.193':139
- '63.##1.64.203':139
- '63.##1.203.28':139
- '63.##1.156.189':139
- '63.##1.49.67':139
- '63.##1.23.195':139
- '63.##1.26.252':139
- '63.##1.180.12':139
- '63.##1.116.190':139
- '63.##1.201.96':139
- '63.##1.191.71':139
- '63.##1.222.129':139
- '63.##1.57.26':139
- '63.##1.92.47':139
- '63.#51.9.14':139
- '63.##1.92.253':139
- '63.##1.27.18':139
- '63.##1.245.246':139
- '63.##1.96.119':139
- '63.#51.29.5':139
- '63.##1.247.103':139
- '63.##1.172.118':139
- '63.##1.118.47':139
- '63.##1.231.4':139
- '63.##1.186.70':139
- '63.##1.160.15':445
- '63.##1.41.126':139
- '63.##1.133.163':139
- '63.##1.143.80':139
- '63.##1.160.15':139
- '63.##1.111.36':139
- '63.##1.9.144':139
- '63.##1.66.113':139
- '63.##1.84.194':139
- '63.##1.54.29':139
- '63.##1.67.40':139
- '63.##1.191.15':139
- '63.##1.26.201':139
- '63.##1.154.135':139
- '63.##1.255.105':139
- '63.##1.178.78':139
- '63.##1.222.201':139
- '63.#51.62.5':139
- '63.##1.251.207':139
- '63.##1.42.10':139
- '63.##1.36.105':139
- '63.##1.230.33':139
- '63.##1.227.235':139
- '63.##1.104.249':139
- '63.##1.58.127':139
- '63.##1.95.132':139
- '63.##1.153.163':139
- '63.##1.70.221':139
- '63.##1.98.79':139
- '63.##1.171.104':139
- '63.##1.112.75':139
- '63.##1.179.91':139
- '63.##1.22.144':139
- '63.#51.0.11':139
- '63.##1.88.32':139
- '63.##1.116.196':139
- '63.##1.68.244':139
- '63.##1.125.72':139
- '63.##1.141.98':139
- '63.##1.87.119':139
- '63.##1.116.196':445
- '63.##1.141.98':445
- '63.##1.179.91':445
- '63.##1.22.144':445
- '63.##1.87.119':445
- '63.##1.112.75':445
- '63.##1.104.249':445
- '63.##1.68.244':445
- '63.##1.125.72':445
- '63.##1.88.32':445
- '63.##1.111.36':445
- '63.##1.84.194':445
- '63.##1.41.126':445
- '63.##1.133.163':445
- '63.##1.54.29':445
- '63.##1.36.105':445
- '63.#51.0.11':445
- '63.##1.9.144':445
- '63.##1.66.113':445
- '63.##1.58.127':445
- '63.##1.38.84':139
- '63.##1.8.241':139
- '63.##1.253.189':139
- '63.##1.110.251':139
- '63.##1.84.220':139
- '63.##1.128.249':139
- '63.##1.192.120':139
- '63.##1.55.254':139
- '63.##1.20.152':139
- '63.##1.143.94':139
- '63.##1.227.235':445
- '63.##1.70.221':445
- '63.##1.230.33':445
- '63.##1.153.163':445
- '63.##1.95.132':445
- '63.##1.64.179':139
- '63.##1.239.247':139
- '63.##1.98.79':445
- '63.##1.171.104':445
