Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERb443.dir00\svchost.exe.mdmp 16325836412032148
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERb443.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '69.##.236.27':445
- '69.#3.9.246':445
- '69.##.246.149':445
- '69.##.127.229':445
- '69.##.118.202':445
- '69.##.141.173':445
- '69.##.87.236':445
- '69.##.103.114':139
- '69.##.71.204':139
- '69.##.141.208':445
- '69.##.152.145':445
- '69.##.145.88':445
- '69.#3.1.187':445
- '69.#3.72.38':139
- '69.##.103.114':445
- '69.##.117.69':9988
- '69.##.232.55':139
- '69.##.55.167':139
- '69.##.166.165':139
- '69.##.40.134':445
- '69.#3.7.114':445
- '69.##.220.128':445
- '69.##.71.204':445
- '69.#3.5.106':9988
- '69.##.15.136':445
- '69.#3.16.99':9988
- '69.#3.75.34':9988
- '69.##.118.203':9988
- '69.##.145.88':139
- '69.##.87.236':139
- '69.##.236.31':9988
- '69.##.124.93':9988
- '69.##.175.48':9988
- '69.##.236.31':445
- '69.##.91.146':9988
- '69.##.244.75':9988
- '69.##.133.197':9988
- '69.##.152.145':139
- '69.##.220.128':139
- '69.#3.1.187':139
- '69.##.127.229':139
- '69.##.15.136':139
- '69.##.40.134':139
- '69.#3.7.114':139
- '69.#3.9.246':139
- '69.##.246.149':139
- '69.##.141.208':139
- '69.##.118.202':139
- '69.##.141.173':139
- '69.##.236.27':139
- '69.#3.99.64':9988
- '69.##.203.16':445
- '69.#3.16.89':445
- '69.##.222.216':445
- '69.##.238.114':445
- '69.##.114.148':445
- '69.##.104.85':445
- '69.##.119.78':445
- '69.##.78.125':445
- '69.##.159.129':445
- '69.##.113.28':445
- '69.#3.28.30':445
- '69.#3.52.89':445
- '69.##.49.191':445
- '69.##.124.241':139
- '69.##.241.161':139
- '69.##.135.228':139
- '69.##.156.67':139
- '69.##.246.61':139
- '69.##.159.198':139
- '69.#3.47.97':139
- '69.#3.65.75':445
- '69.##.51.153':445
- '69.##.206.223':139
- '69.##.181.200':139
- '69.##.78.172':139
- '69.#3.52.89':139
- '69.##.119.78':139
- '69.##.29.102':9988
- '69.##.222.216':139
- '69.##.113.28':139
- '69.#3.28.30':139
- '69.#3.21.48':9988
- '69.##.159.129':139
- '69.##.117.75':139
- '69.##.78.125':139
- '69.#3.94.34':9988
- '69.##.219.178':9988
- '69.#3.16.89':139
- '69.##.166.165':445
- '69.#3.72.38':445
- '69.#3.65.75':139
- '69.##.117.75':445
- '69.##.232.55':445
- '69.##.55.167':445
- '69.##.114.148':139
- '69.##.104.85':139
- '69.##.203.16':139
- '69.##.51.153':139
- '69.##.49.191':139
- '69.##.238.114':139
- '69.##.223.143':139
- '69.##.230.156':139
- '69.##.156.226':139
- '69.#3.32.38':139
- '69.#3.75.34':139
- '69.##.155.130':139
- '69.##.16.139':139
- '69.##.133.194':139
- '69.##.202.79':139
- '69.#3.5.64':139
- '69.##.117.71':139
- '69.##.55.220':139
- '69.##.193.52':139
- '69.##.214.77':139
- '69.##.192.171':139
- '69.#3.16.99':139
- '69.##.106.178':139
- '69.##.115.56':139
- '69.##.56.192':139
- '69.##.130.91':139
- '69.#3.92.27':139
- '69.#3.8.87':139
- '69.#3.16.41':139
- '69.##.132.225':139
- '69.#3.84.39':139
- '69.##.124.93':139
- '69.##.13.117':139
- '69.#3.5.106':139
- '69.##.240.29':139
- '69.##.29.102':139
- '69.##.175.48':139
- '69.##.244.75':139
- '69.##.133.197':139
- '69.##.159.172':139
- '69.##.15.176':139
- '69.##.117.69':139
- '69.##.44.235':139
- '69.#3.99.64':139
- '69.##.91.146':139
- '69.##.56.175':139
- '69.##.112.113':139
- '69.##.14.229':139
- '69.##.118.203':139
- '69.##.182.57':139
- '69.##.219.178':139
- '69.#3.94.34':139
- '69.#3.21.48':139
- '69.##.123.111':139
- '69.##.153.239':139
- '69.#3.93.57':139
- '69.##.236.31':139
- '69.##.223.143':445
- '69.##.230.156':445
- '69.##.156.226':445
- '69.#3.32.38':445
- '69.#3.75.34':445
- '69.##.155.130':445
- '69.##.16.139':445
- '69.##.133.194':445
- '69.##.202.79':445
- '69.#3.5.64':445
- '69.##.117.71':445
- '69.##.55.220':445
- '69.##.193.52':445
- '69.##.214.77':445
- '69.##.192.171':445
- '69.#3.16.99':445
- '69.##.106.178':445
- '69.##.115.56':445
- '69.##.56.192':445
- '69.##.130.91':445
- '69.#3.92.27':445
- '69.#3.8.87':445
- '69.#3.16.41':445
- '69.##.132.225':445
- '69.#3.84.39':445
- '69.#3.5.106':445
- '69.##.244.75':445
- '69.##.159.172':445
- '69.##.240.29':445
- '69.##.29.102':445
- '69.##.175.48':445
- '69.##.124.93':445
- '69.##.117.69':445
- '69.##.13.117':445
- '69.##.44.235':445
- '69.##.15.176':445
- '69.##.133.197':445
- '69.#3.99.64':445
- '69.##.91.146':445
- '69.##.56.175':445
- '69.##.112.113':445
- '69.##.14.229':445
- '69.##.118.203':445
- '69.##.182.57':445
- '69.##.219.178':445
- '69.#3.94.34':445
- '69.#3.21.48':445
- '69.##.123.111':445
- '69.##.153.239':445
- '69.#3.93.57':445
