Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WERe370.dir00\svchost.exe.mdmp 16325836412032312
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERe370.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '64.##3.54.185':445
- '64.##3.111.141':445
- '64.##3.72.174':445
- '64.##3.75.55':445
- '64.##3.53.159':445
- '64.##3.78.182':445
- '64.##3.35.15':445
- '64.##3.195.40':445
- '64.##3.194.173':445
- '64.##3.107.144':445
- '64.##3.212.203':445
- '64.##3.108.54':9988
- '64.##3.239.78':445
- '64.##3.248.73':445
- '64.##3.61.168':445
- '64.##3.205.156':445
- '64.##3.52.227':445
- '64.##3.18.198':445
- '64.##3.119.16':445
- '64.##3.165.141':445
- '64.##3.89.30':445
- '64.##3.225.98':445
- '64.##3.210.203':445
- '64.##3.23.151':445
- '64.##3.240.75':445
- '64.##3.141.165':445
- '64.##3.241.40':445
- '64.##3.80.135':445
- '64.##3.193.8':445
- '64.##3.110.152':445
- '64.##3.135.1':445
- '64.##3.93.115':445
- '64.##3.108.54':445
- '64.#93.5.13':445
- '64.##3.80.135':9988
- '64.##3.241.40':9988
- '64.##3.110.152':9988
- '64.##3.111.141':9988
- '64.##3.110.54':9988
- '64.##3.23.151':9988
- '64.##3.89.30':9988
- '64.#93.5.13':9988
- '64.##3.195.40':9988
- '64.##3.72.174':9988
- '64.##3.239.78':9988
- '64.##3.51.65':139
- '64.##3.212.203':9988
- '64.##3.248.73':9988
- '64.##3.35.15':9988
- '64.##3.61.168':9988
- '64.##3.52.227':9988
- '64.##3.145.166':9988
- '64.##3.6.102':9988
- '64.##3.107.144':9988
- '64.##3.119.46':9988
- '64.##3.93.115':9988
- '64.##3.119.168':9988
- '64.##3.82.217':9988
- '64.##3.240.146':9988
- '64.##3.213.204':9988
- '64.##3.240.75':9988
- '64.##3.210.203':9988
- '64.##3.18.198':9988
- '64.##3.179.246':9988
- '64.##3.31.93':9988
- '64.##3.254.75':9988
- '64.##3.214.2':9988
- '64.##3.53.131':9988
- '64.##3.179.246':445
- '64.##3.119.16':139
- '64.##3.23.151':139
- '64.##3.89.30':139
- '64.##3.18.198':139
- '64.##3.210.203':139
- '64.##3.179.246':139
- '64.##3.240.75':139
- '64.##3.225.98':139
- '64.##3.165.141':139
- '64.##3.80.135':139
- '64.##3.108.54':139
- '64.##3.110.152':139
- '64.##3.241.40':139
- '64.##3.93.115':139
- '64.##3.141.165':139
- '64.#93.5.13':139
- '64.##3.135.1':139
- '64.##3.213.204':139
- '64.##3.119.46':139
- '64.##3.254.198':139
- '64.##3.31.93':139
- '64.##3.254.75':139
- '64.##3.145.166':139
- '64.##3.119.168':139
- '64.##3.136.23':139
- '64.##3.122.131':139
- '64.##3.110.54':139
- '64.##3.82.217':139
- '64.##3.123.141':139
- '64.##3.221.106':139
- '64.##3.53.131':139
- '64.##3.240.146':139
- '64.##3.6.102':139
- '64.##3.214.2':139
- '64.##3.213.204':445
- '64.##3.119.46':445
- '64.##3.254.198':445
- '64.##3.31.93':445
- '64.##3.145.166':445
- '64.##3.254.75':445
- '64.##3.119.168':445
- '64.##3.136.23':445
- '64.##3.122.131':445
- '64.##3.110.54':445
- '64.##3.82.217':445
- '64.##3.123.141':445
- '64.##3.221.106':445
- '64.##3.53.131':445
- '64.##3.240.146':445
- '64.##3.6.102':445
- '64.##3.214.2':445
- '64.##3.111.141':139
- '64.##3.35.15':139
- '64.##3.75.55':139
- '64.##3.54.185':139
- '64.##3.53.159':139
- '64.##3.193.8':139
- '64.##3.195.40':139
- '64.##3.78.182':139
- '64.##3.72.174':139
- '64.##3.212.203':139
- '64.##3.205.156':139
- '64.##3.239.78':139
- '64.##3.107.144':139
- '64.##3.61.168':139
- '64.##3.194.173':139
- '64.##3.52.227':139
- '64.##3.248.73':139
