Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERead3.dir00\svchost.exe.mdmp 16325836412032404
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WERead3.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '59.##.220.37':445
- '59.##.21.158':445
- '59.##.30.170':445
- '59.#5.101.2':445
- '59.##.206.147':445
- '59.##.195.88':445
- '59.##.122.107':445
- '59.##.220.84':445
- '59.##.253.85':445
- '59.##.197.231':9988
- '59.##.199.116':9988
- '59.##.20.135':9988
- '59.##.251.11':9988
- '59.##.127.201':9988
- '59.##.31.153':445
- '59.##.70.116':445
- '59.##.213.196':9988
- '59.##.110.12':9988
- '59.##.201.20':445
- '59.##.251.11':445
- '59.##.110.12':445
- '59.##.54.142':445
- '59.##.20.135':445
- '59.##.61.225':445
- '59.##.161.133':445
- '59.##.208.168':445
- '59.##.104.246':445
- '59.##.150.122':445
- '59.##.193.238':445
- '59.##.148.146':445
- '59.#5.9.46':445
- '59.##.230.86':445
- '59.##.238.207':445
- '59.##.117.38':445
- '59.##.122.217':445
- '59.##.59.194':445
- '59.##.220.84':9988
- '59.##.61.225':9988
- '59.##.161.133':9988
- '59.##.193.238':9988
- '59.##.54.142':9988
- '59.#5.0.128':9988
- '59.##.25.211':9988
- '59.##.238.207':9988
- '59.##.70.116':9988
- '59.##.148.146':9988
- '59.##.30.170':9988
- '59.##.253.85':9988
- '59.##.150.122':9988
- '59.##.230.86':9988
- '59.#5.9.46':9988
- '59.##.206.147':9988
- '59.##.172.186':9988
- '59.##.21.158':9988
- '59.##.138.186':9988
- '59.##.107.67':9988
- '59.#5.20.36':9988
- '59.##.52.188':9988
- '59.##.192.125':9988
- '59.##.154.52':9988
- '59.##.122.107':9988
- '59.##.130.129':9988
- '59.##.152.35':9988
- '59.#5.101.2':9988
- '59.##.31.153':9988
- '59.##.195.88':9988
- '59.##.122.217':9988
- '59.##.117.38':9988
- '59.##.22.202':9988
- '59.#5.55.53':9988
- '59.##.104.246':9988
- '59.##.174.127':9988
- '59.##.235.110':445
- '59.##.61.225':139
- '59.##.208.168':139
- '59.##.251.11':139
- '59.##.104.246':139
- '59.##.161.133':139
- '59.##.174.127':139
- '59.##.235.110':139
- '59.##.154.22':139
- '59.##.22.202':139
- '59.##.193.238':139
- '59.##.238.207':139
- '59.##.230.86':139
- '59.##.59.194':139
- '59.##.117.38':139
- '59.##.201.20':139
- '59.##.20.135':139
- '59.##.110.12':139
- '59.##.54.142':139
- '59.##.138.186':139
- '59.##.186.162':139
- '59.##.25.211':139
- '59.##.61.230':139
- '59.##.197.231':139
- '59.##.172.186':139
- '59.#5.0.128':139
- '59.##.199.116':139
- '59.##.127.201':139
- '59.##.213.196':139
- '59.##.52.188':139
- '59.##.192.125':139
- '59.##.154.52':139
- '59.##.107.67':139
- '59.##.152.35':139
- '59.#5.55.53':139
- '59.##.130.129':139
- '59.#5.20.36':139
- '59.##.61.230':445
- '59.##.138.186':445
- '59.##.52.188':445
- '59.##.107.67':445
- '59.##.186.162':445
- '59.##.197.231':445
- '59.##.199.116':445
- '59.##.25.211':445
- '59.#5.55.53':445
- '59.##.192.125':445
- '59.##.22.202':445
- '59.##.174.127':445
- '59.##.154.22':445
- '59.##.213.196':445
- '59.#5.20.36':445
- '59.##.130.129':445
- '59.##.154.52':445
- '59.##.152.35':445
- '59.##.253.85':139
- '59.##.122.107':139
- '59.##.21.158':139
- '59.##.220.37':139
- '59.##.148.146':139
- '59.##.150.122':139
- '59.##.122.217':139
- '59.##.195.88':139
- '59.#5.9.46':139
- '59.##.127.201':445
- '59.##.31.153':139
- '59.##.172.186':445
- '59.#5.0.128':445
- '59.##.70.116':139
- '59.##.220.84':139
- '59.##.206.147':139
- '59.##.30.170':139
- '59.#5.101.2':139
