Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1108 -dm 7 7 %TEMP%\WERe410.dir00\svchost.exe.mdmp 16325836412032052
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WERe410.dir00\svchost.exe.mdmp
Сетевая активность:
Подключается к:
- '59.##.213.249':445
- '59.##.13.128':445
- '59.#6.34.42':445
- '59.#6.1.80':445
- '59.##.170.153':445
- '59.##.154.205':445
- '59.#6.5.76':445
- '59.##.125.223':445
- '59.##.117.41':445
- '59.##.40.128':9988
- '59.##.78.204':9988
- '59.#6.31.73':9988
- '59.##.245.118':9988
- '59.##.127.230':445
- '59.##.116.221':445
- '59.##.83.117':9988
- '59.##.31.100':445
- '59.##.220.225':445
- '59.##.253.224':445
- '59.#6.94.79':445
- '59.##.189.16':445
- '59.##.202.154':445
- '59.##.162.41':445
- '59.##.144.238':445
- '59.##.223.68':445
- '59.##.179.97':445
- '59.##.41.125':445
- '59.##.161.85':445
- '59.#6.26.98':445
- '59.##.198.97':445
- '59.##.133.213':445
- '59.##.90.224':445
- '59.##.221.225':445
- '59.##.119.202':445
- '59.#6.60.41':445
- '59.##.162.41':9988
- '59.##.170.153':9988
- '59.##.179.97':9988
- '59.##.202.154':9988
- '59.##.206.112':9988
- '59.##.240.150':9988
- '59.#6.26.98':9988
- '59.##.90.224':9988
- '59.##.125.223':9988
- '59.##.224.192':9988
- '59.##.127.230':9988
- '59.##.119.202':9988
- '59.##.144.238':9988
- '59.##.31.100':9988
- '59.##.166.140':9988
- '59.#6.34.42':9988
- '59.#6.72.22':9988
- '59.##.95.252':9988
- '59.##.213.249':9988
- '59.##.128.244':9988
- '59.#6.0.5':9988
- '59.#6.5.76':9988
- '59.#6.41.68':9988
- '59.##.189.16':9988
- '59.##.99.244':9988
- '59.##.221.225':9988
- '59.#6.2.253':9988
- '59.#6.94.79':9988
- '59.##.133.213':9988
- '59.##.198.97':9988
- '59.##.116.221':9988
- '59.#6.60.41':9988
- '59.##.223.68':9988
- '59.#6.7.127':9988
- '59.##.159.141':9988
- '59.##.41.125':9988
- '59.##.240.150':445
- '59.##.240.150':139
- '59.##.179.97':139
- '59.#6.26.98':139
- '59.##.119.202':139
- '59.#6.72.22':139
- '59.##.159.141':139
- '59.##.144.238':139
- '59.##.223.68':139
- '59.##.162.41':139
- '59.##.253.224':139
- '59.##.154.205':139
- '59.##.220.225':139
- '59.##.41.125':139
- '59.##.189.16':139
- '59.#6.94.79':139
- '59.##.202.154':139
- '59.##.170.153':139
- '59.##.40.128':139
- '59.##.93.195':139
- '59.#6.102.0':139
- '59.#6.41.68':139
- '59.#6.2.253':139
- '59.##.206.112':139
- '59.##.224.192':139
- '59.##.128.244':139
- '59.##.99.244':139
- '59.#6.0.5':139
- '59.##.166.140':139
- '59.##.83.117':139
- '59.##.245.118':139
- '59.##.30.135':139
- '59.#6.31.73':139
- '59.##.95.252':139
- '59.#6.7.127':139
- '59.##.78.204':139
- '59.##.161.85':139
- '59.#6.0.5':445
- '59.#6.102.0':445
- '59.#6.31.73':445
- '59.##.95.252':445
- '59.#6.2.253':445
- '59.##.99.244':445
- '59.##.93.195':445
- '59.#6.41.68':445
- '59.##.83.117':445
- '59.##.40.128':445
- '59.##.166.140':445
- '59.#6.72.22':445
- '59.##.30.135':445
- '59.##.78.204':445
- '59.#6.7.127':445
- '59.##.245.118':445
- '59.##.159.141':445
- '59.##.128.244':445
- '59.##.213.249':139
- '59.##.90.224':139
- '59.#6.5.76':139
- '59.#6.1.80':139
- '59.##.198.97':139
- '59.##.221.225':139
- '59.#6.60.41':139
- '59.##.133.213':139
- '59.##.125.223':139
- '59.##.116.221':139
- '59.##.117.41':139
- '59.##.224.192':445
- '59.##.206.112':445
- '59.#6.34.42':139
- '59.##.31.100':139
- '59.##.127.230':139
- '59.##.13.128':139
