Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER57b5.dir00\svchost.exe.mdmp 16325836412028856
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\WER57b5.dir00\svchost.exe.mdmp
Сетевая активность:
Подключается к:
- '65.##5.120.65':445
- '65.##5.158.185':445
- '65.##5.111.28':445
- '65.##5.114.48':445
- '65.##5.24.209':445
- '65.##5.79.134':445
- '65.##5.25.115':445
- '65.##5.17.63':445
- '65.##5.161.214':445
- '65.##5.115.42':445
- '65.##5.103.185':445
- '65.##5.225.119':445
- '65.##5.110.185':445
- '65.##5.48.57':445
- '65.##5.62.111':445
- '65.##5.86.109':445
- '65.##5.84.154':445
- '65.##5.38.15':445
- '65.##5.188.152':445
- '65.##5.192.225':445
- '65.##5.65.137':445
- '65.##5.13.152':445
- '65.##5.49.89':445
- '65.##5.161.215':445
- '65.##5.44.96':445
- '65.##5.119.93':445
- '65.##5.114.41':445
- '65.##5.237.46':445
- '65.##5.143.98':445
- '65.##5.9.198':445
- '65.##5.129.77':445
- '65.##5.45.59':445
- '65.##5.46.58':139
- '65.##5.87.59':139
- '65.##5.177.231':139
- '65.##5.11.16':139
- '65.##5.171.224':139
- '65.##5.224.50':139
- '65.##5.70.233':139
- '65.##5.67.171':139
- '65.##5.98.21':139
- '65.##5.10.109':139
- '65.##5.173.37':139
- '65.##5.72.37':139
- '65.##5.35.134':139
- '65.##5.27.32':139
- '65.##5.16.97':139
- '65.##5.192.42':139
- '65.##5.131.2':445
- '65.##5.238.163':445
- '65.##5.158.185':9988
- '65.##5.129.77':9988
- '65.##5.219.236':445
- '65.#45.26.1':445
- '65.##5.45.225':445
- '65.##5.76.92':445
- '65.##5.27.186':139
- '65.##5.192.47':139
- '65.#45.0.58':139
- '65.##5.78.158':139
- '65.##5.171.188':139
- '65.##5.188.130':139
- '65.##5.43.194':139
- '65.##5.223.171':139
- '65.##5.188.152':139
- '65.##5.49.89':139
- '65.##5.120.65':139
- '65.##5.17.63':139
- '65.##5.192.225':139
- '65.##5.161.215':139
- '65.##5.129.77':139
- '65.##5.38.15':139
- '65.##5.119.93':139
- '65.##5.45.59':139
- '65.##5.79.134':139
- '65.##5.110.185':139
- '65.##5.143.98':139
- '65.##5.9.198':139
- '65.##5.158.185':139
- '65.##5.44.96':139
- '65.##5.127.9':139
- '65.##5.42.180':139
- '65.##5.63.101':139
- '65.##5.173.227':139
- '65.##5.152.18':139
- '65.##5.57.171':139
- '65.##5.73.50':139
- '65.##5.97.145':139
- '65.##5.13.152':139
- '65.##5.101.102':139
- '65.##5.65.137':139
- '65.##5.96.126':139
- '65.##5.65.77':139
- '65.##5.39.88':139
- '65.##5.255.164':139
- '65.##5.84.154':139
- '65.##5.57.171':445
- '65.##5.97.145':445
- '65.##5.73.50':445
- '65.##5.42.180':445
- '65.##5.45.225':139
- '65.##5.76.92':139
- '65.##5.152.18':445
- '65.##5.131.2':139
- '65.##5.255.164':445
- '65.##5.65.77':445
- '65.##5.96.126':445
- '65.##5.101.102':445
- '65.##5.127.9':445
- '65.##5.173.227':445
- '65.##5.63.101':445
- '65.##5.39.88':445
- '65.##5.111.28':139
- '65.##5.86.109':139
- '65.##5.103.185':139
- '65.##5.114.41':139
- '65.##5.25.115':139
- '65.##5.237.46':139
- '65.##5.114.48':139
- '65.##5.24.209':139
- '65.##5.48.57':139
- '65.#45.26.1':139
- '65.##5.219.236':139
- '65.##5.62.111':139
- '65.##5.238.163':139
- '65.##5.115.42':139
- '65.##5.225.119':139
- '65.##5.161.214':139
