Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WERabd2.dir00\svchost.exe.mdmp 16325836412032548
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\WERabd2.dir00\svchost.exe.mdmp
Сетевая активность:
Подключается к:
- '83.##2.181.190':445
- '83.##2.95.222':445
- '83.##2.252.12':445
- '83.##2.226.64':445
- '83.##2.80.52':445
- '83.##2.80.35':445
- '83.##2.65.42':445
- '83.##2.108.56':445
- '83.##2.167.203':445
- '83.##2.102.167':445
- '83.##2.111.251':445
- '83.##2.104.118':445
- '83.##2.120.249':445
- '83.##2.208.121':445
- '83.##2.115.38':445
- '83.##2.40.83':445
- '83.##2.10.235':445
- '83.##2.46.250':445
- '83.##2.240.208':445
- '83.##2.56.253':445
- '83.##2.254.77':445
- '83.##2.140.57':445
- '83.##2.208.8':445
- '83.##2.137.30':445
- '83.##2.139.201':445
- '83.##2.60.47':445
- '83.##2.49.67':445
- '83.##2.3.181':445
- '83.##2.9.212':445
- '83.##2.101.131':9988
- '83.##2.205.238':9988
- '83.##2.111.251':9988
- '83.##2.124.121':9988
- '83.##2.79.241':445
- '83.##2.95.168':445
- '83.##2.167.203':9988
- '83.##2.142.53':9988
- '83.##2.87.142':9988
- '83.##2.115.38':9988
- '83.##2.254.77':9988
- '83.##2.110.6':9988
- '83.##2.82.89':9988
- '83.##2.63.136':9988
- '83.##2.3.212':445
- '83.##2.82.89':445
- '83.##2.101.131':445
- '83.##2.119.167':445
- '83.##2.201.43':445
- '83.##2.63.136':445
- '83.##2.34.126':445
- '83.##2.86.45':445
- '83.##2.1.126':445
- '83.##2.110.6':445
- '83.##2.185.228':445
- '83.##2.197.169':445
- '83.##2.124.121':445
- '83.##2.16.119':445
- '83.##2.208.8':139
- '83.##2.137.30':139
- '83.##2.80.52':139
- '83.##2.139.201':139
- '83.##2.3.181':139
- '83.##2.49.67':139
- '83.##2.140.57':139
- '83.##2.95.222':139
- '83.##2.252.12':139
- '83.##2.104.118':139
- '83.##2.181.190':139
- '83.##2.80.35':139
- '83.##2.65.42':139
- '83.##2.226.64':139
- '83.##2.205.238':139
- '83.##2.120.26':139
- '83.##2.240.208':139
- '83.##2.213.175':139
- '83.##2.93.87':139
- '83.##2.142.53':139
- '83.##2.87.142':139
- '83.##2.10.235':139
- '83.##2.46.250':139
- '83.##2.60.47':139
- '83.##2.115.38':139
- '83.##2.56.253':139
- '83.##2.254.77':139
- '83.##2.40.83':139
- '83.##2.120.249':139
- '83.##2.1.126':139
- '83.##2.110.6':139
- '83.##2.79.241':139
- '83.##2.86.45':139
- '83.##2.124.121':139
- '83.##2.16.119':139
- '83.##2.185.228':139
- '83.##2.213.175':445
- '83.##2.205.238':445
- '83.##2.120.26':445
- '83.##2.142.53':445
- '83.##2.95.168':139
- '83.##2.87.142':445
- '83.##2.93.87':445
- '83.##2.102.167':139
- '83.##2.9.212':139
- '83.##2.201.43':139
- '83.##2.167.203':139
- '83.##2.208.121':139
- '83.##2.111.251':139
- '83.##2.108.56':139
- '83.##2.82.89':139
- '83.##2.101.131':139
- '83.##2.197.169':139
- '83.##2.3.212':139
- '83.##2.63.136':139
- '83.##2.34.126':139
- '83.##2.119.167':139
