Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER1a8c.dir00\svchost.exe.mdmp 16325836412032140
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER1a8c.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
Сетевая активность:
Подключается к:
- '21#.#08.204.45':445
- '21#.#08.106.123':445
- '21#.#08.180.222':445
- '21#.#08.171.164':445
- '21#.#08.73.178':445
- '21#.#08.152.140':445
- '21#.#08.88.196':445
- '21#.#08.16.135':445
- '21#.#08.205.110':445
- '21#.#08.107.190':445
- '21#.#08.19.169':445
- '21#.#08.149.161':445
- '21#.#08.106.93':445
- '21#.#08.156.177':445
- '21#.#08.43.219':445
- '21#.#08.234.5':445
- '21#.#08.185.217':445
- '21#.#08.109.134':445
- '21#.#08.82.139':445
- '21#.#08.176.58':445
- '21#.#08.130.250':445
- '21#.#08.236.76':445
- '21#.#08.130.223':445
- '21#.#08.178.130':445
- '21#.#08.1.205':445
- '21#.#08.233.106':445
- '21#.#08.180.142':445
- '21#.#08.251.199':445
- '21#.#08.106.123':9988
- '21#.#08.88.196':9988
- '21#.#08.236.76':9988
- '21#.#08.43.219':9988
- '21#.#08.113.167':445
- '21#.#08.108.213':445
- '21#.#08.149.10':445
- '21#.#08.143.203':9988
- '21#.#08.88.209':9988
- '21#.#08.171.164':9988
- '21#.#08.19.169':9988
- '21#.#08.205.110':9988
- '21#.#08.251.199':9988
- '21#.#08.233.106':9988
- '21#.#08.64.182':445
- '21#.#08.175.123':445
- '21#.#08.57.60':445
- '21#.#08.143.203':445
- '21#.#08.162.107':445
- '21#.#08.172.189':445
- '21#.#08.88.209':445
- '21#.#08.89.27':445
- '21#.#08.225.208':445
- '21#.#08.198.9':445
- '21#.#08.27.24':445
- '21#.#08.79.2':445
- '21#.#08.27.177':445
- '21#.#08.69.60':445
- '21#.#08.98.21':445
- '21#.#08.130.223':139
- '21#.#08.178.130':139
- '21#.#08.73.178':139
- '21#.#08.1.205':139
- '21#.#08.180.142':139
- '21#.#08.251.199':139
- '21#.#08.236.76':139
- '21#.#08.204.45':139
- '21#.#08.180.222':139
- '21#.#08.149.161':139
- '21#.#08.106.123':139
- '21#.#08.152.140':139
- '21#.#08.88.196':139
- '21#.#08.171.164':139
- '21#.#08.107.22':139
- '21#.#08.98.21':139
- '21#.#08.82.139':139
- '21#.#08.97.111':139
- '21#.#08.158.33':139
- '21#.#08.72.118':139
- '21#.#08.152.5':139
- '21#.#08.234.5':139
- '21#.#08.185.217':139
- '21#.#08.233.106':139
- '21#.#08.109.134':139
- '21#.#08.176.58':139
- '21#.#08.130.250':139
- '21#.#08.43.219':139
- '21#.#08.89.27':139
- '21#.#08.198.9':139
- '21#.#08.113.167':139
- '21#.#08.225.208':139
- '21#.#08.27.177':139
- '21#.#08.69.60':139
- '21#.#08.27.24':139
- '21#.#08.158.33':445
- '21#.#08.97.111':445
- '21#.#08.107.22':445
- '21#.#08.152.5':445
- '21#.#08.108.213':139
- '21#.#08.149.10':139
- '21#.#08.72.118':445
- '21#.#08.205.110':139
- '21#.#08.107.190':139
- '21#.#08.162.107':139
- '21#.#08.16.135':139
- '21#.#08.106.93':139
- '21#.#08.19.169':139
- '21#.#08.156.177':139
- '21#.#08.175.123':139
- '21#.#08.57.60':139
- '21#.#08.79.2':139
- '21#.#08.64.182':139
- '21#.#08.88.209':139
- '21#.#08.172.189':139
- '21#.#08.143.203':139
