Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER42ec.dir00\svchost.exe.mdmp 16325836412032248
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER42ec.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
Сетевая активность:
Подключается к:
- '82.##.211.114':9988
- '82.##.156.80':9988
- '82.##.46.180':9988
- '82.#8.7.81':9988
- '82.##.28.120':9988
- '82.#8.85.2':9988
- '82.#8.250.1':9988
- '82.#8.5.199':9988
- '82.##.52.109':9988
- '82.##.109.137':9988
- '82.##.31.140':9988
- '82.##.118.189':9988
- '82.##.117.234':9988
- '82.##.48.110':9988
- '82.##.124.95':9988
- '82.##.157.196':9988
- '82.##.22.154':9988
- '82.##.31.224':9988
- '82.##.81.130':9988
- '82.#8.30.31':9988
- '82.##.224.95':9988
- '82.##.129.112':9988
- '82.##.26.125':9988
- '82.##.102.227':9988
- '82.##.250.53':445
- '82.##.124.95':445
- '82.##.250.53':9988
- '82.##.32.123':9988
- '82.##.59.186':9988
- '82.##.227.54':445
- '82.#8.70.11':445
- '82.##.140.62':445
- '82.##.26.125':445
- '82.##.59.186':445
- '82.##.31.224':445
- '82.##.96.184':9988
- '82.#8.33.89':9988
- '82.##.96.107':9988
- '82.##.157.142':9988
- '82.##.11.125':9988
- '82.##.141.94':9988
- '82.#8.58.21':9988
- '82.##.107.159':9988
- '82.#8.93.67':9988
- '82.##.141.153':9988
- '82.#8.48.37':9988
- '82.#8.33.87':9988
- '82.#8.39.18':139
- '82.##.83.212':139
- '82.##.11.127':139
- '82.##.130.111':139
- '82.##.115.149':139
- '82.##.159.234':139
- '82.##.180.117':139
- '82.#8.37.31':139
- '82.##.185.138':139
- '82.##.234.208':139
- '82.##.170.122':139
- '82.##.111.130':139
- '82.##.69.214':139
- '82.##.66.246':139
- '82.##.237.219':139
- '82.#8.42.67':139
- '82.##.66.203':139
- '82.##.34.231':139
- '82.##.42.198':139
- '82.#8.90.32':139
- '82.##.178.137':139
- '82.##.164.95':139
- '82.##.66.191':139
- '82.##.144.127':139
- '82.##.111.186':9988
- '82.##.47.117':9988
- '82.#8.1.52':9988
- '82.##.140.62':9988
- '82.##.86.150':9988
- '82.##.152.239':9988
- '82.##.25.116':9988
- '82.#8.70.11':9988
- '82.##.215.69':9988
- '82.##.226.163':9988
- '82.##.243.54':9988
- '82.##.227.54':9988
- '82.##.148.30':139
- '82.#8.30.61':139
- '82.##.200.227':139
- '82.##.152.143':139
- '82.#8.38.47':139
- '82.##.60.230':139
- '82.##.251.110':139
- '82.##.110.227':139
- '82.##.117.52':139
- '82.##.131.144':139
- '82.#8.7.170':139
- '82.##.31.140':139
- '82.#8.85.2':139
- '82.##.22.154':139
- '82.##.129.112':139
- '82.##.224.95':139
- '82.#8.7.81':139
- '82.##.46.180':139
- '82.#8.30.31':139
- '82.##.118.189':139
- '82.##.157.196':139
- '82.##.109.137':139
- '82.##.156.80':139
- '82.##.140.62':139
- '82.##.48.110':139
- '82.#8.70.11':139
- '82.##.31.224':139
- '82.##.26.125':139
- '82.##.86.150':139
- '82.##.211.114':139
- '82.##.28.120':139
- '82.##.102.227':139
- '82.##.117.234':139
- '82.#8.250.1':139
- '82.#8.33.89':139
- '82.#8.5.199':139
- '82.#8.33.87':139
- '82.#8.58.21':139
- '82.##.215.69':139
- '82.##.47.117':139
- '82.##.243.54':139
- '82.##.226.163':139
- '82.#8.1.52':139
- '82.##.111.186':139
- '82.#8.48.37':139
- '82.##.52.109':139
- '82.##.11.125':139
- '82.##.107.159':139
- '82.##.81.130':139
- '82.##.96.107':139
- '82.##.96.184':139
- '82.##.157.142':139
- '82.##.32.123':139
- '82.##.141.153':139
- '82.##.152.239':139
- '82.##.25.116':139
- '82.##.141.94':139
- '82.#8.93.67':139
- '82.##.157.196':445
- '82.##.46.180':445
- '82.##.109.137':445
- '82.#8.85.2':445
- '82.#8.7.81':445
- '82.##.118.189':445
- '82.##.157.142':445
- '82.##.96.107':445
- '82.##.96.184':445
- '82.#8.30.31':445
- '82.#8.33.89':445
- '82.##.31.140':445
- '82.#8.250.1':445
- '82.##.102.227':445
- '82.##.86.150':445
- '82.##.48.110':445
- '82.##.117.234':445
- '82.##.211.114':445
- '82.##.224.95':445
- '82.##.22.154':445
- '82.##.129.112':445
- '82.##.28.120':445
- '82.##.156.80':445
- '82.##.107.159':445
- '82.##.52.109':445
- '82.##.141.153':445
- '82.#8.58.21':445
- '82.#8.1.52':445
- '82.##.152.239':445
- '82.##.47.117':445
- '82.##.250.53':139
- '82.##.124.95':139
- '82.##.59.186':139
- '82.#8.5.199':445
- '82.##.227.54':139
- '82.#8.93.67':445
- '82.##.215.69':445
- '82.##.11.125':445
- '82.##.141.94':445
- '82.##.81.130':445
- '82.##.32.123':445
- '82.#8.48.37':445
- '82.#8.33.87':445
- '82.##.226.163':445
- '82.##.25.116':445
- '82.##.243.54':445
- '82.##.111.186':445
