Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERb394.dir00\svchost.exe.mdmp 16325836412032280
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERb394.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Сетевая активность:
Подключается к:
- '63.##.228.80':445
- '63.##.118.69':445
- '63.##.36.249':445
- '63.##.225.123':445
- '63.##.47.152':445
- '63.##.97.184':445
- '63.#3.51.23':445
- '63.##.105.187':445
- '63.##.222.148':445
- '63.##.118.69':9988
- '63.##.105.187':9988
- '63.##.36.249':9988
- '63.##.200.237':9988
- '63.##.218.216':9988
- '63.##.200.237':445
- '63.#3.89.43':445
- '63.#3.62.15':9988
- '63.#3.28.52':9988
- '63.##.55.243':445
- '63.##.120.21':445
- '63.##.104.11':445
- '63.#3.18.23':445
- '63.##.79.197':445
- '63.#3.50.77':445
- '63.#3.62.15':445
- '63.##.82.115':445
- '63.##.214.203':445
- '63.##.179.220':445
- '63.##.129.29':445
- '63.##.45.173':445
- '63.#3.2.223':445
- '63.##.96.107':445
- '63.##.218.216':445
- '63.##.155.160':445
- '63.##.222.145':445
- '63.##.146.18':445
- '63.##.100.33':9988
- '63.##.79.197':9988
- '63.##.146.18':9988
- '63.##.179.220':9988
- '63.##.129.29':9988
- '63.##.96.107':9988
- '63.##.120.21':9988
- '63.#3.18.23':9988
- '63.##.155.160':9988
- '63.##.104.11':9988
- '63.##.228.80':9988
- '63.##.47.152':9988
- '63.#3.89.43':9988
- '63.##.225.123':9988
- '63.##.97.184':9988
- '63.##.45.173':9988
- '63.#3.2.223':9988
- '63.##.222.148':9988
- '63.#3.51.23':9988
- '63.##.230.99':9988
- '63.#3.218.8':9988
- '63.##.143.233':9988
- '63.#3.98.28':9988
- '63.##.52.118':9988
- '63.##.33.119':9988
- '63.#3.9.39':9988
- '63.##.160.84':9988
- '63.#3.2.189':9988
- '63.#3.50.77':9988
- '63.##.218.71':9988
- '63.##.214.203':9988
- '63.##.82.115':9988
- '63.##.132.62':9988
- '63.##.28.253':9988
- '63.##.126.239':9988
- '63.##.106.11':9988
- '63.#3.58.13':9988
- '63.##.214.203':139
- '63.#3.50.77':139
- '63.##.120.21':139
- '63.##.82.115':139
- '63.##.132.62':139
- '63.#3.25.53':139
- '63.##.28.253':139
- '63.#3.62.15':139
- '63.#3.58.13':139
- '63.##.146.18':139
- '63.##.218.216':139
- '63.##.96.107':139
- '63.##.222.145':139
- '63.##.155.160':139
- '63.##.55.243':139
- '63.##.79.197':139
- '63.##.104.11':139
- '63.#3.18.23':139
- '63.#3.218.8':139
- '63.#3.92.55':139
- '63.##.143.233':139
- '63.##.162.163':139
- '63.##.77.203':139
- '63.##.59.152':139
- '63.##.106.11':139
- '63.##.230.99':139
- '63.##.100.33':139
- '63.#3.28.52':139
- '63.##.52.118':139
- '63.##.126.239':139
- '63.#3.98.28':139
- '63.##.218.71':139
- '63.##.160.84':139
- '63.#3.9.39':139
- '63.#3.2.189':139
- '63.##.33.119':139
- '63.##.129.29':139
- '63.##.33.119':445
- '63.##.160.84':445
- '63.#3.2.189':445
- '63.#3.9.39':445
- '63.##.143.233':445
- '63.##.100.33':445
- '63.##.106.11':445
- '63.##.230.99':445
- '63.##.162.163':445
- '63.#3.25.53':445
- '63.##.28.253':445
- '63.##.132.62':445
- '63.#3.58.13':445
- '63.##.126.239':445
- '63.##.52.118':445
- '63.##.218.71':445
- '63.#3.98.28':445
- '63.#3.28.52':445
- '63.##.105.187':139
- '63.##.222.148':139
- '63.##.118.69':139
- '63.##.47.152':139
- '63.##.97.184':139
- '63.#3.2.223':139
- '63.##.179.220':139
- '63.##.45.173':139
- '63.#3.51.23':139
- '63.##.77.203':445
- '63.##.59.152':445
- '63.#3.218.8':445
- '63.#3.92.55':445
- '63.##.200.237':139
- '63.##.225.123':139
- '63.##.228.80':139
- '63.#3.89.43':139
- '63.##.36.249':139
