Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WERe71b.dir00\svchost.exe.mdmp 16325836412032580
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERe71b.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Сетевая активность:
Подключается к:
- '63.##3.251.175':9988
- '63.##3.119.243':9988
- '63.##3.53.10':9988
- '63.##3.43.17':9988
- '63.##3.201.85':9988
- '63.##3.66.113':9988
- '63.##3.220.121':9988
- '63.#03.98.6':9988
- '63.##3.1.253':9988
- '63.##3.231.8':9988
- '63.##3.29.251':9988
- '63.##3.212.189':9988
- '63.##3.255.249':9988
- '63.##3.41.202':9988
- '63.##3.231.214':9988
- '63.##3.64.29':9988
- '63.##3.243.44':9988
- '63.##3.87.154':9988
- '63.##3.134.209':9988
- '63.##3.203.194':9988
- '63.##3.201.2':9988
- '63.##3.168.112':9988
- '63.##3.234.227':9988
- '63.##3.231.214':445
- '63.##3.1.253':445
- '63.#03.98.6':445
- '63.##3.112.212':9988
- '63.##3.48.15':9988
- '63.##3.64.29':445
- '63.##3.220.121':445
- '63.##3.201.85':445
- '63.##3.56.177':445
- '63.##3.203.194':445
- '63.##3.111.225':445
- '63.##3.15.143':9988
- '63.#03.8.46':9988
- '63.##3.61.250':9988
- '63.##3.13.60':9988
- '63.##3.56.177':9988
- '63.##3.63.12':9988
- '63.##3.224.82':9988
- '63.##3.205.15':9988
- '63.##3.26.44':9988
- '63.##3.79.138':9988
- '63.##3.107.39':9988
- '63.##3.86.115':9988
- '63.##3.115.17':9988
- '63.##3.129.10':139
- '63.##3.147.215':139
- '63.#03.97.1':139
- '63.##3.122.47':139
- '63.##3.47.97':139
- '63.##3.23.95':139
- '63.##3.11.203':139
- '63.##3.110.216':139
- '63.##3.33.29':139
- '63.##3.85.214':139
- '63.##3.37.33':139
- '63.##3.159.122':139
- '63.##3.175.18':139
- '63.##3.106.151':139
- '63.##3.206.164':139
- '63.#03.24.9':139
- '63.##3.125.240':139
- '63.##3.107.179':139
- '63.##3.226.195':139
- '63.##3.91.116':139
- '63.##3.55.148':139
- '63.##3.199.164':139
- '63.##3.164.118':139
- '63.##3.54.67':9988
- '63.##3.179.121':9988
- '63.##3.99.164':9988
- '63.##3.182.248':9988
- '63.##3.111.225':9988
- '63.##3.19.53':9988
- '63.#03.49.4':9988
- '63.##3.246.95':9988
- '63.##3.123.137':9988
- '63.##3.162.222':9988
- '63.##3.92.96':9988
- '63.#03.2.38':9988
- '63.##3.19.213':139
- '63.##3.141.108':139
- '63.##3.170.221':139
- '63.##3.150.35':139
- '63.##3.181.59':139
- '63.##3.20.20':139
- '63.##3.143.5':139
- '63.##3.115.44':9988
- '63.##3.68.34':139
- '63.##3.143.5':445
- '63.##3.68.34':445
- '63.##3.246.95':139
- '63.#03.8.46':139
- '63.##3.13.60':139
- '63.##3.251.175':139
- '63.##3.201.2':139
- '63.##3.61.250':139
- '63.##3.26.44':139
- '63.##3.162.222':139
- '63.##3.19.53':139
- '63.##3.86.115':139
- '63.##3.115.17':139
- '63.##3.53.10':139
- '63.##3.111.225':139
- '63.##3.56.177':139
- '63.##3.168.112':139
- '63.##3.64.29':139
- '63.##3.1.253':139
- '63.##3.115.44':139
- '63.##3.87.154':139
- '63.##3.243.44':139
- '63.##3.54.67':139
- '63.##3.63.12':139
- '63.#03.2.38':139
- '63.##3.107.39':139
- '63.##3.179.121':139
- '63.##3.48.15':139
- '63.##3.231.8':139
- '63.##3.29.251':139
- '63.##3.123.137':139
- '63.##3.224.82':139
- '63.##3.92.96':139
- '63.##3.79.138':139
- '63.##3.205.15':139
- '63.##3.134.209':139
- '63.##3.15.143':139
- '63.##3.99.164':139
- '63.#03.49.4':139
- '63.##3.255.249':139
- '63.##3.234.227':139
- '63.##3.182.248':139
- '63.##3.119.243':139
- '63.##3.212.189':139
- '63.##3.41.202':139
- '63.##3.112.212':139
- '63.##3.43.17':139
- '63.##3.66.113':139
- '63.##3.220.121':139
- '63.##3.115.17':445
- '63.##3.19.53':445
- '63.##3.86.115':445
- '63.#03.8.46':445
- '63.##3.61.250':445
- '63.##3.26.44':445
- '63.##3.182.248':445
- '63.##3.99.164':445
- '63.##3.255.249':445
- '63.##3.162.222':445
- '63.##3.234.227':445
- '63.##3.246.95':445
- '63.#03.2.38':445
- '63.##3.54.67':445
- '63.##3.63.12':445
- '63.##3.168.112':445
- '63.##3.115.44':445
- '63.##3.87.154':445
- '63.##3.201.2':445
- '63.##3.13.60':445
- '63.##3.251.175':445
- '63.##3.243.44':445
- '63.##3.53.10':445
- '63.##3.134.209':445
- '63.##3.92.96':445
- '63.##3.205.15':445
- '63.##3.179.121':445
- '63.##3.123.137':445
- '63.##3.79.138':445
- '63.#03.98.6':139
- '63.##3.203.194':139
- '63.##3.231.214':139
- '63.##3.224.82':445
- '63.##3.201.85':139
- '63.##3.107.39':445
- '63.##3.66.113':445
- '63.##3.112.212':445
- '63.##3.43.17':445
- '63.#03.49.4':445
- '63.##3.119.243':445
- '63.##3.41.202':445
- '63.##3.48.15':445
- '63.##3.29.251':445
- '63.##3.231.8':445
- '63.##3.212.189':445
- '63.##3.15.143':445
