Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER7ef8.dir00\svchost.exe.mdmp 16325836412029216
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\WER7ef8.dir00\svchost.exe.mdmp
Сетевая активность:
Подключается к:
- '21#.#.109.65':445
- '21#.7.1.56':445
- '21#.7.91.19':445
- '21#.#.55.122':445
- '21#.#.11.161':445
- '21#.#.23.221':445
- '21#.#.18.162':445
- '21#.#.29.253':445
- '21#.#.168.91':445
- '21#.#.83.113':445
- '21#.#.131.253':445
- '21#.#.245.63':445
- '21#.#.219.247':445
- '21#.#.89.143':445
- '21#.7.7.1':445
- '21#.#.42.104':445
- '21#.#.122.132':445
- '21#.#.24.190':445
- '21#.7.59.24':445
- '21#.#.65.170':445
- '21#.7.8.78':445
- '21#.#.254.115':445
- '21#.#.81.234':445
- '21#.7.56.44':445
- '21#.7.86.7':445
- '21#.7.77.32':445
- '21#.#.253.253':445
- '21#.7.38.51':445
- '21#.#.13.183':445
- '21#.#.178.94':445
- '21#.#.119.45':445
- '21#.7.46.77':445
- '21#.#.77.173':445
- '21#.7.1.123':445
- '21#.#.13.217':445
- '21#.#.62.140':445
- '21#.7.77.32':9988
- '21#.#.57.142':9988
- '21#.#.253.253':9988
- '21#.7.51.20':9988
- '21#.#.140.31':445
- '21#.#.170.135':445
- '21#.#.150.105':445
- '21#.#.191.112':445
- '21#.7.17.89':445
- '21#.#.171.234':445
- '21#.7.96.93':445
- '21#.#.217.228':445
- '21#.#.229.79':445
- '21#.#.57.142':445
- '21#.7.25.51':445
- '21#.7.49.76':445
- '21#.#.173.62':445
- '21#.7.65.98':445
- '21#.#.234.93':445
- '21#.7.51.83':445
- '21#.7.42.59':445
- '21#.7.7.1':139
- '21#.#.245.63':139
- '21#.#.65.170':139
- '21#.7.8.78':139
- '21#.7.51.20':139
- '21#.7.1.56':139
- '21#.#.131.253':139
- '21#.#.81.234':139
- '21#.#.219.247':139
- '21#.#.29.253':139
- '21#.#.109.65':139
- '21#.#.24.190':139
- '21#.7.77.32':139
- '21#.#.11.161':139
- '21#.#.89.143':139
- '21#.#.42.104':139
- '21#.#.122.132':139
- '21#.7.59.24':139
- '21#.#.18.162':139
- '21#.7.56.44':139
- '21#.7.91.19':139
- '21#.7.33.19':139
- '21#.7.38.51':139
- '21#.7.86.7':139
- '21#.#.254.115':139
- '21#.#.23.221':139
- '21#.#.55.122':139
- '21#.#.253.253':139
- '21#.7.65.98':139
- '21#.7.1.123':139
- '21#.7.49.76':139
- '21#.#.62.140':139
- '21#.#.13.217':139
- '21#.#.150.105':139
- '21#.#.170.135':139
- '21#.#.140.31':139
- '21#.7.46.77':139
- '21#.7.33.19':445
- '21#.7.51.20':445
- '21#.#.77.173':139
- '21#.#.173.62':139
- '21#.#.119.45':139
- '21#.#.178.94':139
- '21#.7.51.83':139
- '21#.7.25.51':139
- '21#.7.42.59':139
- '21#.#.83.113':139
- '21#.#.234.93':139
- '21#.#.171.234':139
- '21#.#.168.91':139
- '21#.7.17.89':139
- '21#.7.96.93':139
- '21#.#.57.142':139
- '21#.#.13.183':139
- '21#.#.229.79':139
- '21#.#.191.112':139
- '21#.#.217.228':139
