Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER53ba.dir00\svchost.exe.mdmp 16325836412032480
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %TEMP%\WER53ba.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
Сетевая активность:
Подключается к:
- '20#.#92.49.44':139
- '20#.#92.27.80':139
- '20#.#92.142.125':139
- '20#.#92.210.252':139
- '20#.#92.52.231':139
- '20#.#92.231.49':139
- '20#.#92.125.217':139
- '20#.#92.95.174':139
- '20#.#92.174.187':139
- '20#.#92.187.201':139
- '20#.#92.217.221':139
- '20#.#92.222.69':139
- '20#.#92.70.96':139
- '20#.#92.245.197':139
- '20#.#92.198.134':139
- '20#.#92.27.11':139
- '20#.#92.1.27':139
- '20#.#92.249.20':139
- '20#.#92.64.20':139
- '20#.#92.246.209':139
- '20#.#92.96.13':139
- '20#.#92.13.73':139
- '20#.#92.34.9':139
- '20#.#92.123.63':139
- '20#.#92.255.126':139
- '20#.#92.149.96':139
- '20#.#92.88.37':139
- '20#.#92.144.172':139
- '20#.#92.209.225':139
- '20#.#92.146.46':139
- '20#.#92.46.49':139
- '20#.#92.174.51':139
- '20#.#92.189.82':139
- '20#.#92.20.168':9988
- '20#.#92.110.243':9988
- '20#.#92.93.208':9988
- '20#.#92.49.121':139
- '20#.#92.72.147':139
- '20#.#92.2.180':139
- '20#.#92.253.96':139
- '20#.#92.44.193':139
- '20#.#92.102.97':139
- '20#.#92.167.178':139
- '20#.#92.141.96':139
- '20#.#92.188.253':139
- '20#.#92.25.184':139
- '20#.#92.103.188':139
- '20#.#92.7.142':139
- '20#.#92.222.94':139
- '20#.#92.217.110':139
- '20#.#92.110.189':139
- '20#.#92.141.86':139
- '20#.#92.210.69':139
- '20#.#92.52.231':445
- '20#.#92.231.49':445
- '20#.#92.49.44':445
- '20#.#92.13.73':445
- '20#.#92.34.9':445
- '20#.#92.210.252':445
- '20#.#92.27.80':445
- '20#.#92.222.69':445
- '20#.#92.70.96':445
- '20#.#92.95.174':445
- '20#.#92.142.125':445
- '20#.#92.125.217':445
- '20#.#92.217.221':445
- '20#.#92.249.20':445
- '20#.#92.64.20':445
- '20#.#92.245.197':445
- '20#.#92.235.188':445
- '20#.#92.210.69':445
- '20#.#92.1.27':445
- '20#.#92.198.134':445
- '20#.#92.255.126':445
- '20#.#92.149.96':445
- '20#.#92.96.13':445
- '20#.#92.27.11':445
- '20#.#92.246.209':445
- '20#.#92.123.63':445
- '20#.#92.46.49':445
- '20#.#92.174.51':445
- '20#.#92.88.37':445
- '20#.#92.7.142':445
- '20#.#92.222.94':445
- '20#.#92.146.46':445
- '20#.#92.144.172':445
- '20#.#92.72.147':445
- '20#.#92.2.180':445
- '20#.#92.235.188':139
- '20#.#92.209.225':445
- '20#.#92.189.82':445
- '20#.#92.49.121':445
- '20#.#92.141.96':445
- '20#.#92.188.253':445
- '20#.#92.253.96':445
- '20#.#92.174.187':445
- '20#.#92.187.201':445
- '20#.#92.167.178':445
- '20#.#92.44.193':445
- '20#.#92.110.189':445
- '20#.#92.141.86':445
- '20#.#92.103.188':445
- '20#.#92.102.97':445
- '20#.#92.25.184':445
- '20#.#92.217.110':445
- '20#.#92.123.110':139
- '20#.#92.246.227':139
- '20#.#92.60.38':139
- '20#.#92.15.158':139
- '20#.#92.45.158':139
- '20#.#92.157.244':139
- '20#.#92.191.250':139
- '20#.#92.214.181':139
- '20#.#92.87.204':139
- '20#.#92.93.208':139
- '20#.#92.1.207':139
- '20#.#92.36.252':139
- '20#.#92.126.214':139
- '20#.#92.162.94':139
- '20#.#92.233.51':139
- '20#.#92.52.24':139
- '20#.#92.229.234':445
- '20#.#92.41.152':139
- '20#.#92.47.57':139
- '20#.#92.47.172':139
- '20#.#92.156.26':139
- '20#.#92.119.15':139
- '20#.#92.7.74':139
- '20#.#92.20.168':139
- '20#.#92.12.159':139
- '20#.#92.77.100':139
- '20#.#92.218.179':139
- '20#.#92.180.127':139
- '20#.#92.127.111':139
- '20#.#92.115.95':139
- '20#.#92.101.89':139
- '20#.#92.114.139':139
- '20#.#92.110.243':139
- '20#.#92.196.224':139
- '20#.#92.205.173':139
- '20#.#92.200.196':139
- '20#.#92.243.101':139
- '20#.#92.229.234':139
- '20#.#92.40.156':139
- '20#.#92.35.39':139
- '20#.#92.143.241':139
- '20#.#92.2.87':139
- '20#.#92.91.178':139
- '20#.#92.255.151':139
- '20#.#92.176.105':139
- '20#.#92.250.224':139
- '20#.#92.144.19':139
- '20#.#92.169.69':139
- '20#.#92.3.227':139
- '20#.#92.65.112':139
- '20#.#92.108.198':139
- '20#.#92.84.183':139
- '20#.#92.243.101':445
- '20#.#92.45.158':445
- '20#.#92.157.244':445
- '20#.#92.123.110':445
- '20#.#92.156.26':445
- '20#.#92.7.74':445
- '20#.#92.15.158':445
- '20#.#92.246.227':445
- '20#.#92.36.252':445
- '20#.#92.126.214':445
- '20#.#92.214.181':445
- '20#.#92.60.38':445
- '20#.#92.191.250':445
- '20#.#92.1.207':445
- '20#.#92.41.152':445
- '20#.#92.47.57':445
- '20#.#92.162.94':445
- '20#.#92.35.39':9988
- '20#.#92.108.198':9988
- '20#.#92.127.111':9988
- '20#.#92.233.51':445
- '20#.#92.77.100':445
- '20#.#92.12.159':445
- '20#.#92.119.15':445
- '20#.#92.52.24':445
- '20#.#92.47.172':445
- '20#.#92.20.168':445
- '20#.#92.101.89':445
- '20#.#92.114.139':445
- '20#.#92.218.179':445
- '20#.#92.3.227':445
- '20#.#92.169.69':445
- '20#.#92.115.95':445
- '20#.#92.196.224':445
- '20#.#92.200.196':445
- '20#.#92.205.173':445
- '20#.#92.40.156':445
- '20#.#92.180.127':445
- '20#.#92.127.111':445
- '20#.#92.110.243':445
- '20#.#92.255.151':445
- '20#.#92.176.105':445
- '20#.#92.35.39':445
- '20#.#92.87.204':445
- '20#.#92.93.208':445
- '20#.#92.91.178':445
- '20#.#92.143.241':445
- '20#.#92.108.198':445
- '20#.#92.84.183':445
- '20#.#92.144.19':445
- '20#.#92.2.87':445
- '20#.#92.250.224':445
- '20#.#92.65.112':445
