Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\SA.DAT
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERb751.dir00\svchost.exe.mdmp 16325836412032036
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WERb751.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
Network activity:
Connects to:
- '81.##0.10.233':445
- '81.##0.205.135':445
- '81.##0.77.105':445
- '81.##0.29.93':445
- '81.##0.151.154':445
- '81.##0.51.120':445
- '81.##0.152.162':445
- '81.##0.20.215':445
- '81.#20.27.2':445
- '81.##0.76.150':9988
- '81.##0.125.83':9988
- '81.##0.171.62':9988
- '81.##0.26.106':9988
- '81.##0.19.183':9988
- '81.##0.145.33':445
- '81.##0.191.130':445
- '81.#20.10.3':9988
- '81.##0.11.204':9988
- '81.##0.153.12':445
- '81.##0.241.77':445
- '81.##0.107.48':445
- '81.##0.59.140':445
- '81.##0.114.176':445
- '81.##0.247.93':445
- '81.##0.204.76':445
- '81.##0.155.11':445
- '81.##0.220.173':445
- '81.##0.249.176':445
- '81.##0.119.215':445
- '81.#20.10.3':445
- '81.##0.173.107':445
- '81.##0.51.209':445
- '81.##0.40.104':445
- '81.##0.103.106':445
- '81.##0.28.93':445
- '81.##0.40.40':445
- '81.##0.220.173':9988
- '81.##0.29.93':9988
- '81.##0.151.154':9988
- '81.##0.153.12':9988
- '81.##0.40.104':9988
- '81.##0.174.0':9988
- '81.##0.204.76':9988
- '81.##0.59.140':9988
- '81.##0.103.106':9988
- '81.##0.28.93':9988
- '81.##0.152.162':9988
- '81.#20.27.2':9988
- '81.##0.173.107':9988
- '81.##0.145.33':9988
- '81.##0.73.133':9988
- '81.##0.77.105':9988
- '81.##0.10.233':9988
- '81.##0.191.130':9988
- '81.##0.205.135':9988
- '81.##0.85.140':9988
- '81.##0.125.92':9988
- '81.##0.246.80':9988
- '81.##0.247.93':9988
- '81.##0.80.232':9988
- '81.##0.155.11':9988
- '81.##0.94.11':9988
- '81.##0.114.176':9988
- '81.##0.170.45':9988
- '81.##0.133.152':9988
- '81.##0.85.226':9988
- '81.##0.132.225':9988
- '81.##0.51.209':9988
- '81.##0.107.48':9988
- '81.##0.236.245':9988
- '81.##0.150.25':9988
- '81.##0.173.168':9988
- '81.##0.241.77':9988
- '81.##0.220.173':139
- '81.##0.173.168':139
- '81.##0.114.176':139
- '81.##0.155.11':139
- '81.##0.125.83':139
- '81.##0.11.204':139
- '81.##0.214.76':139
- '81.##0.170.45':139
- '81.#20.94.5':139
- '81.##0.40.40':139
- '81.##0.40.104':139
- '81.##0.51.209':139
- '81.##0.28.93':139
- '81.##0.103.106':139
- '81.##0.153.12':139
- '81.##0.241.77':139
- '81.##0.107.48':139
- '81.##0.59.140':139
- '81.##0.73.133':139
- '81.##0.133.152':139
- '81.##0.26.106':139
- '81.##0.204.76':139
- '81.##0.247.93':139
- '81.##0.246.80':139
- '81.##0.85.140':139
- '81.##0.76.150':139
- '81.##0.171.62':139
- '81.##0.94.11':139
- '81.##0.80.232':139
- '81.##0.174.0':139
- '81.##0.150.25':139
- '81.##0.132.225':139
- '81.##0.236.245':139
- '81.##0.19.183':139
- '81.##0.85.226':139
- '81.##0.125.92':139
- '81.##0.119.215':139
- '81.##0.85.226':445
- '81.##0.133.152':445
- '81.##0.76.150':445
- '81.##0.80.232':445
- '81.##0.132.225':445
- '81.##0.11.204':445
- '81.##0.150.25':445
- '81.#20.94.5':445
- '81.##0.94.11':445
- '81.##0.125.83':445
- '81.##0.236.245':445
- '81.##0.171.62':445
- '81.##0.173.168':445
- '81.##0.73.133':445
- '81.##0.125.92':445
- '81.##0.26.106':445
- '81.##0.19.183':445
- '81.##0.170.45':445
- '81.##0.20.215':139
- '81.#20.27.2':139
- '81.##0.205.135':139
- '81.##0.151.154':139
- '81.##0.51.120':139
- '81.##0.173.107':139
- '81.##0.249.176':139
- '81.##0.152.162':139
- '81.#20.10.3':139
- '81.##0.246.80':445
- '81.##0.85.140':445
- '81.##0.214.76':445
- '81.##0.174.0':445
- '81.##0.145.33':139
- '81.##0.29.93':139
- '81.##0.10.233':139
- '81.##0.191.130':139
- '81.##0.77.105':139
