Trojan.DownLoader9.40710

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3aa7.dir00\svchost.exe.mdmp 16325836412032520

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER3aa7.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.6.12.24':445
'21#.#.61.210':445
'21#.#.93.238':445
'21#.6.75.12':445
'21#.#.131.182':445
'21#.#.215.191':445
'21#.6.84.37':445
'21#.#.162.45':445
'21#.6.23.96':445
'21#.#.136.230':445
'21#.6.192.2':445
'21#.#.152.40':445
'21#.6.87.89':445
'21#.#.254.40':445
'21#.#.102.20':445
'21#.#.251.225':445
'21#.#.75.124':445
'21#.#.255.198':445
'21#.#.124.87':445
'21#.#.120.126':445
'21#.#.37.249':445
'21#.#.236.122':445
'21#.#.181.235':445
'21#.#.219.41':445
'21#.#.16.110':445
'21#.#.63.122':445
'21#.#.202.204':445
'21#.#.22.221':445
'21#.#.173.64':445
'21#.#.16.124':445
'21#.#.111.17':445
'21#.6.136.9':445
'21#.6.1.57':445
'21#.#.155.22':445
'21#.#.202.204':139
'21#.#.22.221':139
'21#.#.173.64':139
'21#.#.16.124':139
'21#.6.1.57':139
'21#.6.136.9':139
'21#.#.155.22':139
'21#.#.111.17':139
'21#.#.131.182':139
'21#.6.12.24':139
'21#.6.75.12':139
'21#.6.23.96':139
'21#.#.93.238':139
'21#.#.162.45':139
'21#.#.215.191':139
'21#.6.84.37':139
'21#.#.61.210':139
'21#.#.130.199':139
'21#.6.34.18':139
'21#.#.155.181':139
'21#.#.249.68':139
'21#.6.53.59':139
'21#.#.169.241':139
'21#.#.106.33':139
'21#.#.136.30':139
'21#.#.181.235':139
'21#.#.37.249':139
'21#.#.255.198':139
'21#.#.63.122':139
'21#.#.120.126':139
'21#.#.16.110':139
'21#.#.236.122':139
'21#.#.124.87':139
'21#.#.219.41':139
'21#.#.193.141':139
'21#.6.85.23':139
'21#.#.172.230':139
'21#.#.141.53':139
'21#.6.27.79':139
'21#.6.9.27':139
'21#.#.121.86':139
'21#.#.78.243':139
'21#.#.244.240':139
'21#.#.223.77':139
'21#.6.77.82':139
'21#.#.221.166':139
'21#.6.81.9':139
'21#.#.34.243':139
'21#.6.145.9':139
'21#.#.60.158':139
'21#.#.120.82':139
'21#.#.52.159':139
'21#.#.171.48':139
'21#.#.115.193':139
'21#.#.18.202':139
'21#.#.62.177':139
'21#.6.12.48':139
'21#.#.174.170':139
'21#.#.176.174':139
'21#.6.25.10':139
'21#.#.132.76':139
'21#.6.31.10':139
'21#.6.29.3':139
'21#.6.77.52':139
'21#.#.167.155':139
'21#.#.64.111':139
'21#.6.84.88':139
'21#.6.84.89':139
'21#.#.212.18':139
'21#.#.34.109':139
'21#.#.120.156':139
'21#.#.15.176':139
'21#.#.187.12':139
'21#.#.116.30':139
'21#.#.51.224':139
'21#.#.213.68':139
'21#.6.9.178':139
'21#.#.130.199':445
'21#.6.34.18':445
'21#.#.155.181':445
'21#.#.249.68':445
'21#.6.53.59':445
'21#.#.169.241':445
'21#.#.106.33':445
'21#.#.136.30':445
'21#.#.41.166':139
'21#.6.32.41':139
'21#.#.67.183':139
'21#.6.40.26':139
'21#.#.246.90':139
'21#.6.71.9':139
'21#.#.40.244':139
'21#.#.110.218':139
'21#.#.213.68':445
'21#.#.15.176':445
'21#.#.212.18':445
'21#.6.9.178':445
'21#.#.120.156':445
'21#.#.187.12':445
'21#.#.116.30':445
'21#.#.34.109':445
'21#.#.51.224':445
'21#.#.19.105':139
'21#.#.127.230':139
'21#.#.170.162':139
'21#.#.204.190':139
'21#.#.30.253':139
'21#.#.234.101':139
'21#.#.210.127':139
'21#.#.86.133':139
'21#.#.69.136':139
'21#.#.141.120':139
'21#.#.78.208':139
'21#.#.57.204':139
'21#.#.143.247':139
'21#.#.126.164':139
'21#.#.211.147':139
'21#.#.210.19':139
'21#.#.164.213':139
'21#.#.206.195':445
'21#.6.62.33':445
'21#.#.108.143':445
'21#.#.37.132':445
'21#.#.67.212':445
'21#.#.104.188':445
'21#.#.76.231':445
'21#.#.109.158':445
'21#.#.221.65':445
'21#.#.182.208':445
'21#.6.20.79':445
'21#.#.166.175':445
'21#.#.175.132':445
'21#.#.63.181':445
'21#.#.118.133':445
'21#.#.56.187':445
'21#.#.58.133':445
'21#.#.206.195':139
'21#.6.62.33':139
'21#.#.37.132':139
'21#.#.108.143':139
'21#.#.67.212':139
'21#.#.104.188':139
'21#.#.76.231':139
'21#.#.109.158':139
'21#.#.63.181':139
'21#.#.118.133':139
'21#.6.20.79':139
'21#.#.182.208':139
'21#.#.221.65':139
'21#.#.56.187':139
'21#.#.166.175':139
'21#.#.58.133':139
'21#.#.175.132':139
'21#.#.136.212':139
'21#.#.33.200':139
'21#.#.121.59':139
'21#.#.27.246':139
'21#.#.36.186':139
'21#.#.88.168':139
'21#.6.82.90':139
'21#.#.22.182':139
'21#.#.172.25':139
'21#.#.18.218':139
'21#.6.251.9':139
'21#.6.52.74':139
'21#.#.171.49':139
'21#.#.56.249':139
'21#.6.1.111':139
'21#.6.43.36':139
'21#.#.111.148':139
'21#.#.147.143':139
'21#.#.80.147':139
'21#.6.116.2':139
'21#.#.133.60':139
'21#.#.215.187':139
'21#.#.232.212':139
'21#.6.53.81':139
'21#.#.158.52':139
'21#.#.194.102':139
'21#.6.62.33':9988
'21#.6.82.90':9988
'21#.#.171.49':9988
'21#.#.166.175':9988
'21#.#.36.186':9988
'21#.#.88.168':9988
'21#.#.33.200':9988
'21#.#.22.182':9988
'21#.#.136.230':139
'21#.6.192.2':139
'21#.6.87.89':139
'21#.#.152.40':139
'21#.#.254.40':139
'21#.#.102.20':139
'21#.#.251.225':139
'21#.#.75.124':139
'21#.#.232.212':445
'21#.#.133.60':445
'21#.#.147.143':445
'21#.#.194.102':445
'21#.6.116.2':445
'21#.#.215.187':445
'21#.#.158.52':445
'21#.#.80.147':445
'21#.6.53.81':445
'21#.#.136.212':445
'21#.#.33.200':445
'21#.#.121.59':445
'21#.#.27.246':445
'21#.#.36.186':445
'21#.#.88.168':445
'21#.6.82.90':445
'21#.#.22.182':445
'21#.#.172.25':445
'21#.#.18.218':445
'21#.6.251.9':445
'21#.6.52.74':445
'21#.#.171.49':445
'21#.#.56.249':445
'21#.6.1.111':445
'21#.#.111.148':445
'21#.6.43.36':445
'21#.#.19.105':445
'21#.#.127.230':445
'21#.#.170.162':445
'21#.#.204.190':445
'21#.#.30.253':445
'21#.#.234.101':445
'21#.#.210.127':445
'21#.#.86.133':445
'21#.#.69.136':445
'21#.#.141.120':445
'21#.#.78.208':445
'21#.#.57.204':445
'21#.#.143.247':445
'21#.#.126.164':445
'21#.#.211.147':445
'21#.#.210.19':445
'21#.#.164.213':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней