Trojan.DownLoader10.3561

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER0daa.dir00\svchost.exe.mdmp 16325836412032840

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER0daa.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'61.##2.120.232':139
'61.##2.74.121':139
'61.##2.233.27':139
'61.##2.81.42':139
'61.##2.13.66':139
'61.##2.123.34':139
'61.##2.239.39':139
'61.##2.2.235':139
'61.##2.238.3':139
'61.##2.138.143':139
'61.##2.251.250':139
'61.##2.157.154':139
'61.##2.13.242':139
'61.##2.163.102':139
'61.##2.54.138':139
'61.#92.1.13':139
'61.##2.149.28':139
'61.##2.25.102':139
'61.##2.167.215':139
'61.##2.87.139':139
'61.##2.25.55':139
'61.#92.72.6':139
'61.##2.70.136':139
'61.##2.34.140':445
'61.##2.47.250':445
'61.##2.100.206':445
'61.##2.157.73':139
'61.##2.176.42':139
'61.##2.178.39':445
'61.##2.129.156':445
'61.##2.192.129':445
'61.##2.156.45':445
'61.##2.222.218':445
'61.##2.28.90':445
'61.##2.132.139':139
'61.##2.166.112':139
'61.##2.206.165':139
'61.##2.112.222':139
'61.##2.241.32':139
'61.##2.166.6':139
'61.##2.60.155':139
'61.##2.42.30':139
'61.##2.88.152':139
'61.##2.91.211':139
'61.##2.158.37':139
'61.##2.228.190':139
'61.##2.48.13':445
'61.##2.50.134':445
'61.##2.249.114':445
'61.##2.187.32':445
'61.##2.41.238':445
'61.##2.82.55':445
'61.##2.119.56':445
'61.##2.166.62':445
'61.##2.10.147':445
'61.##2.191.104':445
'61.##2.21.42':445
'61.##2.97.154':445
'61.##2.196.145':445
'61.##2.202.158':445
'61.##2.5.145':445
'61.##2.32.30':445
'61.##2.228.248':445
'61.##2.235.17':445
'61.##2.157.77':445
'61.##2.103.222':445
'61.##2.167.244':445
'61.##2.136.234':445
'61.##2.29.137':445
'61.##2.156.45':139
'61.##2.129.156':139
'61.##2.28.90':139
'61.##2.178.39':139
'61.##2.222.218':139
'61.##2.192.129':139
'61.##2.234.41':139
'61.##2.70.53':139
'61.##2.41.232':139
'61.#92.8.69':139
'61.##2.232.50':139
'61.##2.47.250':139
'61.##2.131.158':445
'61.##2.40.67':445
'61.##2.135.224':445
'61.##2.220.66':445
'61.##2.151.167':445
'61.##2.107.8':445
'61.##2.100.206':139
'61.##2.34.140':139
'61.##2.10.146':445
'61.##2.189.84':445
'61.##2.180.228':445
'61.#92.8.69':445
'61.##2.215.156':139
'61.##2.70.83':139
'61.##2.61.171':139
'61.##2.202.89':139
'61.##2.245.248':139
'61.##2.61.70':139
'61.##2.67.10':139
'61.##2.253.66':139
'61.#92.3.64':139
'61.##2.51.50':139
'61.#92.2.2':139
'61.##2.133.135':139
'61.##2.139.114':139
'61.##2.251.221':139
'61.##2.152.26':139
'61.##2.11.171':139
'61.##2.100.45':139
'61.##2.99.251':139
'61.##2.135.202':139
'61.##2.146.163':139
'61.##2.89.103':139
'61.##2.84.100':139
'61.##2.149.237':139
'61.##2.74.139':139
'61.##2.78.150':139
'61.##2.209.58':139
'61.##2.104.174':139
'61.##2.58.227':139
'61.##2.42.77':139
'61.##2.131.187':139
'61.##2.76.22':139
'61.##2.129.197':139
'61.##2.125.98':139
'61.##2.70.167':139
'61.##2.3.159':139
'61.##2.215.244':139
'61.##2.215.119':139
'61.##2.97.117':139
'61.##2.223.252':139
'61.##2.24.254':139
'61.##2.9.200':139
'61.##2.243.228':139
'61.##2.167.246':139
'61.##2.185.143':139
'61.##2.129.249':139
'61.##2.0.208':139
'61.##2.157.154':445
'61.##2.81.42':445
'61.##2.87.139':445
'61.##2.25.55':445
'61.##2.167.215':445
'61.##2.13.66':445
'61.##2.123.34':445
'61.##2.138.143':445
'61.##2.74.121':445
'61.##2.233.27':445
'61.##2.120.232':445
'61.##2.70.136':445
'61.##2.70.53':445
'61.#92.1.13':445
'61.##2.234.41':445
'61.##2.232.50':445
'61.##2.41.232':445
'61.##2.149.28':445
'61.##2.25.102':445
'61.#92.72.6':445
'61.##2.163.102':445
'61.##2.54.138':445
'61.##2.13.242':445
'61.##2.132.139':445
'61.##2.157.73':445
'61.##2.88.152':445
'61.##2.91.211':445
'61.##2.42.30':445
'61.##2.176.42':445
'61.##2.199.112':139
'61.##2.191.81':139
'61.##2.122.116':139
'61.##2.241.175':139
'61.##2.221.241':139
'61.##2.228.190':445
'61.##2.2.235':445
'61.##2.241.32':445
'61.##2.239.39':445
'61.##2.251.250':445
'61.##2.238.3':445
'61.##2.166.6':445
'61.##2.60.155':445
'61.##2.158.37':445
'61.##2.206.165':445
'61.##2.112.222':445
'61.##2.166.112':445
'61.##2.146.71':445
'61.##2.71.215':445
'61.##2.215.74':445
'61.##2.171.202':445
'61.##2.107.234':445
'61.##2.223.107':445
'61.##2.41.115':445
'61.##2.16.62':445
'61.##2.29.101':445
'61.##2.237.65':445
'61.##2.101.17':445
'61.##2.212.49':445
'61.##2.132.223':445
'61.##2.229.123':139
'61.##2.58.247':139
'61.##2.19.239':139
'61.##2.177.42':139
'61.##2.239.177':139
'61.##2.48.169':445
'61.#92.5.80':445
'61.##2.146.120':445
'61.##2.7.184':445
'61.##2.28.227':445
'61.##2.80.152':445
'61.##2.49.161':445
'61.##2.156.183':445
'61.##2.100.48':445
'61.##2.159.106':445
'61.##2.70.100':445
'61.#92.16.0':445
'61.##2.41.118':445
'61.##2.234.42':445
'61.##2.183.79':445
'61.##2.44.233':445
'61.##2.151.142':445
'61.##2.49.77':445
'61.##2.37.89':445
'61.##2.44.48':445
'61.##2.89.28':445
'61.##2.38.23':445
'61.##2.66.230':445
'61.##2.23.46':445
'61.##2.15.58':445
'61.##2.69.112':445
'61.##2.26.161':445
'61.##2.145.105':445
'61.##2.161.191':445
'61.##2.101.17':139
'61.##2.29.101':139
'61.##2.71.215':139
'61.##2.237.65':139
'61.##2.66.230':139
'61.##2.215.74':139
'61.##2.37.89':139
'61.##2.44.48':139
'61.##2.89.28':139
'61.##2.38.23':139
'61.##2.41.115':139
'61.##2.212.49':139
'61.##2.7.184':139
'61.#92.5.80':139
'61.##2.80.152':139
'61.##2.28.227':139
'61.##2.48.169':139
'61.##2.146.120':139
'61.##2.171.202':139
'61.##2.16.62':139
'61.##2.132.223':139
'61.##2.107.234':139
'61.##2.223.107':139
'61.##2.10.156':139
'61.#92.16.0':139
'61.##2.156.183':139
'61.##2.70.100':139
'61.##2.183.79':139
'61.##2.41.118':139
'61.##2.142.1':139
'61.##2.55.163':139
'61.##2.76.170':139
'61.##2.42.133':139
'61.##2.234.42':139
'61.##2.49.161':139
'61.##2.161.191':139
'61.##2.26.161':139
'61.##2.23.46':139
'61.##2.69.112':139
'61.##2.145.105':139
'61.##2.15.58':139
'61.##2.159.106':139
'61.##2.49.77':139
'61.##2.44.233':139
'61.##2.100.48':139
'61.##2.151.142':139
'61.##2.42.133':445
'61.##2.50.134':139
'61.##2.41.238':139
'61.##2.119.56':139
'61.##2.151.167':139
'61.##2.249.114':139
'61.##2.10.147':139
'61.##2.135.224':139
'61.##2.107.8':139
'61.##2.21.42':139
'61.##2.166.62':139
'61.##2.220.66':139
'61.##2.48.13':139
'61.##2.29.137':139
'61.##2.167.244':139
'61.##2.136.234':139
'61.##2.202.158':139
'61.##2.235.17':139
'61.##2.157.77':139
'61.##2.103.222':139
'61.##2.82.55':139
'61.##2.191.104':139
'61.##2.97.154':139
'61.##2.187.32':139
'61.##2.50.124':445
'61.##2.17.215':445
'61.##2.240.163':445
'61.##2.239.147':445
'61.##2.12.199':445
'61.##2.81.181':445
'61.##2.240.107':445
'61.##2.206.214':445
'61.##2.21.116':445
'61.##2.151.237':445
'61.##2.178.214':445
'61.##2.149.15':445
'61.##2.40.67':139
'61.##2.131.158':139
'61.##2.10.146':139
'61.##2.189.84':139
'61.##2.180.228':139
'61.##2.132.17':445
'61.##2.21.198':445
'61.##2.237.174':445
'61.##2.251.15':445
'61.##2.223.53':445
'61.#92.7.47':445
'61.##2.16.62':9988
'61.#92.16.0':9988
'61.##2.49.161':9988
'61.##2.55.163':9988
'61.##2.223.107':9988
'61.##2.26.161':9988
'61.##2.212.49':9988
'61.##2.69.112':9988
'61.##2.23.46':9988
'61.##2.171.202':9988
'61.##2.37.89':9988
'61.##2.80.152':9988
'61.##2.177.42':445
'61.##2.239.177':445
'61.##2.142.1':445
'61.##2.76.170':445
'61.##2.10.156':445
'61.##2.55.163':445
'61.##2.28.227':9988
'61.##2.89.28':9988
'61.##2.58.247':445
'61.##2.19.239':445
'61.##2.229.123':445
'61.##2.21.116':139
'61.##2.240.107':139
'61.##2.178.214':139
'61.##2.81.181':139
'61.##2.151.237':139
'61.##2.206.214':139
'61.##2.5.145':139
'61.##2.196.145':139
'61.##2.228.248':139
'61.##2.146.71':139
'61.##2.32.30':139
'61.##2.50.124':139
'61.##2.21.198':139
'61.##2.237.174':139
'61.#92.7.47':139
'61.##2.132.17':139
'61.##2.223.53':139
'61.##2.251.15':139
'61.##2.240.163':139
'61.##2.17.215':139
'61.##2.12.199':139
'61.##2.149.15':139
'61.##2.239.147':139

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней