Trojan.FakeAV.10890

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'18#.#16.160.2':3128
'41.##6.13.235':3128
'95.##0.130.166':3128
'12#.#2.115.8':3128
'22#.#75.232.10':3128
'18#.#10.236.57':3128
'21#.#6.79.18':3128
'94.##.33.183':3128
'83.##8.28.136':3128
'41.##.104.62':3128
'22#.#75.231.27':3128
'80.##.168.127':3128
'87.##1.19.76':3128
'17#.#22.180.177':3128
'88.##.177.236':3128
'19#.#1.173.15':3128
'19#.#06.81.39':3128
'20#.#74.151.115':3128
'70.##.208.173':3128
'22#.#75.228.61':3128
'19#.#0.77.169':3128
'41.##.161.23':3128
'37.#9.66.96':3128
'89.##5.244.229':3128
'41.##9.234.53':3128
'46.##.236.164':3128
'77.##2.230.85':3128
'2.###.158.126':3128
'22#.#75.231.64':3128
'65.##3.234.70':3128
'12#.#23.49.136':3128
'19#.#5.88.167':3128
'95.##.232.85':3128
'79.##7.47.194':3128
'41.##.155.194':3128
'19#.#2.137.75':3128
'11#.#2.146.212':3128
'46.##9.112.179':3128
'95.##.61.246':3128
'22#.#75.231.110':3128
'18#.#24.199.65':3128
'11#.#06.2.15':3128
'95.#9.2.148':3128
'66.##4.111.198':3128
'18#.#5.26.139':3128
'18#.#7.42.112':3128
'22#.#75.232.53':3128
'95.##.139.10':3128
'17#.#0.155.28':3128
'95.##.231.153':3128
'2.##.135.151':3128
'93.##6.154.250':3128
'18#.#84.125.126':3128
'95.##1.151.172':3128
'36.#.125.120':3128
'18#.#6.230.116':3128
'17#.#2.172.201':3128
'17#.#27.197.94':3128
'70.##.129.218':3128
'17#.#75.221.3':3128
'46.##2.21.157':3128
'85.##.151.80':3128
'41.##0.37.54':3128
'19#.#06.84.130':3128
'17#.#.170.174':3128
'85.##.169.141':3128
'10#.#2.16.218':3128
'95.##2.197.224':3128
'83.##1.188.244':3128
'98.##7.248.135':3128
'31.##.236.120':3128
'18#.#61.199.18':3128
'88.##8.141.91':3128
'17#.#1.42.78':3128
'21#.96.2.58':3128
'61.##.255.149':3128
'12#.#9.243.193':3128
'77.##.45.219':3128
'75.##0.16.211':3128
'41.##.17.192':3128
'95.##.53.180':3128
'85.##0.81.228':3128
'18#.#10.225.167':3128
'20#.#11.67.77':3128
'18#.#13.227.13':3128
'19#.#.218.213':3128
'19#.#00.176.60':3128
'18#.#5.240.32':3128
'64.##0.246.5':3128
'17#.#1.56.122':3128
'61.##4.150.206':3128
'41.##2.230.45':3128
'77.##0.213.211':3128
'60.##4.121.130':3128
'37.#9.67.55':3128
'62.##.36.136':3128
'12#.#01.222.56':3128
'87.##7.61.167':3128
'20#.#14.5.33':3128
'41.##5.21.229':3128
'98.##5.118.194':3128
'80.##.168.140':3128
'19#.#2.210.37':3128
'75.##0.76.228':3128
'18#.#4.49.33':3128
'77.##5.6.231':3128
'58.##3.125.236':3128
'92.##.223.223':3128
'94.##.206.168':3128
'18#.#84.30.78':3128
'41.##3.57.75':3128
'41.##2.11.100':3128
'22#.#75.2.136':3128
'41.##.46.235':3128
'22#.#75.231.195':3128
'17#.#2.172.221':3128
'18#.#4.243.192':3128
'20#.#15.211.108':3128
'84.##.230.244':3128
'18#.#6.210.43':3128
'41.##5.83.146':3128
'11#.#93.128.20':3128
'41.##3.57.74':3128
'41.#6.31.66':3128
'92.##.248.234':3128
'46.##9.114.170':3128
'11#.#41.69.206':3128
'19#.#4.167.87':3128
'95.#5.38.93':3128
'75.##0.238.235':3128
'41.##.76.139':3128
'98.##6.110.103':3128
'20#.#.145.222':3128
'41.##1.102.207':3128
'41.##5.50.77':3128
'18#.#65.149.68':3128
'20#.#79.72.122':3128
'11#.#29.196.36':3128
'18#.#22.151.152':3128
'37.#9.2.236':3128
'18#.#65.140.35':3128
'11#.55.7.17':3128
'22#.#75.231.237':3128
'77.#45.6.90':3128
'19#.#2.3.246':3128
'89.##.222.115':3128
'89.##3.98.138':3128
'31.##.15.251':3128
'18#.#3.203.34':3128
'95.##.172.46':3128
'41.#6.8.141':3128
'95.##5.61.62':3128
'95.##.140.17':3128
'41.##.189.112':3128
'18#.#0.247.49':3128
'19#.#56.30.50':3128
'18#.#22.147.167':3128
'85.##.176.81':3128
'18#.#29.203.130':3128
'98.##3.35.199':3128
'95.#9.41.45':3128
'2.##.7.60':3128
'41.#7.39.2':3128
'93.##3.153.139':3128
'41.##3.57.76':3128
'2.###.193.134':3128
'80.##.15.244':3128
'41.##.172.252':3128
'77.##.142.52':3128
'2.###.19.208':3128
'17#.#47.129.134':3128
'12#.#05.138.25':3128
'92.##.17.173':3128
'21#.#30.101.74':3128
'17#.#9.79.29':3128
'37.#9.73.29':3128
'24.##7.65.81':3128
'96.#.160.28':3128
'22#.#75.231.32':3128
'17#.#22.141.203':3128
'2.##.68.92':3128
'19#.#13.19.241':3128
'97.#6.66.6':3128
'95.##.249.116':3128
'2.##.81.65':3128
'18#.#10.230.239':3128
'20#.#4.237.189':3128
'17#.#0.73.122':3128
'19#.#63.227.205':3128
'18#.0.20.97':3128
'20#.#2.204.4':3128
'24.##7.31.181':3128
'17#.#49.46.218':3128
'18#.#7.204.79':3128
'19#.#86.206.101':3128
'36.#.85.105':3128
'82.##0.174.164':3128
'2.###.195.111':3128
'19#.#7.134.52':3128
'37.##.67.126':3128
'74.#15.3.63':3128
'2.###.105.113':3128
'17#.#2.171.1':3128
'2.##.68.228':3128
'81.##.19.171':3128
'95.##.106.75':3128
'18#.#84.52.174':3128
'19#.#8.247.244':3128
'41.##1.44.108':3128
'98.##8.212.151':3128
'18#.#06.160.177':3128
'22#.#75.231.78':3128
'19#.#03.193.107':3128
'19#.#6.196.3':3128
'95.##0.158.185':3128
'11#.#5.12.55':3128
'17#.#9.61.122':3128
'74.#15.3.67':3128
'11#.#8.36.98':3128
'18#.#60.166.2':3128
'16#.#67.212.235':3128
'75.##0.226.12':3128
'20#.#91.242.241':3128
'70.##.141.158':3128
'27.##4.94.234':3128
'94.##1.77.157':3128
'11#.#60.141.102':3128
'85.##2.209.175':3128
'11#.#5.11.37':3128
'18#.#44.87.50':3128
'41.##3.228.17':3128
'91.##5.50.110':3128
'64.##.73.202':3128
'19#.#7.136.244':3128
'95.##.48.198':3128
'17#.#68.88.186':3128
'20#.#3.162.99':3128
'17#.#47.135.124':3128
'92.##.137.42':3128
'84.##.242.177':3128
'11#.#5.4.172':3128
'18#.2.89.64':3128
'72.##2.168.108':3128
'93.##5.69.141':3128
'41.#6.46.47':3128
'95.##.124.38':3128
'89.##5.106.30':3128
'19#.#55.209.74':3128
'77.##1.18.161':3128
'88.##0.36.219':3128
'19#.#3.231.210':3128
'11#.#4.136.242':3128
'21#.#47.131.92':3128
'89.##9.146.68':3128
'18#.#92.223.152':3128
'11#.#52.191.187':3128
'95.#8.99.79':3128
'2.##.37.70':3128
'82.##8.97.240':3128
'61.##.57.175':3128
'87.##0.166.58':3128
'17#.#44.161.209':3128
'21#.#5.122.105':3128
'95.##.172.22':3128
'18#.#7.18.212':3128
'67.##2.104.30':3128
'21#.#47.131.236':3128
'78.##.149.250':3128
'86.##.120.163':3128
'10#.#72.59.74':3128
'21#.#5.79.64':3128
'85.##5.238.33':3128
'22#.#14.251.206':3128
'18#.#.218.239':3128
'18#.#5.179.53':3128
'19#.#20.162.3':3128
'11#.#41.58.243':3128
'41.##.17.190':3128
'91.##5.9.247':3128
'2.###.110.127':3128
'89.##9.73.254':3128
'77.##1.18.248':3128
'22#.#37.116.4':3128
'95.##.131.31':3128
'12#.#25.196.143':3128
'95.##.113.46':3128
'95.##.109.230':3128
'19#.#2.54.245':3128
'18#.#4.54.64':3128
'2.##.233.198':3128
'41.##.18.145':3128
'85.##4.253.12':3128
'19#.#02.194.17':3128
'11#.#8.0.224':3128
'19#.#13.223.88':3128
'2.##.103.137':3128
'10#.#53.78.130':3128
'18#.#10.234.155':3128
'41.#7.0.222':3128
'41.##3.57.73':3128
'77.#45.6.14':3128
'41.#6.8.129':3128
'80.#0.168.1':3128
'19#.53.70.6':3128
'19#.#04.141.211':3128
'79.##7.47.195':3128
'2.##.154.232':3128
'92.##5.41.62':3128
'31.##.246.83':3128
'46.##.224.85':3128
'20#.#43.151.93':3128
'19#.#20.153.38':3128
'95.##.141.203':3128
'75.##0.133.254':3128
'22#.#75.232.210':3128
'91.##3.140.96':3128
'31.#4.75.22':3128
'68.##.208.167':3128
'95.##2.184.18':3128
'92.##.17.226':3128
'17#.#06.237.181':3128
'11#.#2.152.137':3128
'95.#5.36.51':3128
'18#.#61.132.107':3128
'95.##.192.126':3128
'19#.#01.203.152':3128
'80.##.108.138':3128
'18#.#10.230.164':3128
'62.##.37.130':3128
'89.##6.219.3':3128
'21#.#12.170.65':3128
'92.##.66.136':3128
'46.##.138.78':3128
'17#.#39.117.243':3128
'41.##2.169.170':3128
'41.##2.62.141':3128
'17#.#5.67.237':3128
'10#.#53.115.139':3128
'20#.#64.230.164':3128
'95.##.18.221':3128
'84.##0.213.74':3128
'78.##.242.233':3128
'41.##3.57.72':3128
'72.##2.237.212':3128
'95.##.104.199':3128
'12#.#6.62.33':3128
'46.##.221.46':3128
'41.##2.130.167':3128
'31.##8.11.139':3128
'41.##0.246.66':3128
'18#.#53.219.249':3128
'22#.#75.231.99':3128
'17#.#21.88.236':3128
'11#.#8.38.163':3128
'94.##1.71.43':3128
'10#.#3.231.154':3128
'18#.#22.145.46':3128
'18#.#53.236.99':3128
'2.###.138.40':3128
'21#.#5.49.228':3128
'41.##.125.134':3128
'20#.#09.244.30':3128
'41.##1.56.14':3128
'41.##3.41.85':3128
'37.#9.66.72':3128
'46.##.223.174':3128
'18#.#60.9.90':3128
'95.##.147.221':3128
'83.#.53.203':3128
'61.##5.136.244':3128
'89.##.38.241':3128
'77.#45.6.24':3128
'12#.#40.73.192':3128
'19#.#.97.196':3128
'20#.#42.212.32':3128
'79.##7.47.199':3128
'41.##.166.113':3128
'81.#0.0.18':3128
'2.##4.5.223':3128
'91.##5.9.231':3128
'20#.#43.101.123':3128
'2.##.137.201':3128
'20#.#62.16.205':3128
'19#.#.115.130':3128
'80.##.144.146':3128
'19#.#0.214.68':3128
'16#.#67.43.205':3128
'95.##.135.68':3128
'19#.#03.250.199':3128
'95.##2.109.119':3128
'37.##.108.37':3128
'92.##.43.232':3128
'81.#0.0.17':3128
'17#.#0.153.31':3128
'19#.#.52.104':3128
'46.##.106.39':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней