Trojan.DownLoader9.58288

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERb689.dir00\svchost.exe.mdmp 16325836412032552

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERb689.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'81.##6.13.45':445
'81.##6.232.43':445
'81.##6.94.34':445
'81.##6.60.251':445
'81.##6.162.24':445
'81.##6.3.132':139
'81.##6.139.79':139
'81.##6.80.113':445
'81.##6.203.0':139
'81.##6.49.41':445
'81.##6.58.174':445
'81.##6.8.170':445
'81.##6.174.104':445
'81.##6.174.240':445
'81.##6.188.97':445
'81.##6.234.164':445
'81.##6.40.235':445
'81.##6.69.113':445
'81.##6.164.231':445
'81.##6.9.149':139
'81.##6.15.219':139
'81.##6.247.167':139
'81.##6.40.173':139
'81.##6.219.191':139
'81.##6.57.238':139
'81.##6.169.143':139
'81.##6.60.105':139
'81.##6.250.19':139
'81.##6.203.249':139
'81.##6.103.241':139
'81.##6.249.53':139
'81.##6.18.160':139
'81.##6.31.12':139
'81.##6.71.85':139
'81.##6.62.164':139
'81.##6.61.76':139
'81.##6.112.128':139
'81.##6.146.62':139
'81.##6.236.145':139
'81.##6.200.182':445
'81.##6.218.7':445
'81.##6.23.11':445
'81.##6.83.30':445
'81.##6.73.162':445
'81.##6.95.188':445
'81.##6.242.88':445
'81.##6.56.137':445
'81.##6.139.132':445
'81.##6.89.124':445
'81.##6.11.54':445
'81.##6.232.43':139
'81.##6.162.24':139
'81.##6.60.251':139
'81.##6.13.45':139
'81.##6.80.113':139
'81.##6.226.244':445
'81.##6.67.227':445
'81.##6.151.172':445
'81.##6.236.215':445
'81.##6.132.55':445
'81.##6.31.197':445
'81.##6.8.154':445
'81.#96.87.4':445
'81.##6.152.132':445
'81.##6.173.15':445
'81.##6.220.95':445
'81.##6.112.148':445
'81.##6.245.172':445
'81.##6.141.227':445
'81.##6.29.21':445
'81.##6.124.23':445
'81.##6.242.161':445
'81.##6.18.140':445
'81.##6.101.147':445
'81.##6.37.17':445
'81.##6.158.48':445
'81.##6.218.140':445
'81.##6.154.36':445
'81.##6.217.71':445
'81.#96.15.7':445
'81.##6.6.251':445
'81.##6.60.105':445
'81.##6.240.157':445
'81.##6.81.106':445
'81.##6.98.53':445
'81.##6.174.97':445
'81.##6.169.68':445
'81.##6.1.101':445
'81.##6.169.143':445
'81.##6.40.173':445
'81.##6.219.191':445
'81.##6.112.128':445
'81.##6.103.241':445
'81.##6.15.219':445
'81.##6.250.19':445
'81.##6.203.249':445
'81.##6.247.167':445
'81.##6.57.238':445
'81.##6.1.104':445
'81.##6.45.101':445
'81.##6.42.89':445
'81.##6.127.66':445
'81.##6.231.127':445
'81.##6.3.232':445
'81.##6.168.47':445
'81.##6.220.38':445
'81.##6.153.244':445
'81.##6.41.174':445
'81.##6.249.227':445
'81.##6.156.42':445
'81.##6.77.194':445
'81.##6.137.204':445
'81.##6.19.55':445
'81.##6.124.153':445
'81.##6.45.199':445
'81.##6.37.106':445
'81.##6.136.238':445
'81.##6.55.44':445
'81.##6.61.76':445
'81.##6.77.194':139
'81.##6.124.153':139
'81.##6.19.55':139
'81.##6.156.42':139
'81.##6.136.238':139
'81.##6.37.106':139
'81.##6.249.227':139
'81.##6.55.44':139
'81.##6.45.199':139
'81.##6.137.204':139
'81.##6.6.251':139
'81.##6.81.106':139
'81.##6.240.157':139
'81.#96.15.7':139
'81.##6.169.68':139
'81.##6.174.97':139
'81.##6.1.104':139
'81.##6.1.101':139
'81.##6.98.53':139
'81.##6.127.66':139
'81.##6.31.12':445
'81.##6.71.85':445
'81.##6.139.79':445
'81.##6.9.149':445
'81.##6.249.53':445
'81.##6.146.62':445
'81.##6.236.145':445
'81.##6.18.160':445
'81.##6.62.164':445
'81.##6.3.132':445
'81.##6.42.89':139
'81.##6.3.232':139
'81.##6.231.127':139
'81.##6.45.101':139
'81.##6.153.244':139
'81.##6.220.38':139
'81.##6.203.0':445
'81.##6.41.174':139
'81.##6.168.47':139
'81.##6.94.34':139
'81.##6.178.203':445
'81.##6.159.236':445
'81.##6.53.74':139
'81.##6.210.5':445
'81.##6.255.245':445
'81.##6.221.159':445
'81.##6.58.173':445
'81.##6.153.5':445
'81.##6.172.251':445
'81.##6.161.153':139
'81.##6.26.101':139
'81.##6.119.123':139
'81.##6.135.173':139
'81.##6.73.146':139
'81.##6.221.114':139
'81.##6.27.182':139
'81.##6.169.18':139
'81.##6.72.125':139
'81.##6.12.150':139
'81.##6.227.123':445
'81.##6.200.74':445
'81.##6.234.155':445
'81.##6.172.216':445
'81.##6.16.169':445
'81.##6.220.223':445
'81.##6.93.19':445
'81.##6.225.116':445
'81.##6.84.35':445
'81.##6.219.8':445
'81.##6.216.231':445
'81.##6.64.73':445
'81.##6.166.176':445
'81.##6.236.23':445
'81.##6.131.187':445
'81.##6.84.249':445
'81.##6.126.22':445
'81.##6.196.84':445
'81.##6.252.65':445
'81.#96.9.67':445
'81.##6.86.242':139
'81.##6.252.65':139
'81.##6.166.176':139
'81.##6.58.173':139
'81.##6.64.73':139
'81.##6.84.249':139
'81.##6.196.84':139
'81.##6.216.231':139
'81.#96.9.67':139
'81.##6.126.22':139
'81.##6.227.123':139
'81.##6.159.236':139
'81.##6.210.5':139
'81.##6.131.187':139
'81.##6.221.159':139
'81.##6.255.245':139
'81.##6.178.203':139
'81.##6.236.23':139
'81.##6.153.5':139
'81.##6.172.251':139
'81.##6.172.216':139
'81.##6.140.86':139
'81.##6.216.248':139
'81.##6.68.210':139
'81.##6.36.111':139
'81.##6.232.239':139
'81.##6.90.134':139
'81.##6.22.105':139
'81.##6.90.252':139
'81.##6.222.148':139
'81.##6.67.166':139
'81.##6.234.155':139
'81.##6.84.35':139
'81.##6.16.169':139
'81.##6.200.74':139
'81.##6.220.223':139
'81.##6.225.116':139
'81.##6.211.104':139
'81.##6.219.8':139
'81.##6.93.19':139
'81.##6.242.161':139
'81.##6.37.17':139
'81.##6.101.147':139
'81.##6.124.23':139
'81.##6.154.36':139
'81.##6.218.140':139
'81.##6.29.21':139
'81.##6.217.71':139
'81.##6.158.48':139
'81.##6.18.140':139
'81.##6.23.11':139
'81.##6.95.188':139
'81.##6.73.162':139
'81.##6.218.7':139
'81.##6.139.132':139
'81.##6.56.137':139
'81.##6.132.55':139
'81.##6.89.124':139
'81.##6.242.88':139
'81.#96.87.4':139
'81.##6.8.170':139
'81.##6.188.97':139
'81.##6.174.240':139
'81.##6.58.174':139
'81.##6.69.113':139
'81.##6.40.235':139
'81.##6.49.41':139
'81.##6.164.231':139
'81.##6.234.164':139
'81.##6.174.104':139
'81.##6.8.154':139
'81.##6.173.15':139
'81.##6.152.132':139
'81.##6.31.197':139
'81.##6.245.172':139
'81.##6.112.148':139
'81.##6.200.182':139
'81.##6.141.227':139
'81.##6.220.95':139
'81.##6.83.30':139
'81.##6.135.173':445
'81.##6.26.101':445
'81.##6.22.105':445
'81.##6.86.242':445
'81.##6.73.146':445
'81.##6.72.125':445
'81.##6.12.150':445
'81.##6.119.123':445
'81.##6.221.114':445
'81.##6.90.134':445
'81.##6.68.210':445
'81.##6.36.111':445
'81.##6.211.104':445
'81.##6.67.166':445
'81.##6.140.86':445
'81.##6.90.252':445
'81.##6.222.148':445
'81.##6.216.248':445
'81.##6.232.239':445
'81.##6.27.182':445
'81.##6.220.223':9988
'81.##6.131.187':9988
'81.##6.90.134':9988
'81.##6.161.153':9988
'81.##6.151.172':139
'81.##6.67.227':139
'81.##6.11.54':139
'81.##6.236.215':139
'81.##6.226.244':139
'81.##6.210.5':9988
'81.##6.53.74':445
'81.##6.252.65':9988
'81.##6.169.18':445
'81.##6.161.153':445
'81.##6.178.203':9988
'81.##6.236.23':9988
'81.##6.84.249':9988
'81.##6.90.252':9988
'81.##6.227.123':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней