Trojan.DownLoader10.3364

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER50b0.dir00\svchost.exe.mdmp 16325836412032732

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER50b0.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'60.##0.171.174':445
'60.##0.0.229':445
'60.##0.174.145':445
'60.##0.60.75':445
'60.##0.142.184':445
'60.##0.233.76':445
'60.##0.75.27':445
'60.##0.54.164':445
'60.##0.177.229':445
'60.##0.221.73':445
'60.##0.146.55':445
'60.##0.137.36':445
'60.##0.125.131':445
'60.##0.154.143':445
'60.##0.53.29':445
'60.##0.35.225':445
'60.##0.73.235':445
'60.##0.150.7':445
'60.##0.6.150':445
'60.##0.47.159':139
'60.##0.185.212':139
'60.##0.160.248':139
'60.##0.71.95':139
'60.##0.179.185':139
'60.##0.20.169':139
'60.##0.32.152':139
'60.##0.192.51':139
'60.##0.169.28':139
'60.##0.172.182':139
'60.##0.159.26':445
'60.##0.65.51':445
'60.##0.43.226':445
'60.##0.95.43':445
'60.##0.64.65':139
'60.##0.4.210':139
'60.##0.44.253':139
'60.##0.27.64':139
'60.##0.141.206':139
'60.##0.92.237':445
'60.##0.111.136':445
'60.##0.191.104':445
'60.##0.65.51':139
'60.##0.35.243':445
'60.##0.61.144':445
'60.##0.162.118':445
'60.##0.42.75':445
'60.##0.94.111':445
'60.#10.6.8':445
'60.##0.159.26':139
'60.##0.142.184':139
'60.##0.54.164':139
'60.##0.174.145':139
'60.##0.0.229':139
'60.##0.177.229':139
'60.##0.43.226':139
'60.##0.95.43':139
'60.##0.233.76':139
'60.##0.75.27':139
'60.##0.68.157':445
'60.##0.150.115':445
'60.##0.181.113':445
'60.##0.226.180':445
'60.##0.51.240':445
'60.##0.212.142':445
'60.##0.236.103':445
'60.##0.9.209':445
'60.##0.151.120':445
'60.##0.113.215':445
'60.##0.52.252':445
'60.##0.39.176':445
'60.##0.186.56':445
'60.##0.24.135':445
'60.##0.35.166':445
'60.##0.131.156':445
'60.##0.215.59':445
'60.##0.15.97':445
'60.##0.187.44':445
'60.#10.9.12':139
'60.##0.120.35':445
'60.##0.210.252':445
'60.##0.32.152':445
'60.#10.9.12':445
'60.##0.209.211':445
'60.#10.9.74':445
'60.##0.164.128':445
'60.##0.105.239':445
'60.##0.157.102':445
'60.##0.20.169':445
'60.##0.160.248':445
'60.##0.71.95':445
'60.##0.44.253':445
'60.##0.172.182':445
'60.##0.47.159':445
'60.##0.192.51':445
'60.##0.169.28':445
'60.##0.185.212':445
'60.##0.179.185':445
'60.##0.254.245':445
'60.##0.72.87':445
'60.##0.60.78':445
'60.##0.255.112':445
'60.##0.161.133':445
'60.##0.143.83':445
'60.##0.57.169':445
'60.##0.81.121':445
'60.##0.55.138':445
'60.##0.14.141':445
'60.##0.138.120':445
'60.##0.1.176':445
'60.##0.209.26':445
'60.##0.225.219':445
'60.##0.20.164':445
'60.##0.38.123':445
'60.##0.40.189':445
'60.##0.155.253':445
'60.##0.26.186':445
'60.##0.4.210':445
'60.##0.155.253':139
'60.##0.26.186':139
'60.##0.1.176':139
'60.##0.20.164':139
'60.##0.38.123':139
'60.##0.60.78':139
'60.##0.255.112':139
'60.##0.40.189':139
'60.##0.14.141':139
'60.##0.138.120':139
'60.##0.209.211':139
'60.##0.105.239':139
'60.##0.120.35':139
'60.##0.210.252':139
'60.##0.157.102':139
'60.##0.209.26':139
'60.##0.225.219':139
'60.#10.9.74':139
'60.##0.164.128':139
'60.##0.246.104':139
'60.##0.15.163':139
'60.##0.159.155':139
'60.##0.182.121':139
'60.##0.251.128':139
'60.##0.27.64':445
'60.##0.141.206':445
'60.##0.64.17':139
'60.##0.64.65':445
'60.#10.28.4':139
'60.##0.161.133':139
'60.##0.81.121':139
'60.##0.254.245':139
'60.##0.72.87':139
'60.##0.55.138':139
'60.##0.234.179':139
'60.##0.14.212':139
'60.##0.143.83':139
'60.##0.57.169':139
'60.##0.95.66':445
'60.##0.81.182':445
'60.##0.3.199':139
'60.##0.176.102':139
'60.##0.128.82':445
'60.##0.170.81':445
'60.##0.25.91':445
'60.##0.182.235':445
'60.##0.141.144':445
'60.##0.199.63':139
'60.##0.177.235':139
'60.##0.234.177':139
'60.##0.58.17':139
'60.##0.235.170':139
'60.##0.111.221':139
'60.##0.128.236':139
'60.##0.64.129':139
'60.##0.123.244':139
'60.##0.217.221':139
'60.##0.229.146':445
'60.##0.222.127':445
'60.##0.147.214':445
'60.##0.18.12':445
'60.##0.210.152':445
'60.##0.31.196':445
'60.##0.255.123':445
'60.##0.120.102':445
'60.##0.40.120':445
'60.##0.80.50':445
'60.##0.33.51':445
'60.##0.114.27':445
'60.##0.45.26':445
'60.##0.38.45':445
'60.##0.206.98':445
'60.##0.236.6':445
'60.##0.43.185':445
'60.##0.57.211':445
'60.##0.235.190':445
'60.##0.90.63':139
'60.##0.57.211':139
'60.##0.235.190':139
'60.##0.114.27':139
'60.##0.206.98':139
'60.##0.236.6':139
'60.##0.147.214':139
'60.##0.18.12':139
'60.##0.43.185':139
'60.##0.80.50':139
'60.##0.33.51':139
'60.##0.182.235':139
'60.##0.141.144':139
'60.##0.81.182':139
'60.##0.95.66':139
'60.##0.170.81':139
'60.##0.45.26':139
'60.##0.38.45':139
'60.##0.128.82':139
'60.##0.25.91':139
'60.##0.27.100':139
'60.##0.44.58':139
'60.##0.32.94':139
'60.##0.232.196':139
'60.##0.184.43':139
'60.##0.28.211':139
'60.##0.74.85':139
'60.##0.108.164':139
'60.##0.232.240':139
'60.##0.131.183':139
'60.##0.210.152':139
'60.##0.120.102':139
'60.##0.229.146':139
'60.##0.222.127':139
'60.##0.40.120':139
'60.##0.121.44':139
'60.##0.200.165':139
'60.##0.31.196':139
'60.##0.255.123':139
'60.##0.121.44':445
'60.##0.187.44':139
'60.##0.131.156':139
'60.##0.35.166':139
'60.##0.15.97':139
'60.##0.215.59':139
'60.##0.226.180':139
'60.##0.68.157':139
'60.##0.113.215':139
'60.##0.181.113':139
'60.##0.39.176':139
'60.##0.94.111':139
'60.#10.6.8':139
'60.##0.191.104':139
'60.##0.61.144':139
'60.##0.162.118':139
'60.##0.24.135':139
'60.##0.52.252':139
'60.##0.42.75':139
'60.##0.186.56':139
'60.##0.150.7':139
'60.##0.6.150':139
'60.##0.137.36':139
'60.##0.53.29':139
'60.##0.35.225':139
'60.##0.60.75':139
'60.##0.171.174':139
'60.##0.73.235':139
'60.##0.221.73':139
'60.##0.146.55':139
'60.##0.9.209':139
'60.##0.212.142':139
'60.##0.150.115':139
'60.##0.51.240':139
'60.##0.151.120':139
'60.##0.125.131':139
'60.##0.154.143':139
'60.##0.236.103':139
'60.##0.92.237':139
'60.##0.111.136':139
'60.##0.58.17':445
'60.##0.235.170':445
'60.##0.74.85':445
'60.##0.90.63':445
'60.##0.177.235':445
'60.##0.123.244':445
'60.##0.217.221':445
'60.##0.234.177':445
'60.##0.111.221':445
'60.##0.28.211':445
'60.##0.32.94':445
'60.##0.232.196':445
'60.##0.200.165':445
'60.##0.131.183':445
'60.##0.27.100':445
'60.##0.108.164':445
'60.##0.232.240':445
'60.##0.44.58':445
'60.##0.184.43':445
'60.##0.235.190':9988
'60.##0.43.185':9988
'60.##0.128.82':9988
'60.##0.114.27':9988
'60.##0.80.50':9988
'60.##0.31.196':9988
'60.##0.35.243':139
'60.##0.229.146':9988
'60.##0.210.152':9988
'60.##0.95.66':9988
'60.##0.199.63':445
'60.##0.3.199':445
'60.##0.128.236':445
'60.##0.64.129':445
'60.##0.176.102':445
'60.##0.141.144':9988
'60.##0.81.182':9988
'60.##0.170.81':9988
'60.##0.38.45':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней