Trojan.DownLoader10.9204

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER7990.dir00\svchost.exe.mdmp 16325836412032076

Скрывает следующие процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Help\Tours\htmlTour\tjxhsker.exe
%WINDIR%\Help\Tours\htmlTour\hjhecvkh.exe
%WINDIR%\Help\Tours\htmlTour\kzerbzks.exe
%WINDIR%\Help\Tours\htmlTour\klbvejnk.exe
%WINDIR%\Help\Tours\htmlTour\kxkzvszq.exe
%WINDIR%\Help\Tours\htmlTour\lrhwxcwk.exe
%WINDIR%\Help\Tours\htmlTour\nleqhveh.exe
%WINDIR%\Help\Tours\htmlTour\qejnhetj.exe
%WINDIR%\Help\tsbjbtvn.exe
%WINDIR%\Help\jjlenkbt.exe
%WINDIR%\Help\Tours\htmlTour\cxjclkkc.exe
%WINDIR%\Help\Tours\htmlTour\wwvjntek.exe
%WINDIR%\Help\Tours\htmlTour\lhhjrkjk.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\lllknblj.exe
%WINDIR%\Help\Tours\htmlTour\ztssweeh.exe
%WINDIR%\Help\Tours\htmlTour\rbnesqvr.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\lhwxjnsb.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\selkwllq.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\tjnbzhbh.exe
%WINDIR%\Help\Tours\htmlTour\ewrlklcs.exe
%WINDIR%\Help\Tours\htmlTour\trsecbvb.exe
%WINDIR%\Help\Tours\htmlTour\lwnssrtv.exe
%WINDIR%\Help\Tours\htmlTour\skersqzb.exe
%WINDIR%\Help\Tours\htmlTour\zbcwlstj.exe
%WINDIR%\Help\Tours\htmlTour\ekwlsjzj.exe
%WINDIR%\Help\Tours\htmlTour\rqkjqjqb.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%TEMP%\WER7990.dir00\svchost.exe.mdmp
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%WINDIR%\Help\hwexrtne.exe
%WINDIR%\Help\bzehxvnz.exe
%WINDIR%\Help\jbnshhqj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'59.##5.111.116':445
'59.##5.40.141':445
'59.##5.122.231':445
'59.##5.137.2':445
'59.##5.92.75':445
'59.##5.180.7':445
'59.##5.86.37':445
'59.##5.12.50':445
'59.##5.167.12':445
'59.##5.145.124':445
'59.##5.203.145':445
'59.##5.230.97':445
'59.##5.87.246':445
'59.##5.140.203':445
'59.##5.99.133':445
'59.##5.181.141':445
'59.##5.33.141':445
'59.##5.4.197':445
'59.##5.214.7':9988
'59.##5.126.33':9988
'59.##5.11.190':9988
'59.##5.166.14':9988
'59.##5.225.239':9988
'59.##5.114.241':9988
'59.##5.216.248':9988
'59.#15.89.4':9988
'59.##5.17.252':9988
'59.##5.207.113':445
'59.##5.105.244':9988
'59.##5.100.94':445
'59.##5.35.100':445
'59.##5.57.147':9988
'59.##5.38.191':9988
'59.##5.239.120':9988
'59.##5.142.241':9988
'59.##5.65.161':9988
'59.##5.105.82':445
'59.##5.126.33':445
'59.##5.105.244':445
'59.##5.166.14':445
'59.##5.38.191':445
'59.##5.214.7':445
'59.##5.239.120':445
'59.##5.225.239':445
'59.##5.11.190':445
'59.##5.65.161':445
'59.##5.180.7':139
'59.##5.86.37':139
'59.##5.12.50':139
'59.##5.167.12':139
'59.##5.100.94':139
'59.##5.138.115':445
'59.##5.142.241':445
'59.##5.35.100':139
'59.##5.207.113':139
'59.##5.248.46':445
'59.##5.6.218':445
'59.##5.243.156':445
'59.##5.74.108':445
'59.##5.186.101':445
'59.##5.30.47':445
'59.##5.82.30':445
'59.##5.68.186':445
'59.##5.215.51':445
'59.#15.89.4':445
'59.##5.114.241':445
'59.##5.57.147':445
'59.##5.17.252':445
'59.##5.216.248':445
'59.##5.242.122':445
'59.##5.80.145':445
'59.##5.9.188':445
'59.##5.112.252':445
'59.##5.219.112':139
'59.##5.32.115':139
'59.##5.91.87':139
'59.##5.74.110':139
'59.##5.108.254':139
'59.##5.191.176':139
'59.##5.157.191':139
'59.##5.142.107':139
'59.##5.176.87':139
'59.##5.59.24':445
'59.##5.39.114':445
'59.##5.39.114':139
'59.##5.48.38':139
'59.##5.48.38':445
'59.##5.226.211':139
'59.##5.75.245':139
'59.##5.193.150':139
'59.##5.49.41':139
'59.##5.142.107':445
'59.##5.176.87':445
'59.##5.32.115':445
'59.##5.108.254':445
'59.##5.191.176':445
'59.##5.46.10':445
'59.##5.59.24':9988
'59.##5.157.191':445
'59.##5.9.213':445
'59.##5.193.150':445
'59.##5.49.41':445
'59.##5.9.213':139
'59.##5.46.10':139
'59.##5.226.211':445
'59.##5.74.110':445
'59.##5.219.112':445
'59.##5.75.245':445
'59.##5.91.87':445
'59.##5.59.24':139
'59.##5.82.30':9988
'59.##5.215.51':9988
'59.##5.186.101':9988
'59.##5.30.47':9988
'59.##5.105.82':9988
'59.##5.145.124':9988
'59.##5.203.145':9988
'59.##5.230.97':9988
'59.##5.87.246':9988
'59.##5.242.122':9988
'59.##5.80.145':9988
'59.##5.9.188':9988
'59.##5.112.252':9988
'59.##5.243.156':9988
'59.##5.6.218':9988
'59.##5.68.186':9988
'59.##5.74.108':9988
'59.##5.248.46':9988
'59.##5.167.12':9988
'59.##5.180.7':9988
'59.##5.92.75':9988
'59.##5.12.50':9988
'59.##5.86.37':9988
'59.##5.207.113':9988
'59.##5.138.115':9988
'59.##5.100.94':9988
'59.##5.35.100':9988
'59.##5.4.197':9988
'59.##5.99.133':9988
'59.##5.140.203':9988
'59.##5.33.141':9988
'59.##5.181.141':9988
'59.##5.111.116':9988
'59.##5.40.141':9988
'59.##5.122.231':9988
'59.##5.137.2':9988
'24.##.113.65':139
'24.##.45.216':139
'24.##.255.84':139
'24.##.92.188':139
'24.#0.159.4':139
'24.#0.67.92':445
'24.##.66.156':445
'24.##.240.54':445
'24.#0.54.31':445
'24.##.217.46':139
'24.##.19.234':139
'24.##.100.156':139
'24.##.125.127':139
'24.#0.9.194':139
'24.##.199.237':139
'24.##.143.150':139
'24.##.89.183':139
'24.#0.63.47':139
'24.#0.4.199':445
'24.##.109.121':445
'24.#0.52.27':445
'24.##.20.226':445
'24.#0.3.150':445
'24.#0.5.71':445
'24.##.52.149':445
'24.##.107.189':445
'24.##.29.199':445
'24.##.107.55':445
'24.##.23.216':445
'24.##.91.240':445
'24.##.192.79':445
'24.##.111.119':445
'24.##.166.212':445
'24.##.139.133':445
'24.##.151.116':445
'24.##.27.152':445
'24.##.156.143':139
'24.##.166.212':139
'24.#0.52.27':139
'24.##.151.116':139
'24.##.27.152':139
'24.##.139.133':139
'24.##.109.121':139
'24.#0.3.150':139
'24.#0.4.199':139
'24.##.20.226':139
'24.#0.67.92':139
'24.##.66.156':139
'24.##.240.54':139
'24.#0.54.31':139
'24.##.91.240':139
'24.##.23.216':139
'24.##.107.55':139
'24.##.192.79':139
'24.##.111.119':139
'24.##.85.212':139
'24.##.33.151':139
'24.##.175.115':139
'24.##.111.231':139
'24.##.114.158':139
'24.##.99.168':139
'24.##.119.184':139
'24.##.16.164':139
'24.##.106.128':139
'24.#0.5.71':139
'24.##.52.149':139
'24.##.107.189':139
'24.##.29.199':139
'24.#0.6.235':139
'24.##.207.152':139
'24.##.105.112':139
'24.##.123.219':139
'24.#0.28.28':139
'59.##5.80.145':139
'59.##5.243.156':139
'59.##5.112.252':139
'59.##5.242.122':139
'59.##5.74.108':139
'59.##5.186.101':139
'59.##5.68.186':139
'59.##5.248.46':139
'59.##5.6.218':139
'59.##5.225.239':139
'59.##5.57.147':139
'59.##5.65.161':139
'59.##5.239.120':139
'59.##5.17.252':139
'59.##5.216.248':139
'59.##5.9.188':139
'59.#15.89.4':139
'59.##5.114.241':139
'59.##5.99.133':139
'59.##5.181.141':139
'59.##5.33.141':139
'59.##5.4.197':139
'59.##5.122.231':139
'59.##5.40.141':139
'59.##5.92.75':139
'59.##5.137.2':139
'59.##5.111.116':139
'59.##5.82.30':139
'59.##5.105.82':139
'59.##5.215.51':139
'59.##5.30.47':139
'59.##5.230.97':139
'59.##5.203.145':139
'59.##5.140.203':139
'59.##5.87.246':139
'59.##5.145.124':139
'59.##5.11.190':139
'24.##.106.128':445
'24.##.119.184':445
'24.##.33.151':445
'24.##.16.164':445
'24.##.99.168':445
'24.##.125.127':445
'24.##.217.46':445
'24.##.100.156':445
'24.##.156.143':445
'24.##.123.219':445
'24.##.207.152':445
'24.#0.6.235':445
'24.#0.28.28':445
'24.##.105.112':445
'24.##.85.212':445
'24.##.114.158':445
'24.##.175.115':445
'24.##.111.231':445
'59.##5.142.241':139
'59.##5.138.115':139
'24.##.45.216':445
'24.#0.159.4':445
'59.##5.166.14':139
'59.##5.105.244':139
'59.##5.214.7':139
'59.##5.38.191':139
'59.##5.126.33':139
'24.##.89.183':445
'24.#0.63.47':445
'24.##.19.234':445
'24.#0.9.194':445
'24.##.199.237':445
'24.##.255.84':445
'24.##.113.65':445
'24.##.143.150':445
'24.##.92.188':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней