Trojan.DownLoader9.7869

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6885' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14386' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26052' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7104' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20457' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28385' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22838' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10376' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15509' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28264' = '<Полный путь к вирусу>'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Создает и запускает на исполнение:

'C:\lsass.exe' exe <Полный путь к вирусу>

Изменения в файловой системе:

Создает следующие файлы:

C:\lsass.exe

Сетевая активность:

Подключается к:

'20#.#10.182.33':3128
'67.##1.137.134':3128
'85.##9.253.227':3128
'75.##.31.100':3128
'24.##1.155.22':3128
'89.##3.142.181':3128
'86.##6.14.42':3128
'77.##.13.183':3128
'76.##.123.28':3128
'19#.#37.206.244':3128
'77.##2.202.168':3128
'20#.#9.113.3':3128
'72.##6.65.161':3128
'20#.#6.180.194':3128
'20#.#5.131.109':3128
'68.##2.35.71':3128
'24.##4.60.115':3128
'18#.#9.155.183':3128
'69.##9.80.49':3128
'87.##6.197.233':3128
'19#.#7.132.183':3128
'75.##5.154.235':3128
'18#.#6.114.120':3128
'22#.#12.187.144':3128
'20#.#.210.202':3128
'18#.#04.218.52':3128
'21#.#48.255.97':3128
'76.##6.42.189':3128
'11#.#4.234.237':3128
'20#.#55.158.93':3128
'19#.#03.42.120':3128
'19#.#7.242.6':3128
'20#.#49.64.197':3128
'85.##.188.101':3128
'18#.#8.207.1':3128
'19#.#3.157.237':3128
'11#.#7.191.60':3128
'22#.#5.216.175':3128
'22#.#61.135.65':3128
'83.#.122.32':3128
'12#.#31.220.21':3128
'67.##1.237.165':3128
'24.#.12.235':3128
'20#.#.205.176':3128
'12#.#25.41.58':3128
'19#.#00.64.87':3128
'18#.#7.73.247':3128
'21#.#5.199.194':3128
'18#.#20.178.25':3128
'24.##.55.205':3128
'20#.#0.252.223':3128
'89.##.94.130':3128
'22#.#38.228.160':3128
'87.#.207.74':3128
'82.##1.119.31':3128
'20#.#38.164.102':3128
'81.##6.99.35':3128
'83.##3.38.42':3128
'88.##8.160.121':3128
'20#.#25.90.93':3128
'88.##2.152.120':3128
'72.#31.89.7':3128
'21#.#.194.194':3128
'12#.#83.176.126':3128
'83.##.149.206':3128
'95.#80.19.3':3128
'20#.#7.220.197':3128
'89.##8.253.200':3128
'12#.#31.28.47':3128
'68.##.236.201':3128
'24.##7.126.94':3128
'18#.#.136.124':3128
'92.##0.118.228':3128
'21#.#7.128.4':3128
'98.##9.144.177':3128
'67.##2.55.202':3128
'69.##5.90.14':3128
'21#.#51.110.57':3128
'18#.#03.97.52':3128
'20#.#42.100.60':3128
'78.##.65.162':3128
'19#.#06.76.93':3128
'24.##5.158.82':3128
'84.##.144.188':3128
'20#.#49.86.103':3128
'14#.#08.165.167':3128
'19#.#41.223.210':3128
'24.##1.235.153':3128
'69.##3.126.92':3128
'18#.#20.161.33':3128
'19#.#06.210.150':3128
'24.##1.44.232':3128
'68.#.163.214':3128
'20#.#41.150.163':3128
'68.##.116.243':3128
'20#.#10.86.8':3128
'80.##.151.97':3128
'20#.#0.90.48':3128
'22#.#01.149.150':3128
'87.##6.105.67':3128
'69.##9.80http':0
'19#.60.59.3':3128
'82.##7.136.54':3128
'62.##5.124.82':3128
'70.##7.48.38':3128
'19#.#58.0.164':3128
'20#.#46.230.2':3128
'18#.#4.99.231':3128
'76.##0.14.58':3128
'11#.#5.130.229':3128
'12#.#9.152.99':3128
'19#.#7.255.61':3128
'81.##8.156.54':3128
'18#.1.3.65':3128
'17#.#4.132.26':3128
'11#.#43.14.15':3128
'89.##6.120.47':3128
'18#.#7.233.77':3128
'11#.#5.228.209':3128
'82.##1.132.105':3128
'67.#2.3.13':3128
'93.##3.11.83':3128
'98.##8.146.0':3128
'79.##4.212.70':3128
'12#.#38.124.229':3128
'93.##5.73.149':3128
'20#.#.129.103':3128
'19#.#9.13.58':3128
'88.##3.175.222':3128
'20#.#4.200.198':3128
'18#.#.230.159':3128
'19#.#1.205.76':3128
'19#.#04.187.119':3128
'19#.#09.66.244':3128
'19#.#64.136.46':3128
'22#.#46.251.32':3128
'97.##.24.152':3128
'92.##.201.174':3128
'17#.#00.165.202':3128
'89.##5.38.55':3128
'22#.#39.163.216':3128
'12#.#21.82.52':3128
'20#.#4.44.185':3128
'68.##.249.214':3128
'11#.#5.18.15':3128
'18#.#0.242.232':3128
'11#.#66.71.13':3128
'78.##.25.209':3128
'67.##4.228.190':3128
'19#.#7.48.16':3128
'21#.#27.18.93':3128
'98.##0.208.194':3128
'20#.#.155.119':3128
'98.##4.149.92':3128
'84.#32.8.20':3128
'68.##.139.244':3128
'89.##.187.86':3128
'18#.#8.229.150':3128
'78.##5.236.85':3128
'86.##.164.92':3128
'20#.#81.49.65':3128
'98.##3.163.223':3128
'11#.#97.2.66':3128
'85.##5.181.33':3128
'58.##5.54.156':3128
'68.##.176.233':3128
'70.##6.124.152':3128
'98.##1.78.135':3128
'89.##2.29.35':3128
'62.##1.92.44':3128
'80.##3.159.169':3128
'87.##6.41.231':3128
'78.##.210.31':3128
'78.##.178.63':3128
'84.##5.152.214':3128
'18#.#6.77.88':3128
'68.##9.49.117':3128
'24.##8.74.91':3128
'20#.#20.249.179':3128
'88.##5.124.142':3128
'22#.#4.115.130':3128
'20#.#49.82.170':3128
'79.##8.33.238':3128
'18#.#.204.156':3128
'18#.#1.41.99':3128
'20#.#54.166.153':3128
'69.##1.89.102':3128
'19#.#73.75.11':3128
'89.##.63.223':3128
'20#.#5.152.34':3128
'87.##6.251.221':3128
'19#.64.2.94':3128
'82.##0.246.251':3128
'20#.#0.86.41':3128
'21#.#31.114.204':3128
'22#.#08.73.180':3128
'24.##9.121.0':3128
'78.#1.94.47':3128
'60.##.188.190':3128
'20#.#58.46.134':3128
'20#.#2.84.67':3128
'20#.#2.10.16':3128
'91.#2.39.2':3128
'19#.#98.158.205':3128
'74.##4.166.200':3128
'89.##.248.30':3128
'22#.#5.139.158':3128
'18#.#2.244.10':3128
'82.##.100.232':3128
'20#.#05.149.42':3128
'81.##1.54.11':3128
'22#.#21.137.112':3128
'75.##0.202.167':3128
'76.##.179.145':3128
'19#.#9.79.85':3128
'16#.#32.234.75':3128
'20#.#42.194.96':3128
'11#.#5.90.224':3128
'78.#8.37.39':3128
'84.#6.37.78':3128
'70.##7.56.37':3128
'92.##.24.192':3128
'22#.#01.32.142':3128
'82.##8.135.154':3128
'62.##9.153.204':3128
'19#.#30.188.160':3128
'22#.#06.180.231':3128
'19#.#49.156.176':3128
'68.##5.124.123':3128
'95.##.214.109':3128
'12#.#39.32.251':3128
'12#.#6.111.160':3128
'24.#.120.140':3128
'20#.#49.91.224':3128
'22#.#12.239.225':3128
'78.##.167.42':3128
'19#.#99.115.167':3128
'18#.#4.6.130':3128
'21#.#53.156.158':3128
'20#.#49.73.181':3128
'20#.#73.11.235':3128
'59.#4.46.10':3128
'94.##5.195.129':3128
'72.##4.6.237':3128
'20#.#4.205.137':3128
'77.##.189.104':3128
'77.##7.132.23':3128
'19#.#06.80.133':3128
'80.##.139.153':3128
'16#.#32.233.189':3128
'20#.#9.201.32':3128
'20#.#.155.102':3128
'18#.#7.73.28':3128
'18#.#8.40.130':3128
'11#.#54.190.226':3128
'18#.#0.57.24':3128
'94.##.120.22':3128
'22#.#5.139.187':3128
'20#.#5.132.165':3128
'72.#.251.50':3128
'84.##8.117.46':3128
'80.##6.242.104':3128
'75.##.87.119':3128
'19#.#98.252.27':3128
'16#.#32.242.201':3128
'83.##3.162.230':3128
'11#.#2.140.228':3128
'12#.#62.63.207':3128
'20#.#43.63.23':3128
'67.##1.139.79':3128
'90.##.245.96':3128
'20#.#13.40.160':3128
'20#.#58.26.200':3128
'18#.#.207.66':3128
'89.#4.88.79':3128
'20#.#8.152.74':3128
'76.##.99.173':3128
'16#.#46.219.24':3128
'77.##8.10.228':3128
'41.##7.129.73':3128
'20#.#52.145.21':3128
'89.##.41.227':3128
'88.##8.33.218':3128
'76.##5.211.200':3128
'61.##.240.135':3128
'87.##7.120.157':3128
'98.##1.145.45':3128
'76.##1.167.44':3128
'94.##.205.36':3128
'68.##.198.131':3128
'86.##.139.19':3128
'19#.#00.148.50':3128
'77.##.66.184':3128
'69.#07.0.14':3128
'18#.#4.29.167':3128
'21#.#88.235.88':3128
'11#.#62.7.152':3128
'20#.#1.165.78':3128
'83.##2.155.205':3128
'89.#3.197.6':3128
'11#.#6.90.235':3128

UDP:

DNS ASK 69.##9.80http

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: '(null)'

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней