Trojan.DownLoader4.60100

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'10#.#6.130.98':3128
'12#.#6.193.33':3128
'10#.#4.199.95':3128
'11#.#51.193.17':3128
'78.##.242.233':3128
'20#.#87.228.5':3128
'20#.#39.150.156':3128
'61.##.56.179':3128
'85.##0.81.228':3128
'19#.#99.164.253':3128
'41.##0.11.47':3128
'83.##2.81.217':3128
'10#.#4.160.195':3128
'20#.#1.99.77':3128
'12#.#27.65.174':3128
'60.##4.78.62':3128
'21#.#32.0.199':3128
'11#.#6.46.204':3128
'74.#15.3.63':3128
'21#.#4.250.155':3128
'61.##.191.209':3128
'79.##9.164.193':3128
'84.##0.192.116':3128
'12#.#65.113.205':3128
'58.##.164.228':3128
'61.##.190.141':3128
'19#.#.117.138':3128
'21#.#4.182.87':3128
'10#.#53.168.117':3128
'11#.#2.142.174':3128
'58.##.82.245':3128
'85.##8.177.127':3128
'77.##7.159.76':3128
'62.##3.176.118':3128
'18#.#20.226.164':3128
'79.##9.209.44':3128
'20#.43.33.8':3128
'20#.#43.5.17':3128
'46.##9.129.108':3128
'21#.#5.13.65':3128
'92.##.140.241':3128
'18#.#92.177.207':3128
'61.##.254.222':3128
'79.##9.170.148':3128
'95.##.44.254':3128
'94.##6.130.68':3128
'11#.#84.38.78':3128
'21#.#99.111.74':3128
'11#.#9.141.242':3128
'61.##.250.250':3128
'82.##2.103.247':3128
'21#.#86.183.4':3128
'61.##.255.216':3128
'18#.#8.140.81':3128
'10#.#85.136.152':3128
'46.##7.254.73':3128
'10#.#53.221.197':3128
'59.##3.52.164':3128
'17#.#3.150.205':3128
'61.##.254.11':3128
'84.##0.183.115':3128
'61.##.170.173':3128
'79.##9.170.65':3128
'68.##.102.81':3128
'71.#0.209.2':3128
'18#.#92.174.6':3128
'59.##3.55.162':3128
'77.##.186.32':3128
'71.#4.23.37':3128
'11#.#98.82.44':3128
'12#.#04.116.12':3128
'19#.#5.166.58':3128
'22#.#20.31.34':3128
'84.#.230.196':3128
'85.##.106.150':3128
'88.##5.40.159':3128
'75.##9.23.242':3128
'58.#.104.15':3128
'41.##8.57.64':3128
'87.##6.203.32':3128
'11#.#2.218.15':3128
'84.##0.158.61':3128
'11#.#54.131.100':3128
'83.##2.57.230':3128
'11#.#2.218.64':3128
'67.##3.9.225':3128
'11#.#42.68.244':3128
'11#.#42.247.189':3128
'61.##.212.248':3128
'18#.#4.204.229':3128
'12#.#18.153.19':3128
'59.##3.48.191':3128
'92.##5.96.201':3128
'11#.#38.207.174':3128
'95.##.213.231':3128
'18#.#5.232.161':3128
'12#.#27.64.187':3128
'18#.#7.178.209':3128
'18#.#46.40.179':3128
'11#.#05.103.72':3128
'11#.#2.218.78':3128
'11#.#5.98.226':3128
'61.#.70.29':3128
'12#.#44.8.72':3128
'19#.#2.156.101':3128
'11#.#1.65.205':3128
'17#.#00.149.128':3128
'11#.#7.93.59':3128
'94.##.95.151':3128
'19#.#14.155.14':3128
'11#.#70.23.17':3128
'61.##.188.157':3128
'89.##5.1.104':3128
'24.##.149.169':3128
'18#.#04.236.78':3128
'12#.#26.134.35':3128
'84.#2.8.72':3128
'12#.#2.49.67':3128
'85.#7.59.79':3128
'18#.#20.113.237':3128
'19#.#73.125.55':3128
'93.##3.200.30':3128
'92.##3.234.142':3128
'84.#2.63.48':3128
'77.##7.159.51':3128
'77.##7.159.108':3128
'87.##0.166.58':3128
'24.##2.219.145':3128
'22#.#6.233.35':3128
'12#.#8.95.39':3128
'62.##9.117.97':3128
'61.##.180.152':3128
'61.##.160.22':3128
'18#.#92.195.90':3128
'21#.#5.237.148':3128
'21#.#45.152.202':3128
'11#.#13.187.131':3128
'77.##.184.97':3128
'22#.#1.243.218':3128
'11#.#98.92.96':3128
'11#.#02.89.204':3128
'92.##.159.114':3128
'20#.#7.240.150':3128
'19#.#18.62.162':3128
'79.##8.29.228':3128
'21#.#5.238.195':3128
'12#.#32.78.181':3128
'77.##4.115.85':3128
'59.##3.172.14':3128
'61.##.181.244':3128
'62.##9.196.203':3128
'10#.#4.204.28':3128
'20#.#50.162.170':3128
'41.##3.57.74':3128
'95.#9.8.255':3128
'19#.#6.196.3':3128
'12#.#4.106.193':3128
'95.##.214.37':3128
'19#.#01.231.70':3128
'77.##.182.158':3128
'93.##6.235.9':3128
'92.##.164.203':3128
'89.##3.69.41':3128
'12#.#.41.218':3128
'11#.#54.127.193':3128
'21#.#4.104.102':3128
'2.##.7.30':3128
'17#.#49.116.145':3128
'11#.#40.64.198':3128
'74.#15.5.41':3128
'16#.#57.23.94':3128
'11#.#2.218.83':3128
'83.##5.185.244':3128
'21#.#27.144.55':3128
'19#.#00.84.29':3128
'68.#10.86.3':3128
'11#.#5.7.210':3128
'17#.#65.19.33':3128
'82.##1.88.128':3128
'11#.#54.117.245':3128
'93.##0.28.178':3128
'59.##3.54.116':3128
'10#.#22.68.165':3128
'95.#9.8.16':3128
'18#.#2.80.42':3128
'84.##0.185.51':3128
'95.##.139.86':3128
'12#.#05.186.8':3128
'17#.#23.45.79':3128
'77.##7.117.160':3128
'93.#4.69.29':3128
'61.#2.56.17':3128
'12#.#9.25.66':3128
'77.##.122.125':3128
'79.##5.253.7':3128
'61.##.184.188':3128
'16#.#7.221.216':3128
'92.##3.144.242':3128
'17#.#37.6.110':3128
'62.##3.174.192':3128
'92.##5.174.196':3128
'21#.#4.183.37':3128
'61.##.235.206':3128
'61.##.56.232':3128
'82.##4.163.132':3128
'76.##3.127.4':3128
'18#.#8.112.37':3128
'11#.#54.123.17':3128
'22#.#43.63.38':3128
'59.#13.54.9':3128
'20#.#54.63.147':3128
'11#.#7.182.22':3128
'18#.#73.201.5':3128
'95.##.113.30':3128
'21#.#2.200.158':3128
'95.##0.100.99':3128
'77.##4.85.146':3128
'94.##.177.90':3128
'21#.#4.183.155':3128
'21#.85.15.2':3128
'11#.#1.51.16':3128
'89.##9.226.173':3128
'46.##.145.40':3128
'21#.#43.103.17':3128
'21#.#46.192.55':3128
'18#.#58.73.129':3128
'62.##.41.110':3128
'13#.#.157.199':3128
'12#.#27.64.66':3128
'20#.#0.110.96':3128
'77.##0.161.40':3128
'19#.#84.8.104':3128
'85.##8.128.101':3128
'22#.#6.108.221':3128
'11#.#5.98.175':3128
'77.##4.235.124':3128
'18#.#80.106.13':3128
'61.##8.150.103':3128
'92.##3.223.122':3128
'61.##.190.24':3128
'93.##3.109.162':3128
'18#.#92.136.235':3128
'22#.#43.63.199':3128
'11#.#19.182.118':3128
'19#.#8.140.122':3128
'21#.#94.2.198':3128
'95.##1.231.1':3128
'59.##5.193.84':3128
'11#.#9.138.247':3128
'11#.#54.132.137':3128
'92.##3.92.235':3128
'11#.#54.137.171':3128
'84.##0.129.241':3128
'21#.#4.182.72':3128
'16#.9.22.67':3128
'18#.#9.61.203':3128
'18#.#04.201.141':3128
'92.##.148.204':3128
'18#.#59.130.98':3128
'22#.#43.177.113':3128
'62.##3.159.36':3128
'10#.#05.30.72':3128
'68.##4.177.244':3128
'11#.#2.105.46':3128
'20#.#67.87.80':3128
'21#.#4.251.9':3128
'61.##.254.130':3128
'13#.#29.42.211':3128
'11#.#2.163.177':3128
'62.##.127.94':3128
'20#.#32.61.93':3128
'61.##.57.146':3128
'11#.#5.97.127':3128
'19#.#73.77.192':3128
'19#.#9.180.171':3128
'18#.#4.141.92':3128
'60.##3.48.164':3128
'11#.#8.244.148':3128
'12#.#44.8.237':3128
'18#.#96.21.33':3128
'19#.#51.53.33':3128
'81.##.215.203':3128
'20#.#64.47.254':3128
'59.#0.166.8':3128
'79.##9.208.181':3128
'10#.#91.165.33':3128
'21#.#10.16.184':3128
'18#.#12.138.52':3128
'86.##4.146.147':3128
'19#.#07.110.169':3128
'59.##3.52.85':3128
'11#.#98.86.115':3128
'76.##9.223.49':3128
'18#.#96.0.103':3128
'21#.#5.236.121':3128
'19#.#2.243.146':3128
'59.##3.55.171':3128
'21#.#5.14.94':3128
'77.##6.130.118':3128
'11#.#17.22.210':3128
'21#.#4.182.146':3128
'19#.#7.38.89':3128
'61.##.254.162':3128
'59.##3.192.72':3128
'66.#4.145.7':3128
'61.#4.180.6':3128
'94.##9.184.52':3128
'84.##0.144.133':3128
'58.##.141.121':3128
'94.##9.19.22':3128
'11#.#06.143.162':3128
'18#.#.136.59':3128
'21#.#4.181.225':3128
'92.##.142.167':3128
'61.##.189.80':3128
'16#.#42.159.241':3128
'94.##.159.128':3128
'21#.#18.211.13':3128
'1.##.16.143':3128
'20#.#9.201.9':3128
'11#.#6.12.94':3128
'81.##.183.22':3128
'24.##2.25.216':3128
'94.##6.144.28':3128
'89.##7.75.85':3128
'12#.#27.67.140':3128
'85.##6.139.142':3128
'20#.#13.101.154':3128
'61.##.183.212':3128
'77.##7.159.4':3128
'76.##2.236.102':3128
'21#.#4.181.134':3128
'60.##0.147.209':3128
'89.##8.30.232':3128
'79.##3.23.66':3128
'46.##7.210.182':3128
'41.##3.57.76':3128
'78.##.121.114':3128
'94.##6.151.80':3128
'89.##6.178.211':3128
'71.##.19.129':3128
'68.##0.182.43':3128
'12#.#92.3.66':3128
'21#.#67.192.66':3128
'18#.#92.161.17':3128
'11#.#02.97.134':3128
'95.##.229.178':3128
'11#.44.7.63':3128
'21#.#4.183.184':3128
'41.##3.57.72':3128
'61.##.191.248':3128
'17#.#7.139.232':3128
'77.##7.159.191':3128
'11#.#52.227.43':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней