Trojan.DownLoader4.61531

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'41.##0.31.92':3128
'21#.#66.215.62':3128
'12#.#94.140.152':3128
'95.#5.75.75':3128
'49.##6.45.39':3128
'11#.88.5.13':3128
'11#.#40.109.197':3128
'18#.#6.194.72':3128
'89.##4.151.41':3128
'84.##.104.175':3128
'88.##7.27.33':3128
'11#.#02.23.106':3128
'46.##0.112.49':3128
'20#.#65.203.183':3128
'22#.2.13.47':3128
'10#.#51.147.237':3128
'95.##.233.122':3128
'49.##2.249.101':3128
'17#.#24.144.209':3128
'17#.#1.110.124':3128
'39.##9.155.26':3128
'46.##5.46.206':3128
'18#.#44.80.107':3128
'95.##.220.108':3128
'11#.#54.19.40':3128
'62.##2.69.149':3128
'11#.#75.255.51':3128
'82.##5.23.140':3128
'27.##6.118.71':3128
'12#.#03.182.166':3128
'12#.#6.139.101':3128
'11#.#40.48.193':3128
'2.###.208.64':3128
'18#.#87.53.243':3128
'21#.#72.250.98':3128
'18#.#69.204.17':3128
'17#.#1.32.159':3128
'92.##.145.19':3128
'87.##0.166.58':3128
'22#.#27.56.183':3128
'18#.#9.85.152':3128
'21#.#99.229.80':3128
'82.##9.197.225':3128
'12#.#23.125.151':3128
'95.#1.38.46':3128
'58.#.237.130':3128
'19#.#5.24.42':3128
'95.#8.7.141':3128
'93.##0.211.228':3128
'49.##1.9.131':3128
'17#.#52.201.106':3128
'11#.#03.58.59':3128
'21#.#2.200.158':3128
'1.##.142.137':3128
'12#.#36.41.33':3128
'59.##.99.249':3128
'95.#9.30.62':3128
'95.##.240.44':3128
'12#.#65.14.56':3128
'59.##3.24.219':3128
'17#.#0.132.165':3128
'89.##.44.170':3128
'11#.#5.39.148':3128
'99.##8.63.179':3128
'42.##1.164.33':3128
'46.##8.70.59':3128
'67.##7.250.135':3128
'59.##3.69.57':3128
'27.##5.48.116':3128
'11#.#54.55.162':3128
'17#.#23.118.199':3128
'11#.#07.216.200':3128
'18#.#30.97.78':3128
'78.#0.213.7':3128
'39.##9.143.108':3128
'41.##1.126.80':3128
'94.##7.75.85':3128
'17#.#23.83.5':3128
'11#.#99.188.187':3128
'20#.#7.126.195':3128
'93.##0.194.242':3128
'18#.#.203.235':3128
'93.##2.188.75':3128
'17#.#69.6.198':3128
'49.##7.136.193':3128
'14.#8.68.81':3128
'49.#02.4.16':3128
'49.##.156.146':3128
'67.##6.245.120':3128
'12#.#28.117.102':3128
'95.##.235.25':3128
'77.##.45.219':3128
'95.##1.221.49':3128
'95.#7.33.21':3128
'17#.#25.247.121':3128
'11#.#.247.123':3128
'18#.#6.153.92':3128
'94.##.140.106':3128
'11#.#02.64.30':3128
'59.##.144.201':3128
'18#.#.253.99':3128
'18#.#53.221.4':3128
'12#.#65.39.15':3128
'11#.#41.157.225':3128
'46.##8.45.111':3128
'18#.#.195.118':3128
'18#.#.144.113':3128
'20#.#71.184.40':3128
'11#.#6.111.162':3128
'31.##.245.116':3128
'11#.#18.238.203':3128
'17#.#72.191.50':3128
'41.##7.98.191':3128
'91.##0.136.114':3128
'80.#7.88.67':3128
'59.##.112.110':3128
'12#.#3.68.10':3128
'18#.#.116.160':3128
'18#.#14.53.84':3128
'46.##2.69.61':3128
'41.##7.248.212':3128
'46.##9.5.193':3128
'85.##.182.12':3128
'11#.#4.204.182':3128
'77.##.184.157':3128
'41.##0.144.6':3128
'39.##9.208.243':3128
'20#.#59.19.196':3128
'18#.#91.240.91':3128
'12#.#38.180.28':3128
'18#.#2.139.222':3128
'11#.#41.35.46':3128
'59.##.191.137':3128
'21#.#19.100.149':3128
'49.##8.246.162':3128
'1.##.157.5':3128
'19#.#2.13.230':3128
'18#.#.152.188':3128
'17#.#2.128.122':3128
'17#.#15.206.198':3128
'89.##6.102.235':3128
'27.##5.23.42':3128
'41.##1.81.175':3128
'17#.#22.81.11':3128
'93.##3.85.250':3128
'81.#0.0.18':3128
'21#.#86.183.4':3128
'11#.#12.47.2':3128
'31.##.11.176':3128
'11#.#54.20.221':3128
'41.##5.128.33':3128
'11#.#54.186.74':3128
'46.##7.167.236':3128
'49.##0.53.100':3128
'17#.#49.18.198':3128
'42.##1.177.91':3128
'27.##6.82.199':3128
'12#.#45.170.114':3128
'22#.#34.206.77':3128
'11#.#54.122.116':3128
'11#.#8.2.234':3128
'10#.#7.81.35':3128
'88.##.250.151':3128
'80.##1.211.253':3128
'12#.#65.35.217':3128
'94.##6.157.30':3128
'79.##5.138.210':3128
'87.##1.19.76':3128
'79.##4.74.49':3128
'11#.#98.224.240':3128
'46.##8.59.178':3128
'39.##9.183.194':3128
'1.##.231.0':3128
'18#.8.5.230':3128
'17#.#25.253.245':3128
'12#.#65.12.242':3128
'95.##1.186.246':3128
'12#.#25.191.202':3128
'11#.#01.180.11':3128
'11#.#8.27.189':3128
'20#.#3.44.133':3128
'18#.8.13.53':3128
'12#.#94.185.92':3128
'95.#9.9.50':3128
'46.##3.144.152':3128
'95.##1.151.88':3128
'18#.#7.86.103':3128
'46.##3.46.208':3128
'17#.#22.182.220':3128
'27.##.194.124':3128
'41.##1.61.18':3128
'46.##7.134.227':3128
'95.#1.45.44':3128
'41.##.224.27':3128
'20#.#05.31.103':3128
'41.#0.72.11':3128
'18#.#.177.55':3128
'89.##6.76.103':3128
'12#.#8.25.65':3128
'18#.#.190.166':3128
'85.##.172.102':3128
'22#.#4.50.193':3128
'49.##8.162.231':3128
'41.##.215.14':3128
'11#.#9.35.116':3128
'86.##8.16.154':3128
'95.#9.2.230':3128
'81.#0.0.17':3128
'79.##4.179.110':3128
'41.##1.77.228':3128
'12#.#37.53.158':3128
'93.#5.6.116':3128
'61.##.254.212':3128
'49.##2.94.245':3128
'59.##.188.92':3128
'95.#9.44.15':3128
'41.#51.0.29':3128
'11#.#05.151.247':3128
'59.##5.112.202':3128
'11#.#10.232.221':3128
'92.##.151.167':3128
'95.##.34.142':3128
'82.##8.52.224':3128
'11#.#00.36.145':3128
'92.##.155.198':3128
'95.#9.9.95':3128
'41.##1.65.51':3128
'41.##.222.141':3128
'46.##9.53.153':3128
'11#.#01.88.1':3128
'17#.#22.22.89':3128
'12#.#36.100.207':3128
'11#.#2.128.207':3128
'95.##0.18.162':3128
'2.###.182.12':3128
'18#.#78.173.8':3128
'92.#0.50.48':3128
'22#.#2.80.14':3128
'20#.#9.136.120':3128
'85.##5.168.32':3128
'79.#78.14.1':3128
'17#.#9.170.50':3128
'17#.#22.49.23':3128
'86.##3.31.54':3128
'95.##.215.240':3128
'95.##.14.200':3128
'95.##.242.174':3128
'18#.#92.159.199':3128
'11#.#01.52.133':3128
'49.##.195.135':3128
'92.##.173.122':3128
'11#.#04.163.236':3128
'41.##3.223.125':3128
'12#.#8.45.214':3128
'17#.#22.225.10':3128
'85.##.172.133':3128
'93.##2.11.182':3128
'11#.#2.136.48':3128
'11#.#98.130.53':3128
'92.##.128.105':3128
'41.##1.251.106':3128
'17#.#25.200.10':3128
'11#.#32.251.17':3128
'41.##.163.87':3128
'10#.#29.172.141':3128
'18#.#15.206.196':3128
'19#.#62.70.69':3128
'11#.#12.64.227':3128
'89.##6.70.55':3128
'93.#4.58.59':3128
'61.##3.224.72':3128
'14.##5.111.86':3128
'11#.#42.80.135':3128
'10#.#62.90.151':3128
'11#.#54.184.108':3128
'11#.#52.211.189':3128
'17#.#50.220.119':3128
'95.##.197.16':3128
'39.##5.10.116':3128
'39.##3.166.178':3128
'18#.#46.239.135':3128
'18#.#.178.112':3128
'18#.#.172.191':3128
'46.##3.120.214':3128
'11#.#8.49.126':3128
'60.##3.77.237':3128
'11#.#10.1.73':3128
'76.##9.224.82':3128
'46.##3.122.236':3128
'18#.88.99.9':3128
'39.##0.38.52':3128
'82.##9.165.28':3128
'11#.#98.149.121':3128
'22#.#41.41.207':3128
'12#.#45.163.41':3128
'18#.#24.23.241':3128
'18#.#1.26.236':3128
'11#.#42.12.203':3128
'18#.#29.139.212':3128
'46.##2.136.58':3128
'86.##2.85.62':3128
'17#.#20.202.85':3128
'92.#7.89.24':3128
'41.##.121.109':3128
'58.##4.33.166':3128
'59.##1.177.179':3128
'88.##7.47.168':3128
'93.##.168.162':3128
'49.##8.45.216':3128
'12#.#65.133.225':3128
'46.##8.156.24':3128
'17#.#25.216.134':3128
'41.##3.70.135':3128
'27.##.237.107':3128
'49.##1.152.39':3128
'27.##.209.46':3128
'31.##4.132.4':3128
'41.##2.126.203':3128
'19#.#1.127.97':3128
'11#.#98.33.59':3128
'18#.#91.137.227':3128
'78.##.24.183':3128
'17#.#06.57.162':3128
'95.#1.5.190':3128
'11#.#02.92.65':3128
'95.##2.76.35':3128
'46.##8.38.37':3128
'95.##.240.78':3128
'41.#2.37.69':3128
'11#.#97.65.248':3128
'11#.#01.102.163':3128
'68.##.222.177':3128
'27.#.64.21':3128
'95.##.60.232':3128
'10#.#6.137.31':3128
'39.##1.190.122':3128
'11#.#04.237.85':3128
'18#.#58.229.170':3128
'81.#5.41.2':3128
'20#.#08.97.129':3128
'20#.#6.17.30':3128
'12#.#.183.193':3128
'11#.#8.4.239':3128
'41.##.152.171':3128
'21#.76.23.8':3128
'49.##2.164.204':3128
'59.##.218.193':3128
'49.##1.36.195':3128
'59.##.213.166':3128
'89.##6.67.170':3128
'92.##.170.198':3128
'17#.#22.191.85':3128
'46.##7.253.247':3128
'12#.#73.65.144':3128
'95.##1.228.46':3128
'84.#4.75.4':3128
'11#.#10.206.75':3128
'39.##1.61.88':3128
'95.##.60.199':3128
'41.##2.133.161':3128
'18#.#13.138.85':3128
'11#.#1.186.41':3128
'18#.#.63.215':3128
'19#.#13.93.102':3128
'11#.#02.39.47':3128
'49.##1.61.106':3128
'95.##1.190.17':3128
'78.##.48.127':3128
'93.##6.239.231':3128
'17#.#0.132.1':3128
'localhost':7703
'46.##1.228.217':3128
'10#.#42.157.225':3128
'94.##3.115.185':3128
'11#.#54.181.207':3128
'11#.#54.22.91':3128
'41.##2.205.43':3128
'77.##.220.38':3128
'21#.#30.102.24':3128
'12#.#65.25.59':3128
'77.##5.6.118':3128
'31.##4.200.21':3128
'93.##0.195.30':3128
'94.##3.172.65':3128
'59.##1.123.248':3128
'59.##.248.208':3128
'17#.#22.248.4':3128
'95.#1.39.74':3128
'11#.#03.160.111':3128
'85.##2.62.74':3128
'91.##3.234.203':3128
'49.##.98.248':3128
'39.##5.93.15':3128
'95.#1.41.24':3128
'49.##2.91.18':3128
'67.##2.68.59':3128
'83.##8.82.159':3128
'11#.#8.161.59':3128
'41.#2.163.7':3128
'58.##7.37.200':3128
'27.##7.163.253':3128
'12#.#01.165.139':3128
'92.##.176.210':3128
'17#.#22.90.207':3128
'41.##1.234.203':3128
'22#.#91.11.144':3128
'46.##.24.147':3128
'12#.#58.146.214':3128
'12#.#8.33.144':3128
'89.##3.98.138':3128
'19#.#8.107.124':3128
'42.##1.170.43':3128
'82.##8.19.81':3128
'49.##2.131.204':3128
'49.##6.226.254':3128
'16#.9.22.72':3128
'39.#11.26.4':3128
'12#.#0.186.3':3128
'19#.#5.159.202':3128
'46.##3.58.162':3128
'95.##1.231.62':3128
'11#.#41.28.239':3128
'18#.#20.157.29':3128
'77.##1.186.127':3128
'21#.#67.195.98':3128
'11#.#07.84.169':3128
'21#.#27.249.58':3128
'11#.88.1.64':3128
'11#.#43.227.242':3128
'46.##3.60.67':3128
'27.##5.12.60':3128
'12#.#45.112.227':3128
'93.##0.219.221':3128
'94.##.56.138':3128
'20#.#71.243.106':3128
'19#.#98.102.213':3128
'17#.#1.107.133':3128
'18#.#.122.169':3128
'58.#.10.89':3128
'93.##7.183.205':3128
'18#.#6.88.171':3128
'11#.#0.73.130':3128
'11#.#40.223.217':3128
'41.##1.253.103':3128
'59.##3.212.13':3128
'11#.#07.220.48':3128
'46.##7.137.114':3128
'95.##1.163.105':3128
'95.##1.65.242':3128
'49.##8.231.65':3128
'92.##.181.233':3128
'11#.#10.167.60':3128
'11#.#5.90.116':3128
'18#.#73.132.98':3128
'21#.#6.216.242':3128
'18#.#3.175.173':3128
'94.##6.150.167':3128
'12#.0.54.42':3128
'79.##8.218.135':3128
'22#.#83.254.137':3128
'89.##3.36.103':3128
'2.##2.34.47':3128
'19#.#4.152.98':3128
'49.##1.120.108':3128
'27.##.187.19':3128
'19#.#07.204.94':3128
'14.##.117.207':3128
'27.##7.16.79':3128
'78.##7.24.89':3128
'17#.#9.38.166':3128
'19#.#55.211.81':3128
'18#.0.15.33':3128
'86.#7.74.44':3128
'92.##.150.99':3128
'95.##.190.156':3128
'49.##.110.123':3128
'49.##.86.165':3128
'11#.#5.133.232':3128
'18#.#4.118.177':3128
'27.##7.217.100':3128
'11#.#54.42.3':3128
'11#.#54.35.135':3128
'10#.#29.47.34':3128
'27.##.108.156':3128
'61.##4.82.199':3128
'20#.#64.57.10':3128
'60.##9.107.243':3128
'27.#7.115.8':3128
'11#.#54.47.195':3128
'39.##0.210.214':3128
'95.#7.15.31':3128
'89.##6.105.214':3128
'18#.#.200.250':3128
'17#.#24.9.153':3128
'11#.#03.246.60':3128
'19#.#2.242.199':3128
'18#.#.129.24':3128
'59.#8.10.52':3128
'12#.#22.41.111':3128
'11#.#10.102.230':3128
'59.##.157.48':3128
'89.##5.244.229':3128
'95.##.205.10':3128
'11#.#4.189.50':3128
'12#.#65.188.94':3128
'11#.#40.184.184':3128
'41.##8.141.22':3128
'95.##.76.215':3128
'49.##.111.192':3128
'41.##7.154.3':3128
'10#.#42.189.227':3128
'89.##6.105.180':3128
'18#.#.161.123':3128
'11#.#6.185.254':3128
'95.##.189.59':3128
'11#.#17.132.179':3128
'22#.#44.38.249':3128
'11#.#54.148.169':3128
'49.##6.124.143':3128
'19#.#29.104.80':3128
'92.##3.93.130':3128
'19#.#0.161.143':3128
'17#.#4.212.235':3128
'41.##1.86.12':3128
'12#.#45.35.144':3128
'11#.#03.56.169':3128
'95.##.69.171':3128
'19#.#07.204.220':3128
'27.##7.74.124':3128
'11#.#84.237.148':3128
'95.#9.72.75':3128
'94.##4.41.159':3128
'95.##.24.218':3128
'17#.#22.226.189':3128
'95.##.11.142':3128
'62.##5.73.118':3128
'21#.#19.47.106':3128
'91.##.200.195':3128
'11#.#5.83.171':3128
'95.##.235.126':3128
'49.##2.143.20':3128
'17#.#37.87.218':3128
'41.##.132.241':3128
'18#.#2.170.237':3128
'24.##.243.93':3128
'18#.#6.149.51':3128
'81.##.253.164':3128
'81.##.184.190':3128
'92.#6.10.39':3128
'41.##6.155.220':3128
'46.##4.243.37':3128
'39.##3.38.247':3128
'93.##0.208.238':3128
'95.##1.195.26':3128
'18#.#12.138.56':3128
'95.##1.183.67':3128
'92.##.90.196':3128
'11#.#01.59.244':3128
'77.##5.0.235':3128
'18#.#.226.167':3128
'77.##1.241.91':3128
'18#.#88.238.225':3128
'11#.#06.176.96':3128
'46.##7.252.162':3128
'2.###.236.57':3128
'88.##5.130.65':3128
'18#.#20.31.228':3128
'89.##5.181.251':3128
'12#.#23.149.199':3128
'95.##.206.57':3128
'95.##.70.109':3128
'62.##8.214.33':3128
'12#.#3.226.179':3128
'93.##4.148.101':3128
'59.##.240.134':3128
'46.#8.55.94':3128
'46.##3.88.81':3128
'11#.#13.35.210':3128
'11#.#2.145.23':3128
'18#.#2.132.170':3128
'95.##.90.111':3128
'60.#.145.171':3128
'11#.#05.37.241':3128
'49.#5.96.65':3128
'95.##2.54.134':3128
'18#.#07.153.58':3128
'82.##2.103.247':3128
'81.##.164.231':3128
'10#.#08.63.205':3128
'79.##8.237.132':3128
'81.##7.8.192':3128
'10#.#62.27.205':3128
'17#.#21.100.97':3128
'84.##.102.72':3128
'91.##.164.48':3128
'20#.#4.215.9':3128
'10#.#39.6.192':3128
'94.##3.196.63':3128
'89.##.255.65':3128
'89.##7.123.176':3128
'49.##1.38.83':3128
'22#.#86.46.78':3128
'92.##.23.163':3128
'39.##9.131.83':3128
'10#.#62.134.185':3128
'46.##7.145.146':3128
'91.##3.253.129':3128
'17#.#23.217.145':3128
'12#.#65.22.161':3128
'46.##9.4.203':3128
'94.##1.74.143':3128
'17#.#25.136.176':3128
'12#.#8.99.223':3128
'1.##.71.127':3128
'88.##5.25.250':3128
'21#.#16.126.18':3128
'46.##7.196.120':3128
'58.##9.167.7':3128
'41.##.153.11':3128
'18#.#12.160.198':3128
'92.##.185.62':3128
'17#.#22.45.223':3128
'41.#3.14.81':3128
'78.##.77.186':3128
'17#.#23.49.147':3128
'11#.#03.136.109':3128
'59.##.185.93':3128
'18#.8.92.6':3128
'87.##2.245.77':3128
'11#.#70.15.239':3128
'94.##3.125.38':3128
'49.##6.144.101':3128
'19#.#34.97.105':3128
'17#.#25.242.9':3128
'41.##2.133.209':3128
'58.##3.125.236':3128
'95.#7.13.40':3128
'17#.#0.30.57':3128
'11#.#54.116.17':3128
'18#.#3.112.93':3128
'11#.#02.70.9':3128
'12#.#36.235.109':3128
'11#.#54.124.72':3128
'10#.#7.95.183':3128
'46.##7.140.242':3128
'41.#42.46.3':3128
'27.##7.172.89':3128
'11#.#54.134.161':3128
'17#.#06.57.75':3128
'92.#6.65.97':3128

UDP:

DNS ASK h.###aldomain

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней