Trojan.DownLoader12.29220

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERb3a0.dir00\svchost.exe.mdmp 16325836412032148

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERb3a0.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14.##.246.66':445
'14.##.85.242':445
'14.##.200.17':445
'14.##.191.200':445
'14.##.227.172':445
'14.#2.53.15':445
'14.#2.114.0':445
'14.##.23.227':445
'14.##.60.210':445
'14.##.220.69':139
'14.##.31.153':139
'14.##.116.61':139
'14.#2.3.90':139
'14.##.160.220':139
'14.#2.59.32':445
'14.#2.25.98':445
'14.#2.5.161':139
'14.##.29.151':139
'14.#2.43.16':445
'14.##.116.61':445
'14.##.152.254':445
'14.#2.40.23':445
'14.#2.3.90':445
'14.##.160.220':445
'14.#2.5.161':445
'14.##.220.69':445
'14.##.31.153':445
'14.#2.12.24':445
'14.##.33.223':445
'14.##.123.98':445
'14.##.116.102':445
'14.#2.60.43':445
'14.##.42.229':445
'14.#2.86.55':445
'14.##.198.59':445
'14.##.57.119':445
'14.#2.43.16':139
'14.##.28.211':445
'14.##.125.118':445
'14.#2.80.6':445
'14.##.232.79':445
'14.##.31.114':445
'14.##.200.17':139
'14.##.191.200':139
'14.#2.59.32':139
'14.#2.25.98':139
'14.#2.84.42':445
'14.#2.8.239':445
'14.#2.41.57':445
'14.##.113.112':445
'14.##.240.197':445
'14.##.208.49':445
'14.##.63.139':445
'14.##.214.240':445
'14.#2.97.0':445
'14.#2.60.43':139
'14.##.198.59':139
'14.#2.12.24':139
'14.##.33.223':139
'14.##.57.119':139
'14.##.152.254':139
'14.#2.40.23':139
'14.##.42.229':139
'14.#2.86.55':139
'14.##.227.172':139
'14.##.23.227':139
'14.##.246.66':139
'14.##.85.242':139
'14.##.60.210':139
'14.##.123.98':139
'14.##.116.102':139
'14.#2.53.15':139
'14.#2.114.0':139
'14.##.23.103':139
'14.##.69.126':139
'14.##.104.60':139
'14.##.82.175':139
'14.#2.53.68':139
'14.##.105.223':139
'14.##.107.12':139
'14.##.200.234':139
'14.##.43.122':139
'14.##.42.111':445
'14.##.205.207':445
'14.##.92.158':445
'14.##.103.98':445
'14.##.232.249':445
'14.##.197.53':139
'14.##.18.165':139
'14.#2.20.61':445
'14.##.108.76':139
'14.##.159.201':139
'14.#2.4.112':139
'14.##.232.29':139
'14.##.169.30':139
'14.##.126.231':139
'14.##.211.64':139
'14.##.211.211':139
'14.##.103.94':139
'14.##.65.151':139
'14.##.112.146':139
'14.##.125.112':139
'14.##.50.179':139
'14.##.146.51':139
'14.##.124.18':139
'14.##.201.217':139
'14.##.29.202':139
'14.#2.3.179':139
'14.##.217.208':139
'14.##.12.207':445
'14.#2.1.185':139
'14.##.233.115':139
'14.##.161.146':139
'14.##.188.161':139
'14.##.189.232':139
'14.##.92.158':139
'14.##.103.98':139
'14.#2.77.7':139
'14.##.12.207':139
'14.#2.23.80':139
'14.##.207.78':139
'14.##.29.151':445
'14.##.124.12':139
'14.#2.33.83':139
'14.##.141.137':139
'14.##.131.25':139
'14.##.138.86':139
'14.##.251.137':139
'14.##.131.25':445
'14.##.161.146':445
'14.##.251.137':445
'14.##.141.137':445
'14.##.188.161':445
'14.##.189.232':445
'14.#2.77.7':445
'14.#2.1.185':445
'14.##.233.115':445
'14.##.232.249':139
'14.#2.20.61':139
'14.##.42.111':139
'14.##.205.207':139
'14.##.124.12':445
'14.#2.33.83':445
'14.##.138.86':445
'14.#2.23.80':445
'14.##.207.78':445
'14.#2.60.1':139
'14.##.230.199':139
'14.##.208.248':139
'14.##.99.208':139
'14.#2.42.82':139
'14.##.144.122':445
'14.##.61.177':445
'14.##.49.160':445
'14.##.208.129':445
'14.##.101.227':139
'14.##.214.115':139
'14.##.11.199':139
'14.##.20.156':139
'14.##.111.72':139
'14.##.16.219':139
'14.#2.89.22':139
'14.##.241.39':139
'14.##.254.213':139
'14.#2.38.65':445
'14.#2.83.27':445
'14.#2.80.26':445
'14.##.194.24':445
'14.##.62.112':445
'14.#2.198.2':445
'14.##.191.250':445
'14.#2.5.138':445
'14.#2.82.84':445
'14.##.78.164':445
'14.#2.41.96':445
'14.#2.55.36':445
'14.#2.229.3':445
'14.#2.2.172':445
'14.##.38.106':445
'14.##.125.38':445
'14.##.110.53':445
'14.#2.78.98':445
'14.##.122.179':139
'14.##.38.106':139
'14.##.125.38':139
'14.##.110.53':139
'14.#2.78.98':139
'14.#2.80.26':139
'14.#2.83.27':139
'14.##.62.112':139
'14.##.194.24':139
'14.#2.38.65':139
'14.##.208.129':139
'14.##.144.122':139
'14.##.61.177':139
'14.##.49.160':139
'14.#2.55.36':139
'14.##.78.164':139
'14.#2.2.172':139
'14.#2.229.3':139
'14.#2.41.96':139
'14.##.154.113':139
'14.##.231.153':139
'14.##.189.239':139
'14.##.111.122':139
'14.##.153.18':139
'14.##.11.223':139
'14.##.137.148':139
'14.#2.6.65':139
'14.##.97.162':139
'14.#2.198.2':139
'14.##.191.250':139
'14.#2.5.138':139
'14.#2.82.84':139
'14.##.243.184':139
'14.##.15.124':139
'14.##.239.44':139
'14.##.124.52':139
'14.##.19.206':139
'14.##.54.155':139
'14.##.180.54':139
'14.##.102.86':139
'14.##.155.101':139
'14.##.152.180':139
'14.##.113.112':139
'14.#2.84.42':139
'14.#2.34.17':139
'14.#2.41.57':139
'14.##.122.179':9988
'14.##.11.199':9988
'14.##.11.223':9988
'14.##.137.148':9988
'14.##.214.115':9988
'14.##.241.39':9988
'14.#2.89.62':139
'14.##.20.156':9988
'14.##.111.72':9988
'14.#2.89.62':445
'14.##.102.86':445
'14.##.125.118':139
'14.##.31.114':139
'14.##.155.101':445
'14.##.152.180':445
'14.#2.34.17':445
'14.##.54.155':445
'14.##.180.54':445
'14.##.214.240':139
'14.#2.97.0':139
'14.#2.8.239':139
'14.##.240.197':139
'14.##.208.49':139
'14.##.232.79':139
'14.##.28.211':139
'14.##.63.139':139
'14.#2.80.6':139
'14.##.97.162':9988
'14.##.97.162':445
'14.##.11.223':445
'14.##.153.18':445
'14.#2.6.65':445
'14.##.137.148':445
'14.##.20.156':445
'14.##.101.227':445
'14.##.122.179':445
'14.##.11.199':445
'14.##.19.206':445
'14.##.15.124':445
'14.##.243.184':445
'14.##.124.52':445
'14.##.239.44':445
'14.##.154.113':445
'14.##.231.153':445
'14.##.189.239':445
'14.##.111.122':445
'14.##.208.129':9988
'14.##.62.112':9988
'14.##.230.199':445
'14.#2.42.82':445
'14.##.19.206':9988
'14.##.189.239':9988
'14.##.111.122':9988
'14.##.15.124':9988
'14.##.239.44':9988
'14.##.241.39':445
'14.##.254.213':445
'14.##.214.115':445
'14.##.111.72':445
'14.##.16.219':445
'14.##.99.208':445
'14.#2.60.1':445
'14.#2.89.22':445
'14.##.208.248':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней