Trojan.DownLoader10.3254

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf6ba.dir00\svchost.exe.mdmp 16325836412032636

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf6ba.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.47.1.88':445
'21#.#7.63.75':445
'21#.#7.228.136':445
'21#.#7.244.117':445
'21#.#7.242.131':445
'21#.#7.220.78':445
'21#.#7.242.63':445
'21#.#7.241.241':445
'21#.#7.243.84':445
'21#.#7.175.31':445
'21#.#7.113.110':445
'21#.#7.55.78':445
'21#.#7.144.121':445
'21#.#7.67.144':445
'21#.#7.161.224':445
'21#.#7.158.32':445
'21#.#7.210.124':445
'21#.#7.3.157':445
'21#.#7.228.179':445
'21#.#7.211.176':445
'21#.#7.167.22':445
'21#.#7.142.110':445
'21#.#7.136.47':445
'21#.#7.22.244':445
'21#.#7.158.14':445
'21#.#7.25.158':445
'21#.#7.12.33':445
'21#.#7.26.166':445
'21#.#7.63.29':445
'21#.#7.77.41':445
'21#.#7.92.93':445
'21#.#7.202.118':445
'21#.#7.54.46':445
'21#.#7.136.47':139
'21#.#7.22.244':139
'21#.#7.210.124':139
'21#.#7.3.157':139
'21#.#7.18.203':139
'21#.#7.135.208':139
'21#.#7.167.22':139
'21#.#7.142.110':139
'21#.#7.92.93':139
'21#.#7.202.118':139
'21#.#7.158.14':139
'21#.#7.25.158':139
'21#.#7.228.179':139
'21#.#7.211.176':139
'21#.#7.63.29':139
'21#.#7.77.41':139
'21#.#7.224.192':139
'21#.#7.32.87':139
'21#.#7.27.35':139
'21#.#7.64.27':139
'21#.#7.224.200':445
'21#.#7.37.121':445
'21#.#7.48.104':139
'21#.#7.241.110':445
'21#.#7.54.198':139
'21#.#7.206.232':139
'21#.#7.12.36':139
'21#.#7.198.87':139
'21#.#7.104.230':139
'21#.#7.34.102':139
'21#.#7.47.80':139
'21#.#7.110.105':139
'21#.#7.18.203':445
'21#.#7.45.241':139
'21#.#7.198.92':139
'21#.#7.140.247':139
'21#.#7.122.13':139
'21#.#7.82.91':139
'21#.#7.249.186':139
'21#.#7.239.63':139
'21#.#7.91.239':139
'21#.#7.76.176':139
'21#.#7.148.25':139
'21#.#7.17.211':139
'21#.#7.176.87':139
'21#.#7.115.89':139
'21#.#7.155.229':139
'21#.#7.43.145':139
'21#.#7.118.115':139
'21#.#7.34.170':139
'21#.#7.17.208':139
'21#.47.90.5':139
'21#.#7.98.90':139
'21#.#7.233.13':139
'21#.#7.154.153':139
'21#.#7.245.182':139
'21#.#7.50.237':139
'21#.47.1.31':139
'21#.#7.109.101':139
'21#.#7.105.232':139
'21#.#7.25.32':139
'21#.#7.91.58':139
'21#.#7.205.253':139
'21#.#7.91.14':139
'21#.#7.100.91':139
'21#.#7.198.65':139
'21#.#7.64.27':445
'21#.#7.224.192':445
'21#.#7.34.102':445
'21#.#7.27.35':445
'21#.#7.139.148':139
'21#.#7.16.212':139
'21#.#7.32.87':445
'21#.#7.48.104':445
'21#.#7.198.87':445
'21#.#7.54.198':445
'21#.#7.135.208':445
'21#.#7.12.36':445
'21#.#7.110.105':445
'21#.#7.104.230':445
'21#.#7.206.232':445
'21#.#7.47.80':445
'21#.#7.86.170':139
'21#.#7.249.44':139
'21#.47.7.63':139
'21#.47.32.7':139
'21#.47.8.94':139
'21#.47.66.8':139
'21#.#7.78.138':139
'21#.#7.94.102':139
'21#.#7.79.234':139
'21#.#7.34.80':139
'21#.#7.66.175':139
'21#.#7.42.173':139
'21#.#7.194.187':139
'21#.#7.63.141':139
'21#.#7.94.203':139
'21#.#7.55.198':139
'21#.#7.248.52':139
'21#.#7.248.32':139
'21#.#7.208.186':139
'21#.#7.225.224':139
'21#.#7.176.232':139
'21#.#7.199.220':139
'21#.#7.200.178':139
'21#.#7.226.148':139
'21#.#7.218.40':139
'21#.#7.61.215':139
'21#.#7.27.21':139
'21#.#7.214.144':139
'21#.#7.147.111':139
'21#.#7.38.137':139
'21#.#7.100.62':139
'21#.#7.183.58':139
'21#.#7.198.207':445
'21#.#7.38.152':445
'21#.#7.166.233':445
'21#.#7.173.167':445
'21#.#7.19.220':445
'21#.#7.20.80':445
'21#.#7.72.175':445
'21#.#7.82.165':445
'21#.#7.16.109':445
'21#.#7.70.99':445
'21#.#7.170.137':139
'21#.#7.217.170':139
'21#.#7.213.196':445
'21#.#7.233.213':445
'21#.#7.215.133':445
'21#.#7.197.69':445
'21#.#7.32.77':139
'21#.#7.72.175':139
'21#.#7.19.220':139
'21#.#7.198.207':139
'21#.#7.38.152':139
'21#.#7.94.135':139
'21#.#7.58.91':139
'21#.#7.82.165':139
'21#.#7.20.80':139
'21#.#7.215.133':139
'21#.#7.213.196':139
'21#.#7.70.99':139
'21#.#7.16.109':139
'21#.#7.166.233':139
'21#.#7.173.167':139
'21#.#7.197.69':139
'21#.#7.233.213':139
'21#.#7.50.171':139
'21#.#7.108.207':139
'21#.#7.84.57':139
'21#.#7.200.83':139
'21#.47.8.17':139
'21#.#7.65.114':139
'21#.#7.65.109':139
'21#.#7.91.179':139
'21#.#7.69.37':139
'21#.#7.170.224':139
'21#.47.41.1':139
'21#.#7.215.140':139
'21#.#7.124.20':139
'21#.#7.57.207':139
'21#.#7.175.211':139
'21#.#7.33.240':139
'21#.#7.94.135':445
'21#.#7.241.110':139
'21#.#7.224.200':139
'21#.#7.94.135':9988
'21#.#7.16.109':9988
'21#.#7.113.110':139
'21#.#7.55.78':139
'21#.#7.37.121':139
'21#.#7.54.46':139
'21#.#7.217.170':445
'21#.#7.170.224':9988
'21#.#7.199.220':445
'21#.#7.170.137':445
'21#.#7.217.170':9988
'21#.#7.200.83':9988
'21#.#7.233.213':9988
'21#.#7.32.77':9988
'21#.#7.242.63':139
'21#.#7.241.241':139
'21#.47.1.88':139
'21#.#7.63.75':139
'21#.#7.12.33':139
'21#.#7.26.166':139
'21#.#7.242.131':139
'21#.#7.220.78':139
'21#.#7.161.224':139
'21#.#7.158.32':139
'21#.#7.243.84':139
'21#.#7.175.31':139
'21#.#7.228.136':139
'21#.#7.244.117':139
'21#.#7.144.121':139
'21#.#7.67.144':139
'21#.#7.176.232':445
'21#.#7.200.83':445
'21#.#7.50.171':445
'21#.#7.57.207':445
'21#.#7.84.57':445
'21#.#7.91.179':445
'21#.47.8.17':445
'21#.#7.108.207':445
'21#.#7.65.109':445
'21#.#7.215.140':445
'21#.#7.69.37':445
'21#.#7.58.91':445
'21#.47.41.1':445
'21#.#7.33.240':445
'21#.#7.124.20':445
'21#.#7.170.224':445
'21#.#7.175.211':445
'21#.#7.208.186':445
'21#.#7.225.224':445
'21#.#7.147.111':445
'21#.#7.38.137':445
'21#.#7.200.178':445
'21#.#7.226.148':445
'21#.#7.248.52':445
'21#.#7.248.32':445
'21#.#7.27.21':445
'21#.#7.214.144':445
'21#.#7.65.114':445
'21#.#7.32.77':445
'21#.#7.100.62':445
'21#.#7.183.58':445
'21#.#7.218.40':445
'21#.#7.61.215':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней