Trojan.DownLoader10.3259

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERf82d.dir00\svchost.exe.mdmp 16325836412032108

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf82d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'67.##3.49.177':139
'67.##3.207.167':445
'67.##3.207.120':139
'67.##3.168.174':139
'67.##3.166.246':445
'67.##3.43.119':445
'67.##3.207.120':445
'67.##3.169.151':445
'67.##3.151.199':445
'67.##3.43.119':139
'67.##3.238.157':445
'67.##3.166.129':445
'67.##3.211.252':445
'67.#43.86.9':445
'67.##3.36.82':445
'67.##3.169.151':139
'67.##3.151.199':139
'67.##3.207.167':139
'67.##3.166.246':139
'67.##3.78.60':139
'67.##3.226.77':139
'67.##3.82.120':139
'67.##3.12.64':139
'67.##3.230.239':139
'67.##3.65.219':139
'67.##3.114.38':139
'67.#43.36.0':139
'67.##3.27.110':139
'67.##3.188.245':139
'67.##3.229.182':139
'67.##3.21.244':139
'67.##3.168.174':445
'67.##3.49.177':445
'67.##3.229.98':139
'67.##3.113.120':139
'67.##3.246.61':139
'67.##3.69.225':139
'67.##3.7.188':139
'67.##3.209.43':445
'67.##3.181.55':445
'67.##3.243.217':445
'67.##3.73.186':445
'67.##3.88.143':445
'67.##3.36.84':445
'67.##3.205.180':445
'67.##3.31.88':445
'67.##3.255.197':445
'67.##3.97.130':445
'67.##3.200.110':445
'67.##3.23.136':445
'67.##3.194.81':445
'67.##3.93.222':445
'67.##3.117.100':445
'67.##3.211.52':445
'67.##3.48.210':445
'67.##3.120.105':445
'67.##3.26.219':445
'67.##3.163.46':445
'67.##3.87.249':445
'67.##3.202.212':445
'67.##3.125.112':445
'67.##3.90.88':445
'67.##3.176.173':445
'67.##3.45.15':445
'67.##3.249.131':445
'67.##3.6.118':445
'67.##3.83.58':445
'67.##3.122.168':445
'67.##3.57.184':445
'67.##3.223.71':445
'67.##3.143.168':445
'67.##3.127.203':445
'67.##3.15.80':445
'67.##3.54.154':445
'67.##3.179.146':445
'67.##3.50.16':445
'67.##3.128.113':139
'67.##3.45.121':445
'67.##3.59.219':445
'67.##3.177.185':445
'67.##3.163.189':445
'67.##3.215.192':445
'67.##3.123.220':445
'67.##3.18.177':445
'67.##3.65.215':445
'67.##3.103.89':445
'67.##3.219.240':445
'67.##3.114.38':445
'67.##3.65.219':445
'67.#43.36.0':445
'67.##3.27.110':445
'67.##3.128.113':445
'67.##3.157.178':445
'67.##3.121.222':445
'67.##3.222.219':445
'67.##3.120.225':445
'67.##3.28.65':139
'67.##3.45.141':139
'67.##3.203.39':445
'67.##3.17.203':139
'67.##3.151.233':139
'67.##3.166.189':139
'67.##3.84.35':139
'67.##3.165.238':139
'67.##3.169.243':139
'67.##3.39.145':445
'67.##3.48.154':445
'67.##3.87.183':445
'67.##3.154.48':445
'67.##3.60.124':445
'67.##3.64.99':445
'67.##3.215.197':445
'67.##3.144.199':445
'67.##3.86.71':445
'67.##3.59.120':445
'67.##3.123.220':139
'67.##3.60.124':139
'67.##3.65.215':139
'67.##3.103.89':139
'67.##3.18.177':139
'67.##3.87.183':139
'67.##3.64.99':139
'67.##3.48.154':139
'67.##3.154.48':139
'67.##3.215.192':139
'67.##3.219.240':139
'67.##3.121.222':139
'67.##3.59.219':139
'67.##3.157.178':139
'67.##3.222.219':139
'67.##3.163.189':139
'67.##3.45.121':139
'67.##3.120.225':139
'67.##3.177.185':139
'67.##3.246.61':445
'67.##3.188.245':445
'67.##3.7.188':445
'67.##3.113.120':445
'67.##3.82.120':445
'67.##3.226.77':445
'67.##3.230.239':445
'67.##3.12.64':445
'67.##3.78.60':445
'67.##3.69.225':445
'67.##3.215.197':139
'67.##3.144.199':139
'67.##3.86.71':139
'67.##3.59.120':139
'67.##3.39.145':139
'67.##3.21.244':445
'67.##3.229.98':445
'67.##3.203.39':139
'67.##3.229.182':445
'67.##3.36.82':139
'67.##3.212.30':139
'67.##3.8.214':445
'67.##3.91.233':139
'67.##3.102.65':139
'67.##3.14.53':445
'67.##3.112.229':445
'67.##3.128.13':445
'67.##3.214.77':445
'67.##3.58.89':445
'67.##3.233.68':139
'67.##3.49.229':139
'67.##3.164.51':139
'67.##3.203.8':139
'67.##3.229.21':139
'67.##3.78.69':139
'67.##3.255.145':139
'67.##3.108.150':139
'67.##3.105.200':139
'67.##3.91.241':139
'67.##3.36.169':445
'67.#43.7.89':445
'67.##3.121.82':445
'67.##3.238.152':445
'67.##3.20.223':445
'67.##3.118.225':445
'67.##3.62.74':445
'67.##3.223.113':445
'67.##3.134.113':445
'67.##3.82.94':445
'67.##3.54.241':445
'67.##3.184.54':445
'67.##3.168.239':445
'67.##3.241.116':445
'67.##3.104.153':445
'67.##3.94.207':445
'67.##3.207.17':445
'67.##3.31.94':445
'67.##3.166.192':445
'67.##3.166.192':139
'67.##3.207.17':139
'67.##3.104.153':139
'67.##3.31.94':139
'67.##3.94.207':139
'67.##3.238.152':139
'67.##3.36.169':139
'67.##3.82.94':139
'67.##3.121.82':139
'67.##3.184.54':139
'67.##3.8.214':139
'67.##3.58.89':139
'67.##3.14.53':139
'67.##3.214.77':139
'67.##3.112.229':139
'67.##3.241.116':139
'67.##3.54.241':139
'67.##3.168.239':139
'67.##3.128.13':139
'67.##3.231.219':139
'67.##3.45.45':139
'67.##3.34.10':139
'67.##3.65.228':139
'67.#43.67.2':139
'67.##3.116.41':139
'67.#43.1.95':139
'67.##3.7.230':139
'67.##3.16.179':139
'67.##3.86.201':139
'67.##3.20.223':139
'67.##3.134.113':139
'67.#43.7.89':139
'67.##3.223.113':139
'67.##3.118.225':139
'67.##3.19.139':139
'67.##3.61.19':139
'67.##3.62.74':139
'67.##3.82.64':139
'67.##3.19.139':445
'67.##3.255.197':139
'67.##3.36.84':139
'67.##3.88.143':139
'67.##3.31.88':139
'67.##3.205.180':139
'67.##3.122.168':139
'67.##3.57.184':139
'67.##3.223.71':139
'67.##3.143.168':139
'67.##3.181.55':139
'67.##3.26.219':139
'67.##3.211.52':139
'67.##3.117.100':139
'67.##3.120.105':139
'67.##3.48.210':139
'67.##3.73.186':139
'67.##3.209.43':139
'67.##3.97.130':139
'67.##3.243.217':139
'67.##3.6.118':139
'67.##3.176.173':139
'67.##3.90.88':139
'67.##3.249.131':139
'67.##3.45.15':139
'67.##3.238.157':139
'67.##3.166.129':139
'67.##3.211.252':139
'67.#43.86.9':139
'67.##3.87.249':139
'67.##3.50.16':139
'67.##3.15.80':139
'67.##3.127.203':139
'67.##3.179.146':139
'67.##3.54.154':139
'67.##3.125.112':139
'67.##3.163.46':139
'67.##3.83.58':139
'67.##3.202.212':139
'67.##3.203.8':445
'67.##3.229.21':445
'67.##3.116.41':445
'67.#43.1.95':445
'67.##3.49.229':445
'67.##3.78.69':445
'67.##3.91.233':445
'67.##3.164.51':445
'67.##3.91.241':445
'67.##3.16.179':445
'67.##3.34.10':445
'67.##3.86.201':445
'67.##3.82.64':445
'67.##3.61.19':445
'67.##3.65.228':445
'67.##3.7.230':445
'67.#43.67.2':445
'67.##3.45.45':445
'67.##3.231.219':445
'67.##3.203.8':9988
'67.##3.45.45':9988
'67.##3.134.113':9988
'67.##3.61.19':9988
'67.##3.91.233':9988
'67.##3.200.110':139
'67.##3.23.136':139
'67.##3.194.81':139
'67.##3.93.222':139
'67.##3.20.223':9988
'67.##3.105.200':445
'67.##3.255.145':445
'67.##3.212.30':445
'67.##3.108.150':445
'67.##3.102.65':445
'67.##3.184.54':9988
'67.##3.94.207':9988
'67.##3.233.68':445
'67.##3.14.53':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней