Trojan.DownLoader10.3509

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER729b.dir00\svchost.exe.mdmp 16325836412032800

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER729b.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'14#.#16.18.220':445
'14#.#16.179.239':445
'14#.#16.250.227':445
'14#.#16.154.251':445
'14#.#16.11.237':445
'14#.#16.144.55':445
'14#.#16.53.117':445
'14#.#16.37.126':445
'14#.#16.200.52':445
'14#.#16.247.163':445
'14#.#16.97.97':445
'14#.#16.190.31':445
'14#.#16.137.229':445
'14#.#16.227.137':445
'14#.#16.3.186':445
'14#.#16.229.144':445
'14#.#16.31.37':445
'14#.#16.184.238':445
'14#.#16.173.33':445
'14#.#16.75.228':445
'14#.#16.205.75':445
'14#.#16.233.221':445
'14#.#16.42.106':445
'14#.#16.243.172':445
'14#.#16.39.244':445
'14#.#16.217.15':445
'14#.#16.191.9':445
'14#.#16.60.190':445
'14#.#16.16.60':445
'14#.#16.220.118':445
'14#.#16.186.129':445
'14#.#16.10.153':445
'14#.#16.184.76':445
'14#.#16.97.44':445
'14#.#16.184.238':139
'14#.#16.173.33':139
'14#.#16.75.228':139
'14#.#16.205.75':139
'14#.#16.233.221':139
'14#.#16.42.106':139
'14#.#16.243.172':139
'14#.#16.39.244':139
'14#.#16.217.15':139
'14#.#16.191.9':139
'14#.#16.60.190':139
'14#.#16.16.60':139
'14#.#16.220.118':139
'14#.#16.186.129':139
'14#.#16.10.153':139
'14#.#16.184.76':139
'14#.#16.68.220':139
'14#.#16.35.138':139
'14#.#16.19.36':139
'14#.#16.1.207':139
'14#.#16.137.100':139
'14#.#16.158.169':139
'14#.#16.224.158':139
'14#.#16.190.12':139
'14#.#16.169.227':139
'14#.#16.86.214':139
'14#.#16.206.86':139
'14#.#16.220.83':139
'14#.#16.3.253':139
'14#.#16.54.38':139
'14#.#16.249.248':139
'14#.#16.95.153':139
'14#.#16.27.192':139
'14#.#16.68.220':445
'14#.#16.94.135':139
'14#.#16.236.138':139
'14#.#16.61.254':139
'14#.#16.187.160':139
'14#.#16.237.75':139
'14#.#16.119.254':139
'14#.#16.210.120':139
'14#.#16.22.89':139
'14#.#16.78.131':139
'14#.#16.2.75':139
'14#.#16.44.21':139
'14#.#16.213.168':139
'14#.#16.111.124':139
'14#.#16.49.112':139
'14#.#16.191.114':139
'14#.#16.123.197':139
'14#.#16.194.46':139
'14#.#16.88.3':139
'14#.#16.127.163':139
'14#.#16.180.181':139
'14#.#16.94.153':139
'14#.#16.239.142':139
'14#.#16.28.228':139
'14#.#16.20.5':139
'14#.#16.231.28':139
'14#.#16.50.21':139
'14#.#16.119.2':139
'14#.#16.140.98':139
'14#.#16.113.140':139
'14#.#16.163.190':139
'14#.#16.8.61':139
'14#.#16.11.43':139
'14#.#16.24.40':139
'14#.#16.99.253':139
'14#.#16.35.138':445
'14#.#16.19.36':445
'14#.#16.1.207':445
'14#.#16.137.100':445
'14#.#16.158.169':445
'14#.#16.224.158':445
'14#.#16.190.12':445
'14#.#16.169.227':445
'14#.#16.86.214':445
'14#.#16.206.86':445
'14#.#16.220.83':445
'14#.#16.3.253':445
'14#.#16.54.38':445
'14#.#16.249.248':445
'14#.#16.95.153':445
'14#.#16.27.192':445
'14#.#16.81.224':139
'14#.#16.122.215':139
'14#.#16.254.121':139
'14#.#16.81.48':139
'14#.#16.209.191':139
'14#.#16.20.149':139
'14#.#16.39.83':139
'14#.#16.7.254':139
'14#.#16.209.112':139
'14#.#16.6.33':139
'14#.#16.63.201':139
'14#.#16.85.170':139
'14#.#16.216.188':139
'14#.#16.228.166':139
'14#.#16.237.250':139
'14#.#16.99.63':139
'14#.#16.5.100':139
'14#.#16.31.37':139
'14#.#16.103.158':139
'14#.#16.63.154':139
'14#.#16.218.23':139
'14#.#16.59.34':139
'14#.#16.139.135':139
'14#.#16.77.139':139
'14#.#16.54.107':139
'14#.#16.179.36':139
'14#.#16.177.68':139
'14#.#16.180.106':139
'14#.#16.10.192':139
'14#.#16.217.10':139
'14#.#16.253.246':139
'14#.#16.30.69':139
'14#.#16.146.184':139
'14#.#16.246.223':139
'14#.#16.44.78':139
'14#.#16.21.5':445
'14#.#16.68.186':445
'14#.#16.51.158':445
'14#.#16.194.118':445
'14#.#16.82.100':445
'14#.#16.125.29':445
'14#.#16.81.121':445
'14#.#16.2.92':445
'14#.#16.49.55':445
'14#.#16.65.79':445
'14#.#16.191.239':445
'14#.#16.41.207':445
'14#.#16.36.108':445
'14#.#16.137.53':445
'14#.#16.87.11':445
'14#.#16.80.192':445
'14#.#16.32.149':139
'14#.#16.21.5':139
'14#.#16.68.186':139
'14#.#16.137.53':139
'14#.#16.194.118':139
'14#.#16.82.100':139
'14#.#16.125.29':139
'14#.#16.2.92':139
'14#.#16.81.121':139
'14#.#16.41.207':139
'14#.#16.49.55':139
'14#.#16.87.11':139
'14#.#16.191.239':139
'14#.#16.36.108':139
'14#.#16.51.158':139
'14#.#16.65.79':139
'14#.#16.80.192':139
'14#.#16.185.82':139
'14#.#16.72.15':139
'14#.#16.37.9':139
'14#.#16.138.162':139
'14#.#16.245.223':139
'14#.#16.140.119':139
'14#.#16.155.175':139
'14#.#16.189.157':139
'14#.#16.195.41':139
'14#.#16.52.148':139
'14#.#16.92.84':139
'14#.#16.10.213':139
'14#.#16.11.231':139
'14#.#16.162.108':139
'14#.#16.20.239':139
'14#.#16.147.98':139
'14#.#16.174.193':139
'14#.#16.185.82':445
'14#.#16.82.100':9988
'14#.#16.49.55':9988
'14#.#16.195.41':9988
'14#.#16.125.29':9988
'14#.#16.174.193':9988
'14#.#16.92.84':9988
'14#.#16.80.192':9988
'14#.#16.147.98':9988
'14#.#16.10.192':9988
'14#.#16.180.106':9988
'14#.#16.140.119':9988
'14#.#16.36.108':9988
'14#.#16.189.157':9988
'14#.#16.177.68':9988
'14#.#16.191.239':9988
'14#.#16.87.11':9988
'14#.#16.97.44':139
'14#.#16.18.220':139
'14#.#16.179.239':139
'14#.#16.250.227':139
'14#.#16.154.251':139
'14#.#16.11.237':139
'14#.#16.144.55':139
'14#.#16.53.117':139
'14#.#16.37.126':139
'14#.#16.200.52':139
'14#.#16.247.163':139
'14#.#16.97.97':139
'14#.#16.190.31':139
'14#.#16.137.229':139
'14#.#16.227.137':139
'14#.#16.3.186':139
'14#.#16.229.144':139
'14#.#16.44.78':445
'14#.#16.72.15':445
'14#.#16.37.9':445
'14#.#16.138.162':445
'14#.#16.245.223':445
'14#.#16.140.119':445
'14#.#16.155.175':445
'14#.#16.189.157':445
'14#.#16.195.41':445
'14#.#16.52.148':445
'14#.#16.92.84':445
'14#.#16.10.213':445
'14#.#16.11.231':445
'14#.#16.162.108':445
'14#.#16.20.239':445
'14#.#16.147.98':445
'14#.#16.174.193':445
'14#.#16.32.149':445
'14#.#16.103.158':445
'14#.#16.63.154':445
'14#.#16.218.23':445
'14#.#16.59.34':445
'14#.#16.139.135':445
'14#.#16.77.139':445
'14#.#16.54.107':445
'14#.#16.179.36':445
'14#.#16.177.68':445
'14#.#16.180.106':445
'14#.#16.10.192':445
'14#.#16.217.10':445
'14#.#16.253.246':445
'14#.#16.30.69':445
'14#.#16.146.184':445
'14#.#16.246.223':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней