Trojan.DownLoader1.61790

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'87.##.55.244':3128
'18#.#4.131.222':3128
'89.##2.61.197':3128
'93.##0.28.178':3128
'11#.#25.233.36':3128
'17#.#12.80.82':3128
'58.#.143.203':3128
'22#.#43.180.41':3128
'11#.#54.69.226':3128
'88.##5.193.113':3128
'77.##5.61.143':3128
'18#.#12.138.52':3128
'85.##4.169.5':3128
'79.##5.115.229':3128
'41.##0.101.175':3128
'18#.#4.29.114':3128
'18#.#53.48.104':3128
'79.#.68.145':3128
'58.##4.176.3':3128
'88.##1.221.110':3128
'19#.#00.147.42':3128
'11#.#29.187.52':3128
'11#.#90.44.18':3128
'94.##8.245.78':3128
'20#.#48.139.97':3128
'85.##4.26.142':3128
'74.#15.5.41':3128
'93.##3.135.32':3128
'85.##.106.150':3128
'20#.#5.34.60':3128
'85.##5.234.46':3128
'21#.#97.10.106':3128
'19#.#4.201.136':3128
'18#.#92.192.162':3128
'87.##0.166.58':3128
'58.#.63.161':3128
'19#.#0.196.109':3128
'85.##1.212.30':3128
'85.##5.238.70':3128
'22#.#36.68.89':3128
'22#.#36.40.84':3128
'81.##3.30.232':3128
'92.##3.70.37':3128
'91.##6.236.229':3128
'11#.#4.12.15':3128
'85.##1.212.147':3128
'2.##.70.138':3128
'59.##3.49.152':3128
'18#.#79.186.220':3128
'94.##2.156.132':3128
'11#.#65.224.25':3128
'59.##3.54.145':3128
'81.##4.158.155':3128
'82.##.153.16':3128
'17#.#44.239.241':3128
'95.#33.4.42':3128
'84.##8.50.12':3128
'17#.#65.19.33':3128
'10#.#0.40.218':3128
'85.##0.24.191':3128
'19#.#98.243.218':3128
'11#.#65.227.211':3128
'11#.#01.204.190':3128
'12#.#20.45.20':3128
'85.##7.57.116':3128
'83.##1.32.225':3128
'59.##.200.104':3128
'11#.#41.138.159':3128
'19#.#07.110.169':3128
'82.##2.37.22':3128
'11#.#02.26.111':3128
'85.##6.196.130':3128
'20#.#18.213.59':3128
'12#.#05.186.8':3128
'11#.#41.198.121':3128
'85.##5.232.178':3128
'11#.#4.183.217':3128
'18#.#15.29.66':3128
'20#.#1.162.20':3128
'17#.#87.79.77':3128
'95.##2.32.128':3128
'19#.#6.248.204':3128
'11#.#41.137.112':3128
'82.##6.61.184':3128
'84.##9.136.56':3128
'20#.#6.174.237':3128
'18#.#5.130.217':3128
'10#.#89.128.133':3128
'59.##3.53.189':3128
'83.##.153.57':3128
'92.##3.115.116':3128
'83.##0.81.15':3128
'18#.#4.237.177':3128
'19#.#00.210.81':3128
'17#.#9.48.185':3128
'19#.#6.123.129':3128
'62.##.239.61':3128
'84.##9.229.218':3128
'59.##3.48.84':3128
'77.##8.216.172':3128
'18#.#5.26.204':3128
'70.##.151.57':3128
'82.##5.226.110':3128
'19#.#05.76.8':3128
'11#.#98.203.176':3128
'24.##2.25.216':3128
'12#.#.41.218':3128
'79.##4.24.170':3128
'79.##6.149.49':3128
'41.##5.182.124':3128
'19#.#77.165.197':3128
'19#.#3.98.75':3128
'79.##5.218.128':3128
'11#.#25.57.59':3128
'20#.#42.132.53':3128
'20#.#7.96.66':3128
'95.##3.169.5':3128
'84.##7.161.221':3128
'21#.#86.183.4':3128
'20#.#53.206.11':3128
'19#.#5.166.58':3128
'83.##2.81.217':3128
'85.##8.190.242':3128
'41.##1.230.4':3128
'18#.#60.23.198':3128
'18#.#8.112.37':3128
'18#.#27.42.6':3128
'71.#4.4.235':3128
'78.##.242.233':3128
'18#.#24.13.3':3128
'12#.#33.68.245':3128
'17#.#68.42.151':3128
'85.##2.42.183':3128
'83.##.116.214':3128
'79.##4.27.62':3128
'11#.#41.235.146':3128
'18#.#4.141.92':3128
'11#.#41.136.222':3128
'92.##.220.61':3128
'11#.#59.87.27':3128
'11#.#8.38.229':3128
'71.##6.135.4':3128
'19#.#78.156.85':3128
'11#.#54.2.93':3128
'12#.#27.66.184':3128
'11#.#6.159.32':3128
'21#.#38.4.164':3128
'21#.#19.69.149':3128
'83.#1.15.30':3128
'15#.#1.190.250':3128
'21#.#4.9.241':3128
'59.##3.54.68':3128
'79.##6.62.93':3128
'11#.#65.227.127':3128
'11#.#41.137.128':3128
'18#.#78.107.124':3128
'11#.#34.28.123':3128
'18#.#53.44.253':3128
'18#.#53.61.149':3128
'19#.#21.66.112':3128
'88.##7.31.103':3128
'19#.#04.136.1':3128
'19#.#9.124.132':3128
'20#.#48.103.189':3128
'18#.#3.101.244':3128
'41.##1.58.110':3128
'11#.#39.57.44':3128
'11#.#5.215.25':3128
'20#.#73.107.254':3128
'12#.#30.134.149':3128
'81.##.215.203':3128
'11#.#40.174.120':3128
'18#.#7.15.57':3128
'11#.#41.167.47':3128
'22#.#43.176.111':3128
'41.##3.57.76':3128
'41.#21.75.7':3128
'85.##6.250.116':3128
'11#.#08.253.56':3128
'16#.#7.221.216':3128
'20#.#87.228.5':3128
'15#.#39.156.208':3128
'59.##3.54.227':3128
'92.##5.96.123':3128
'79.##4.25.254':3128
'89.##0.213.145':3128
'11#.#54.199.14':3128
'81.##8.141.145':3128
'58.#.95.45':3128
'21#.#12.95.50':3128
'22#.#5.199.60':3128
'11#.#41.138.106':3128
'18#.#41.74.127':3128
'92.##.189.247':3128
'19#.#9.123.203':3128
'20#.#32.61.93':3128
'79.##4.27.120':3128
'92.##3.75.42':3128
'18#.#92.207.192':3128
'16#.#3.228.248':3128
'60.##0.147.209':3128
'41.##3.57.72':3128
'20#.#92.222.33':3128
'21#.#96.69.31':3128
'11#.#41.137.241':3128
'18#.#1.149.111':3128
'22#.#41.6.104':3128
'20#.#1.160.62':3128
'20#.#49.24.86':3128
'21#.#1.240.116':3128
'62.##3.174.192':3128
'19#.#77.139.198':3128
'92.#3.47.48':3128
'89.##8.218.56':3128
'92.##3.99.239':3128
'22#.#43.63.212':3128
'82.##6.29.93':3128
'85.##1.221.132':3128
'17#.#12.81.69':3128
'19#.#04.198.163':3128
'79.##6.149.190':3128
'18#.#55.81.44':3128
'84.##9.12.133':3128
'22#.#36.64.38':3128
'21#.#32.40.59':3128
'22#.#41.6.26':3128
'85.##1.212.242':3128
'79.##4.78.211':3128
'22#.#43.61.177':3128
'21#.#98.142.157':3128
'85.##8.133.13':3128
'77.##4.16.154':3128
'17#.#8.28.223':3128
'19#.#51.53.33':3128
'22#.#43.176.28':3128
'82.##2.103.247':3128
'19#.#7.66.109':3128
'58.#.139.136':3128
'58.#.38.21':3128
'61.##.13.198':3128
'24.##4.139.52':3128
'89.##7.75.85':3128
'74.##.209.166':3128
'12#.#30.106.159':3128
'85.##1.219.123':3128
'19#.#33.174.249':3128
'95.##2.82.107':3128
'19#.#0.169.164':3128
'11#.#54.89.201':3128
'95.##.203.55':3128
'77.##6.47.243':3128
'94.##8.61.102':3128
'18#.#84.162.200':3128
'11#.#48.73.106':3128
'78.#42.36.3':3128
'81.##5.4.137':3128
'11#.#6.149.83':3128
'89.##2.229.3':3128
'41.##1.230.11':3128
'61.#.70.19':3128
'20#.#18.215.241':3128
'11#.#02.202.42':3128
'77.##2.32.188':3128
'19#.#4.249.90':3128
'10#.#89.24.247':3128
'21#.#71.160.5':3128
'19#.#4.21.200':3128
'41.##3.57.74':3128
'19#.#7.161.67':3128
'11#.#41.136.165':3128
'11#.#46.86.131':3128
'12#.#58.213.230':3128
'18#.#29.208.111':3128
'11#.#01.205.193':3128
'92.##3.207.73':3128
'11#.#1.250.156':3128
'82.##8.61.134':3128
'99.##7.197.172':3128
'20#.#09.91.242':3128
'82.##.167.70':3128
'78.##.10.241':3128
'21#.#43.253.101':3128
'18#.4.1.36':3128
'12#.#30.112.17':3128
'11#.#41.137.13':3128
'79.##6.149.35':3128
'21#.#7.82.66':3128
'81.##3.30.148':3128
'59.##3.49.116':3128
'18#.#41.74.128':3128
'96.##.168.115':3128
'18#.#07.96.169':3128
'62.##0.164.253':3128
'84.##8.168.167':3128
'11#.249.2.6':3128
'19#.#00.94.161':3128
'72.##0.124.36':3128
'11#.#4.76.93':3128
'20#.#17.182.2':3128
'10#.#89.25.128':3128
'20#.#08.103.112':3128
'12#.#37.213.219':3128
'21#.#18.248.40':3128
'18#.#2.214.70':3128
'11#.#40.194.238':3128
'79.##5.253.7':3128
'19#.#4.193.79':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней