Trojan.DownLoader4.21937

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'89.##2.236.14':3128
'11#.#36.111.104':3128
'20#.#5.154.126':3128
'11#.#54.130.96':3128
'17#.#50.146.54':3128
'17#.#25.172.9':3128
'11#.#1.74.83':3128
'12#.#7.93.41':3128
'11#.#3.45.53':3128
'10#.#00.240.44':3128
'11#.#9.51.188':3128
'21#.#12.182.243':3128
'79.##0.237.191':3128
'79.##3.153.241':3128
'11#.#7.11.170':3128
'92.#7.4.97':3128
'79.##9.209.87':3128
'62.##.74.140':3128
'17#.#26.207.235':3128
'11#.#01.114.47':3128
'18#.#12.138.52':3128
'11#.#42.61.2':3128
'88.##5.194.91':3128
'79.##3.190.202':3128
'14.##.87.197':3128
'17#.#24.94.49':3128
'58.##2.109.240':3128
'11#.#9.115.251':3128
'41.##3.20.42':3128
'18#.#30.64.18':3128
'94.##7.75.85':3128
'11#.#2.142.42':3128
'12#.#43.139.53':3128
'11#.#40.58.150':3128
'11#.#8.214.212':3128
'91.##3.175.83':3128
'61.##.197.229':3128
'19#.#0.161.143':3128
'18#.#73.211.169':3128
'11#.#8.72.94':3128
'12#.#23.78.67':3128
'11#.#04.64.132':3128
'46.##.171.217':3128
'20#.#17.51.159':3128
'21#.#67.197.117':3128
'11#.#97.27.8':3128
'84.##7.61.206':3128
'77.##0.37.254':3128
'12#.#27.64.127':3128
'17#.#22.240.223':3128
'11#.#10.99.104':3128
'60.##0.222.152':3128
'70.#5.60.8':3128
'19#.#51.53.33':3128
'21#.19.6.21':3128
'11#.#93.128.2':3128
'85.##6.104.184':3128
'77.##9.2.219':3128
'27.##5.59.59':3128
'11#.#52.220.218':3128
'11#.#07.7.56':3128
'59.#8.7.167':3128
'62.##9.146.67':3128
'11#.#54.6.217':3128
'11#.#98.168.149':3128
'86.##6.40.27':3128
'59.#8.7.162':3128
'87.##9.184.119':3128
'11#.#10.18.151':3128
'17#.#36.46.240':3128
'59.#8.7.173':3128
'95.##1.235.248':3128
'20#.#4.201.167':3128
'20#.#60.226.207':3128
'20#.#41.255.46':3128
'93.##6.154.250':3128
'78.##7.180.250':3128
'86.##3.31.54':3128
'80.##.191.57':3128
'21#.#48.255.243':3128
'89.##3.98.138':3128
'59.##3.193.24':3128
'92.##.55.219':3128
'17#.#00.132.163':3128
'11#.#06.80.51':3128
'17#.#0.6.143':3128
'11#.#97.182.9':3128
'41.##9.162.145':3128
'95.##.159.249':3128
'88.##4.52.66':3128
'59.##.153.96':3128
'78.##.25.166':3128
'92.#7.5.149':3128
'11#.#98.163.52':3128
'92.#12.3.72':3128
'93.##3.109.154':3128
'11#.#8.77.58':3128
'74.#15.3.63':3128
'77.##3.72.98':3128
'89.##6.63.137':3128
'17#.#23.195.112':3128
'59.##.211.177':3128
'11#.#97.22.127':3128
'89.#6.59.46':3128
'62.##8.214.33':3128
'19#.#05.12.237':3128
'58.##3.125.236':3128
'11#.#40.73.24':3128
'11#.#07.5.248':3128
'18#.#14.101.160':3128
'16#.#87.75.100':3128
'19#.#2.90.65':3128
'41.##.139.171':3128
'19#.#7.39.215':3128
'78.##.242.233':3128
'83.##8.197.86':3128
'18#.#.125.28':3128
'11#.#24.216.244':3128
'86.##1.54.123':3128
'11#.#11.184.69':3128
'17#.#22.89.10':3128
'1.##.71.127':3128
'12#.#9.28.64':3128
'79.##6.165.190':3128
'20#.#1.160.62':3128
'79.##5.138.210':3128
'18#.2.117.2':3128
'22#.#24.57.154':3128
'95.##5.98.55':3128
'11#.#05.55.134':3128
'84.##9.67.56':3128
'18#.#73.49.47':3128
'89.##5.49.24':3128
'11#.#54.75.69':3128
'21#.#12.249.136':3128
'18#.#96.142.123':3128
'18#.#2.216.51':3128
'11#.#4.142.43':3128
'11#.#37.250.215':3128
'20#.#36.119.101':3128
'94.##.56.138':3128
'21#.#12.164.162':3128
'21#.#40.47.197':3128
'11#.#6.124.137':3128
'17#.#22.89.175':3128
'21#.#74.1.227':3128
'11#.#6.206.49':3128
'85.##0.81.228':3128
'19#.#.35.154':3128
'12#.#94.145.64':3128
'95.##4.172.70':3128
'17#.#23.29.226':3128
'11#.#2.72.149':3128
'11#.#2.129.242':3128
'88.##4.15.50':3128
'93.##7.158.45':3128
'82.##0.33.111':3128
'11#.#93.138.134':3128
'17#.#33.119.252':3128
'89.##6.212.138':3128
'17#.#22.100.224':3128
'41.##3.57.74':3128
'17#.#48.4.76':3128
'58.##2.109.242':3128
'11#.#54.54.142':3128
'17#.#21.31.113':3128
'17#.#25.252.68':3128
'22#.#04.246.113':3128
'11#.#04.66.49':3128
'11#.#78.199.146':3128
'12#.#23.106.96':3128
'17#.#23.10.51':3128
'11#.#8.33.160':3128
'12#.#1.2.139':3128
'87.##0.166.58':3128
'11#.#54.70.142':3128
'41.##3.57.72':3128
'11#.#8.187.40':3128
'94.#2.57.11':3128
'11#.#98.86.115':3128
'27.##5.59.54':3128
'22#.#52.117.126':3128
'10#.#6.241.24':3128
'68.#1.173.2':3128
'17#.#22.152.136':3128
'21#.#5.88.163':3128
'18#.#77.235.90':3128
'19#.#3.163.69':3128
'11#.#04.64.121':3128
'11#.#97.21.10':3128
'11#.#8.202.90':3128
'77.##6.98.108':3128
'93.##6.166.52':3128
'93.##7.150.210':3128
'1.##.16.143':3128
'17#.#0.22.31':3128
'41.##0.106.5':3128
'59.##3.50.63':3128
'89.##8.163.103':3128
'19#.#55.209.74':3128
'17#.#5.10.210':3128
'11#.#7.135.112':3128
'21#.#2.200.158':3128
'12#.#14.134.15':3128
'82.##9.165.28':3128
'88.##6.111.111':3128
'11#.#0.239.202':3128
'95.##.240.37':3128
'41.##1.75.228':3128
'11#.#05.50.80':3128
'19#.#22.143.202':3128
'12#.#3.27.163':3128
'18#.#10.109.63':3128
'11#.#6.12.94':3128
'89.##.159.184':3128
'18#.#3.108.230':3128
'42.##1.166.157':3128
'46.##8.34.83':3128
'59.##3.54.127':3128
'11#.#8.215.108':3128
'93.##8.250.214':3128
'12#.#21.68.110':3128
'85.#85.8.55':3128
'84.##1.18.150':3128
'17#.#50.199.9':3128
'83.##9.32.202':3128
'82.##3.123.207':3128
'10#.#7.192.82':3128
'17#.#33.29.206':3128
'11#.#04.74.3':3128
'67.##7.202.25':3128
'17#.#37.7.22':3128
'11#.#54.183.214':3128
'89.##3.213.96':3128
'12#.#23.147.161':3128
'11#.#03.229.154':3128
'11#.#02.36.82':3128
'91.##.126.12':3128
'99.##6.68.164':3128
'19#.#8.244.30':3128
'11#.#54.129.1':3128
'11#.#24.41.27':3128
'21#.#2.113.170':3128
'21#.#19.211.243':3128
'61.##8.56.36':3128
'59.#8.7.168':3128
'46.##5.169.64':3128
'11#.#04.73.246':3128
'10#.#01.233.98':3128
'20#.#04.20.184':3128
'59.##.194.59':3128
'19#.#3.151.16':3128
'95.##1.183.113':3128
'21#.#9.118.91':3128
'20#.#27.193.138':3128
'27.##5.59.70':3128
'11#.#07.49.181':3128
'46.#8.83.57':3128
'11#.88.1.3':3128
'86.##5.106.56':3128
'62.##3.176.118':3128
'75.##.247.238':3128
'18#.#29.211.240':3128
'91.##4.162.182':3128
'11#.#7.53.106':3128
'11#.#52.241.216':3128
'92.##.176.195':3128
'11#.#84.216.90':3128
'93.##5.96.73':3128
'91.##4.134.197':3128
'21#.#99.111.74':3128
'12#.#9.90.46':3128
'27.##5.59.65':3128
'12#.#36.248.177':3128
'21#.#12.69.248':3128
'18#.#06.81.34':3128
'12#.#25.21.140':3128
'11#.#93.156.31':3128
'82.##7.106.170':3128
'85.##.156.118':3128
'20#.#49.127.77':3128
'60.##3.195.59':3128
'19#.#36.214.243':3128
'59.##3.172.10':3128
'83.##2.81.217':3128
'12#.#38.121.194':3128
'12#.#37.118.163':3128
'17#.#23.23.184':3128
'11#.#99.114.136':3128
'17#.#51.76.180':3128
'98.##4.67.160':3128
'89.##0.164.105':3128
'11#.#05.182.117':3128
'41.##3.57.76':3128
'11#.#04.76.152':3128
'46.##8.34.36':3128
'12#.#23.111.216':3128
'18#.#3.70.111':3128
'86.##6.237.212':3128
'95.#9.1.63':3128
'11#.#6.112.54':3128
'11#.#54.24.194':3128
'18#.#42.185.74':3128
'82.##6.248.139':3128
'83.##.172.192':3128
'80.##1.196.145':3128
'20#.#6.18.246':3128
'89.##.230.250':3128
'71.##4.19.142':3128
'94.#3.69.3':3128
'70.##7.48.84':3128
'84.##.41.150':3128
'17#.#25.53.75':3128
'19#.#18.117.248':3128
'12#.#30.190.26':3128
'79.##2.91.208':3128
'92.##.218.192':3128
'11#.88.4.78':3128
'11#.#54.117.193':3128
'11#.#07.129.130':3128
'11#.#48.196.99':3128
'67.##7.150.10':3128
'11#.#04.73.9':3128
'18#.#2.80.42':3128
'83.##8.82.159':3128
'18#.#22.136.3':3128
'50.##.246.189':3128
'18#.#41.97.224':3128
'46.##.73.184':3128
'61.##3.193.110':3128
'12#.#92.69.237':3128
'41.##1.54.29':3128
'60.##3.38.64':3128
'22#.#26.242.228':3128
'20#.#32.61.93':3128
'19#.#7.235.75':3128
'84.##9.253.152':3128
'27.##1.19.95':3128
'93.##0.230.38':3128
'18#.#0.182.143':3128
'19#.#04.173.239':3128
'31.##.162.114':3128
'49.##8.164.249':3128
'19#.#25.94.189':3128
'11#.#55.129.49':3128
'77.##.69.181':3128
'17#.#22.22.89':3128
'21#.#2.133.252':3128
'79.##5.253.7':3128
'11#.#40.58.147':3128
'27.##5.33.216':3128
'78.##9.161.87':3128
'77.##7.115.2':3128
'84.##.230.244':3128
'11#.#3.89.104':3128
'49.##4.102.212':3128
'14.#7.39.52':3128
'24.##.193.250':3128
'84.##.69.185':3128
'10#.#00.239.148':3128
'11#.#04.67.227':3128
'11#.#05.111.114':3128
'17#.#37.128.94':3128
'89.##.42.156':3128
'20#.#29.54.51':3128
'18#.#8.130.143':3128
'27.##5.59.64':3128
'18#.#42.10.201':3128
'17#.#22.230.89':3128
'41.#3.130.4':3128
'20#.#65.227.159':3128
'22#.#58.173.198':3128
'95.##.134.226':3128
'13#.#.157.199':3128
'17#.#65.97.227':3128
'94.##7.182.140':3128
'11#.#24.242.30':3128
'10#.#.32.121':3128
'11#.#8.31.68':3128
'77.##7.110.198':3128
'70.#8.78.73':3128
'11#.#6.96.152':3128
'17#.#22.115.200':3128
'95.##.69.146':3128
'11#.#11.222.15':3128
'59.##.130.46':3128
'17#.#22.247.101':3128
'19#.#14.77.46':3128
'20#.#4.189.77':3128
'41.##2.41.40':3128
'61.##.186.155':3128
'17#.#23.248.251':3128
'89.#4.90.20':3128
'78.#8.99.95':3128
'11#.#0.169.243':3128
'19#.#6.196.3':3128
'89.##7.75.85':3128
'22#.#43.177.200':3128
'87.##1.19.76':3128
'17#.#00.132.205':3128
'11#.#00.131.200':3128
'18#.#51.135.144':3128
'11#.#04.65.177':3128
'41.##1.251.106':3128
'20#.#32.220.14':3128
'82.##2.103.247':3128
'42.##1.161.145':3128
'80.##.120.34':3128
'19#.#9.152.22':3128
'18#.#64.142.139':3128
'11#.#54.131.100':3128
'19#.#07.110.169':3128
'61.##.131.206':3128

UDP:

DNS ASK ht####h.localdomain
DNS ASK SN#.#ocaldomain

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней