Trojan.DownLoader10.3655

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERb487.dir00\svchost.exe.mdmp 16325836412032120

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERb487.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'67.##6.37.245':445
'67.##6.145.80':445
'67.##6.199.83':445
'67.##6.9.206':445
'67.##6.254.169':445
'67.##6.245.145':445
'67.##6.31.199':139
'67.##6.29.72':139
'67.#16.5.94':139
'67.##6.249.37':445
'67.##6.94.182':139
'67.##6.72.168':445
'67.##6.106.4':445
'67.##6.105.110':445
'67.##6.224.92':445
'67.##6.40.221':445
'67.##6.31.92':445
'67.##6.47.204':445
'67.##6.57.168':445
'67.##6.112.199':445
'67.##6.105.81':445
'67.##6.210.112':445
'67.##6.45.13':445
'67.##6.89.18':445
'67.##6.156.22':445
'67.##6.31.199':445
'67.##6.184.166':139
'67.#16.5.94':445
'67.##6.66.235':445
'67.##6.78.15':445
'67.#16.47.3':445
'67.##6.44.201':445
'67.##6.255.157':445
'67.##6.75.172':445
'67.##6.82.206':445
'67.##6.255.157':139
'67.##6.37.186':445
'67.##6.66.235':139
'67.##6.89.18':139
'67.##6.156.22':139
'67.##6.75.172':139
'67.##6.140.47':139
'67.##6.82.206':139
'67.#16.47.3':139
'67.##6.44.201':139
'67.##6.78.15':139
'67.##6.82.150':445
'67.##6.24.94':445
'67.##6.104.217':445
'67.##6.40.85':445
'67.##6.130.40':445
'67.##6.177.114':445
'67.##6.77.220':445
'67.##6.159.93':445
'67.##6.219.223':445
'67.##6.131.131':445
'67.##6.181.27':445
'67.##6.84.233':445
'67.##6.71.102':445
'67.##6.142.204':445
'67.##6.102.126':445
'67.##6.172.149':445
'67.##6.126.117':445
'67.##6.97.87':445
'67.##6.189.148':445
'67.##6.233.189':445
'67.##6.162.130':445
'67.#16.7.24':445
'67.##6.216.143':445
'67.##6.24.120':445
'67.##6.85.254':445
'67.##6.24.33':445
'67.##6.149.32':445
'67.##6.192.29':445
'67.##6.108.18':445
'67.##6.170.29':445
'67.##6.30.86':445
'67.##6.18.96':445
'67.##6.192.42':445
'67.##6.118.150':445
'67.##6.6.121':445
'67.##6.129.28':445
'67.##6.58.10':445
'67.##6.147.109':445
'67.##6.93.140':445
'67.##6.214.34':445
'67.##6.218.132':445
'67.##6.185.229':445
'67.##6.26.211':445
'67.##6.198.29':445
'67.##6.157.70':445
'67.##6.148.112':445
'67.##6.140.47':445
'67.##6.246.120':445
'67.##6.78.115':445
'67.##6.224.226':445
'67.##6.228.29':445
'67.##6.34.198':445
'67.##6.88.98':445
'67.##6.182.198':445
'67.##6.127.82':445
'67.##6.74.151':445
'67.##6.188.18':445
'67.##6.175.235':445
'67.#16.41.5':445
'67.##6.231.22':445
'67.##6.149.180':445
'67.##6.64.240':445
'67.##6.6.112':445
'67.##6.234.5':445
'67.##6.169.149':445
'67.##6.88.48':445
'67.##6.52.116':445
'67.##6.56.122':445
'67.##6.151.169':445
'67.##6.206.62':445
'67.##6.219.115':139
'67.##6.47.219':139
'67.##6.116.47':139
'67.##6.177.69':139
'67.##6.46.177':139
'67.##6.95.147':139
'67.##6.230.96':139
'67.##6.235.128':139
'67.##6.207.223':139
'67.##6.150.4':139
'67.##6.190.68':139
'67.##6.51.206':139
'67.##6.189.209':445
'67.##6.92.189':445
'67.##6.103.89':445
'67.##6.42.225':445
'67.##6.223.212':445
'67.##6.80.231':445
'67.##6.52.143':445
'67.##6.245.166':139
'67.##6.0.219':445
'67.##6.88.222':445
'67.##6.113.113':445
'67.##6.88.48':139
'67.##6.52.116':139
'67.##6.56.122':139
'67.##6.151.169':139
'67.##6.206.62':139
'67.#16.41.5':139
'67.##6.246.120':139
'67.##6.78.115':139
'67.##6.224.226':139
'67.##6.228.29':139
'67.##6.34.198':139
'67.##6.169.149':139
'67.##6.215.150':139
'67.##6.189.158':139
'67.##6.254.130':139
'67.##6.184.166':445
'67.##6.131.186':139
'67.##6.111.119':139
'67.##6.231.22':139
'67.##6.149.180':139
'67.##6.64.240':139
'67.##6.6.112':139
'67.##6.234.5':139
'67.##6.113.113':139
'67.##6.0.219':139
'67.##6.88.222':139
'67.##6.92.189':139
'67.##6.80.231':139
'67.##6.52.143':139
'67.##6.189.158':445
'67.##6.111.119':445
'67.##6.215.150':445
'67.##6.131.186':445
'67.##6.254.130':445
'67.##6.189.209':139
'67.##6.74.151':139
'67.##6.182.198':139
'67.##6.175.235':139
'67.##6.88.98':139
'67.##6.188.18':139
'67.##6.127.82':139
'67.##6.20.60':445
'67.##6.103.89':139
'67.##6.20.60':139
'67.##6.42.225':139
'67.##6.223.212':139
'67.##6.150.248':445
'67.##6.217.200':445
'67.##6.115.39':445
'67.##6.167.180':445
'67.##6.39.167':445
'67.##6.51.43':445
'67.##6.28.236':445
'67.##6.218.22':445
'67.##6.173.95':445
'67.##6.65.117':445
'67.##6.23.186':445
'67.##6.255.7':445
'67.##6.34.186':139
'67.##6.26.28':139
'67.##6.20.245':139
'67.##6.125.84':139
'67.##6.73.224':139
'67.##6.135.9':445
'67.##6.54.54':445
'67.##6.224.95':445
'67.##6.40.80':445
'67.##6.80.54':445
'67.##6.166.40':445
'67.##6.151.20':445
'67.##6.180.151':445
'67.##6.125.232':445
'67.##6.215.103':445
'67.##6.90.15':445
'67.##6.154.180':445
'67.##6.109.175':445
'67.##6.42.36':445
'67.##6.78.161':445
'67.##6.64.154':445
'67.##6.136.110':445
'67.##6.185.193':445
'67.##6.55.216':445
'67.##6.242.1':445
'67.##6.242.53':445
'67.##6.225.133':445
'67.##6.53.225':445
'67.##6.73.106':445
'67.##6.68.58':445
'67.##6.125.14':445
'67.##6.21.239':445
'67.##6.7.108':445
'67.##6.48.149':445
'67.##6.173.95':139
'67.##6.28.236':139
'67.##6.23.186':139
'67.##6.51.43':139
'67.##6.65.117':139
'67.##6.218.22':139
'67.##6.55.216':139
'67.##6.242.1':139
'67.##6.242.53':139
'67.##6.225.133':139
'67.##6.53.225':139
'67.##6.217.200':139
'67.##6.135.9':139
'67.##6.54.54':139
'67.##6.166.40':139
'67.##6.80.54':139
'67.##6.40.80':139
'67.##6.255.7':139
'67.##6.115.39':139
'67.##6.150.248':139
'67.##6.39.167':139
'67.##6.224.95':139
'67.##6.167.180':139
'67.##6.78.161':139
'67.##6.109.175':139
'67.##6.136.110':139
'67.##6.154.180':139
'67.##6.64.154':139
'67.##6.42.36':139
'67.##6.38.87':139
'67.##6.224.219':139
'67.#16.4.17':139
'67.##6.53.209':139
'67.##6.218.91':139
'67.##6.180.151':139
'67.##6.68.58':139
'67.##6.21.239':139
'67.##6.48.149':139
'67.##6.73.106':139
'67.##6.7.108':139
'67.##6.125.14':139
'67.##6.125.232':139
'67.##6.151.20':139
'67.##6.90.15':139
'67.##6.185.193':139
'67.##6.215.103':139
'67.##6.53.209':445
'67.##6.30.86':139
'67.##6.85.254':139
'67.##6.108.18':139
'67.##6.105.110':139
'67.##6.18.96':139
'67.##6.192.29':139
'67.##6.24.33':139
'67.##6.106.4':139
'67.##6.31.92':139
'67.##6.254.169':139
'67.##6.40.221':139
'67.##6.149.32':139
'67.##6.58.10':139
'67.##6.218.132':139
'67.##6.129.28':139
'67.##6.159.93':139
'67.##6.147.109':139
'67.##6.157.70':139
'67.##6.6.121':139
'67.##6.26.211':139
'67.##6.185.229':139
'67.##6.148.112':139
'67.##6.198.29':139
'67.##6.249.37':139
'67.##6.245.145':139
'67.##6.178.145':139
'67.##6.9.206':139
'67.##6.199.83':139
'67.##6.145.80':139
'67.##6.193.237':445
'67.##6.54.108':445
'67.##6.2.181':445
'67.##6.37.245':139
'67.##6.73.28':445
'67.##6.112.199':139
'67.##6.170.29':139
'67.##6.47.204':139
'67.##6.224.92':139
'67.##6.24.120':139
'67.##6.192.42':139
'67.##6.72.168':139
'67.##6.105.81':139
'67.##6.57.168':139
'67.##6.118.150':139
'67.##6.210.112':139
'67.##6.45.13':139
'67.##6.217.200':9988
'67.##6.65.117':9988
'67.##6.173.95':9988
'67.##6.21.239':9988
'67.##6.115.39':9988
'67.##6.26.28':9988
'67.##6.54.108':139
'67.##6.172.149':139
'67.##6.193.237':139
'67.##6.73.28':139
'67.##6.2.181':139
'67.##6.224.95':9988
'67.##6.224.219':445
'67.##6.125.84':445
'67.##6.38.87':445
'67.##6.218.91':445
'67.#16.4.17':445
'67.##6.73.224':445
'67.##6.150.248':9988
'67.##6.73.106':9988
'67.##6.26.28':445
'67.##6.20.245':445
'67.##6.34.186':445
'67.##6.131.131':139
'67.##6.24.94':139
'67.##6.104.217':139
'67.##6.130.40':139
'67.##6.82.150':139
'67.##6.181.27':139
'67.##6.214.34':139
'67.##6.93.140':139
'67.##6.77.220':139
'67.##6.177.114':139
'67.##6.219.223':139
'67.##6.40.85':139
'67.#16.7.24':139
'67.##6.162.130':139
'67.##6.71.102':139
'67.##6.126.117':139
'67.##6.102.126':139
'67.##6.97.87':139
'67.##6.233.189':139
'67.##6.84.233':139
'67.##6.189.148':139
'67.##6.142.204':139
'67.##6.216.143':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней