Trojan.Packed.23113

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'17#.#66.128.213':3128
'83.##1.179.15':3128
'11#.#9.59.28':3128
'80.##.189.51':3128
'41.##1.56.14':3128
'95.#7.69.1':3128
'72.##1.193.202':3128
'87.##5.65.39':3128
'41.##.17.190':3128
'80.##.168.20':3128
'18#.#14.80.191':3128
'31.#.60.189':3128
'18#.#59.131.50':3128
'95.#6.7.238':3128
'85.##.159.210':3128
'84.##0.236.209':3128
'84.##0.218.209':3128
'19#.#2.209.198':3128
'62.#4.46.69':3128
'20#.#04.110.211':3128
'94.#24.3.29':3128
'37.##.67.153':3128
'11#.#9.58.243':3128
'92.##.228.44':3128
'37.#9.66.96':3128
'17#.#1.195.132':3128
'19#.#13.194.128':3128
'74.#15.0.21':312
'18#.#81.114.105':3128
'95.##.137.116':3128
'11#.#9.48.172':3128
'19#.#8.22.63':3128
'89.##3.98.138':3128
'19#.#6.245.30':3128
'11#.#9.62.35':3128
'74.#15.0.21':3128
'20#.#9.185.133':3128
'17#.#0.55.255':3128
'11#.#9.51.101':3128
'5.##.95.29':3128
'62.#4.45.33':3128
'20#.#1.190.170':3128
'95.##.60.204':3128
'19#.#13.196.7':3128
'11#.#9.56.175':3128
'11#.#9.59.174':3128
'17#.#44.161.209':3128
'79.##7.113.215':3128
'78.##.242.233':3128
'19#.#5.71.23':3128
'92.##.75.254':3128
'11#.#9.58.28':3128
'19#.#1.126.140':3128
'20#.#0.144.162':3128
'21#.#30.96.59':3128
'95.##.124.38':3128
'64.##.73.202':3128
'17#.#.204.82':3128
'41.##.176.133':3128
'11#.#9.56.35':3128
'19#.#07.111.147':3128
'19#.#20.64.3':3128
'83.##1.168.241':3128
'22#.#55.224.27':3128
'11#.#9.56.55':3128
'19#.80.81.8':3128
'21#.#0.85.98':3128
'19#.#7.101.50':3128
'11#.#9.58.35':3128
'95.##1.151.172':3128
'19#.#00.88.175':3128
'11#.#9.63.174':3128
'84.##0.194.4':3128
'92.##.178.170':3128
'2.###.243.229':3128
'46.##.246.39':3128
'17#.#1.194.252':3128
'62.##.47.129':3128
'18#.94.88.9':3128
'19#.#4.67.192':3128
'19#.#.128.245':3128
'92.#7.72.8':3128
'78.##.151.25':3128
'85.##5.238.33':3128
'31.#.180.198':3128
'41.##3.57.75':3128
'19#.#2.18.45':3128
'95.##.34.248':3128
'8.##.204.156':3128
'95.##.239.223':3128
'85.##3.247.178':3128
'82.##5.17.111':3128
'95.#6.10.53':3128
'18#.#9.184.142':3128
'95.#7.86.1':3128
'11#.#01.15.192':3128
'79.##7.47.199':3128
'18#.#84.200.126':3128
'18#.#7.205.14':3128
'95.##.103.220':3128
'19#.#4.235.185':3128
'84.##.73.248':3128
'74.#15.1.41':3128
'19#.#6.29.248':3128
'19#.#1.111.59':3128
'19#.#13.196.6':3128
'11#.#9.57.41':3128
'85.##.178.48':3128
'19#.#7.219.193':3128
'95.#7.17.91':3128
'95.#9.55.64':3128
'92.##.170.69':3128
'80.##1.187.8':3128
'20#.#9.97.173':3128
'91.##1.159.1':3128
'78.##.238.238':3128
'18#.#7.10.72':3128
'80.##.183.251':3128
'92.##.156.19':3128
'41.##2.34.54':3128
'2.##3.58.33':3128
'41.##3.57.76':3128
'82.##0.168.67':3128
'19#.#07.175.167':3128
'93.##6.12.53':3128
'41.##8.138.78':3128
'80.##.168.14':3128
'95.##.144.186':3128
'19#.#86.125.28':3128
'20#.#73.146.224':3128
'20#.#08.70.86':3128
'37.##7.136.169':3128
'93.##5.160.97':3128
'80.##.168.16':3128
'18#.#3.63.11':3128
'41.##5.83.146':3128
'11#.#9.60.31':3128
'41.#7.72.67':3128
'20#.#0.87.82':3128
'18#.#16.160.2':3128
'11#.81.33.8':3128
'19#.#05.219.165':3128
'2.###.226.112':3128
'10#.#29.190.219':3128
'82.##8.52.134':3128
'20#.#48.140.184':3128
'95.##.180.151':3128
'18#.#73.206.216':3128
'11#.#9.57.55':3128
'41.##.174.215':3128
'46.##.143.216':3128
'localhost':3573
'11#.#69.236.77':3128
'90.##.127.17':3128
'19#.#7.160.22':3128
'85.##.183.160':3128
'localhost':1357
'localhost':135
'localhost':1373
'19#.#06.250.68':3128
'11#.#9.49.217':3128
'19#.#4.182.168':3128
'2.###.62.129':3128
'61.#.33.12':3128
'18#.#3.220.137':3128
'11#.#9.59.243':3128
'21#.#9.117.93':3128
'17#.#1.241.189':3128
'2.##2.0.39':3128
'10#.#25.169.124':3128
'87.##0.166.58':3128
'80.##.168.131':3128
'19#.#9.39.226':3128
'18#.#93.180.187':3128
'31.##.115.243':3128
'11#.#9.57.230':3128
'10#.#10.6.212':3128
'83.##1.174.248':3128
'93.##5.81.200':3128
'17#.#1.113.240':3128
'18#.#99.240.246':3128
'12#.#62.231.164':3128
'78.##.129.176':3128
'92.##.66.230':3128
'20#.#43.172.10':3128
'68.##9.63.48':3128
'80.##.168.144':3128
'19#.#7.162.124':3128
'19#.#9.74.199':3128
'17#.#3.169.29':3128
'20#.#65.238.43':3128
'78.##.93.251':3128
'18#.#4.87.201':3128
'18#.#9.181.217':3128
'94.##.13.126':3128
'11#.#9.59.35':3128
'78.##.73.170':3128
'19#.#9.46.224':3128
'11#.#52.191.187':3128
'21#.#19.209.131':3128
'11#.#9.53.172':3128
'20#.#1.175.2':3128
'78.##.103.17':3128
'95.##.36.251':3128
'24.##9.245.137':3128
'82.##5.17.110':3128
'11#.#9.62.188':3128
'92.##.165.191':3128
'17#.#.186.30':3128
'17#.#65.30.83':3128
'18#.#0.49.231':3128
'92.##.234.220':3128
'20#.#8.222.2':3128
'88.##.167.215':3128
'74.#15.1.93':3128
'46.##.91.192':3128
'85.##3.247.92':3128
'95.#7.5.74':3128
'98.##8.81.40':3128
'95.#5.61.80':3128
'21#.#12.72.117':3128
'11#.#9.55.101':3128
'17#.#44.28.191':3128
'95.##.147.221':3128
'2.###.118.173':3128
'17#.#22.137.253':3128
'92.##5.143.129':3128
'11#.#9.58.170':3128
'95.##.220.118':3128
'20#.#0.92.77':3128
'19#.#13.196.3':3128
'20#.#23.151.87':3128
'58.##3.125.199':3128
'2.###.43.231':3128
'77.##8.196.49':3128
'19#.#13.92.176':3128
'46.##.243.47':3128
'17#.#0.204.246':3128
'95.#8.32.64':3128
'93.#0.70.99':3128
'93.##6.4.187':3128
'11#.#9.58.137':3128
'19#.#4.167.144':3128
'19#.#19.213.37':3128
'19#.#.14.179':3128
'81.##0.109.79':3128
'46.#8.132.8':3128
'82.##8.57.54':3128
'19#.#13.128.240':3128
'31.##.254.30':3128
'11#.#9.51.172':3128
'94.##5.61.160':3128
'95.##.110.196':3128
'41.#9.7.53':3128
'75.##2.8.109':3128
'17#.#9.171.23':3128
'31.#9.4.240':3128
'79.##7.47.194':3128
'19#.#4.202.12':3128
'21#.#9.181.226':3128
'20#.#0.125.183':3128
'41.##.205.76':3128
'87.##1.19.76':3128
'19#.#06.149.137':3128
'85.##5.81.164':3128
'79.##7.47.195':3128
'95.##.33.167':3128
'41.##1.35.54':3128
'19#.#4.156.12':3128
'11#.#9.60.213':3128
'41.##3.57.78':3128
'95.##.102.50':3128
'20#.#3.91.213':3128
'19#.#86.77.161':3128
'17#.#17.253.51':3128
'19#.#86.144.63':3128
'11#.#9.59.230':3128
'17#.#20.243.39':3128
'20#.#73.146.161':3128
'18#.#4.247.234':3128
'19#.#55.210.80':3128
'95.#8.42.98':3128
'84.##.230.244':3128
'19#.#6.196.3':3128
'2.###.108.170':3128
'91.##5.30.28':3128
'20#.#22.53.220':3128
'84.##8.42.93':3128
'82.##8.53.173':3128
'10#.#60.9.38':3128
'95.##.248.174':3128
'80.##.168.127':3128
'11#.#9.52.182':3128
'11#.#9.62.230':3128
'74.#15.3.63':3128
'2.###.152.25':3128
'11#.#9.56.174':3128
'74.#15.3.67':3128
'2.###.63.231':3128
'11#.#9.63.243':3128
'19#.#45.114.4':3128
'95.##.41.168':3128
'19#.#04.38.65':3128
'18#.#99.20.227':3128
'11#.#9.50.101':3128
'80.##1.187.22':3128
'95.##.45.175':3128
'41.#01.36.6':3128
'10#.#85.109.72':3128
'95.##.76.215':3128
'92.##.16.203':3128
'92.#0.7.103':3128
'20#.#09.77.194':3128
'19#.#06.248.33':3128
'24.##.98.173':3128
'20#.#73.146.186':3128
'11#.#9.63.35':3128
'11#.#9.62.174':3128
'18#.#92.173.53':3128
'17#.#.233.210':3128
'46.##.212.109':3128
'37.##.152.218':3128
'17#.#0.90.239':3128
'80.#3.43.25':3128
'95.##.58.172':3128
'96.##7.166.214':3128
'10#.#74.18.101':3128
'19#.#55.210.72':3128
'19#.#13.196.4':3128
'20#.16.9.27':3128
'74.#15.1.97':3128
'17#.#00.176.231':3128
'80.##.168.43':3128
'13#.#69.171.124':3128
'11#.#9.54.172':3128
'95.##.136.180':3128
'20#.#.123.238':3128
'82.##5.17.115':3128
'21#.#6.9.182':3128
'82.##.67.116':3128
'19#.#6.143.170':3128
'11#.#9.63.31':3128
'11#.#9.56.41':3128
'19#.#55.210.74':3128
'93.##6.4.124':3128
'80.##.168.140':3128
'20#.#0.103.141':3128
'77.#45.6.90':3128
'41.##0.37.54':3128
'11#.#9.58.55':3128
'18#.#8.140.109':3128
'95.##.255.254':3128
'24.#0.22.49':3128
'85.##0.81.228':3128
'11#.#9.61.31':3128
'2.###.102.33':3128
'11#.#9.60.55':3128
'21#.96.2.58':3128
'2.###.245.145':3128
'95.##2.109.119':3128
'95.#9.34.67':3128
'81.#0.0.17':3128
'19#.#9.30.92':3128
'95.##.88.218':3128
'11#.#9.58.31':3128
'31.##.95.203':3128
'95.#8.37.45':3128
'92.##.121.32':3128
'80.##1.187.32':3128
'46.##0.111.146':3128
'20#.#7.35.90':3128
'41.#02.12.2':3128
'95.##.44.223':3128
'79.##7.47.198':3128
'2.###.209.222':3128
'19#.#7.248.114':3128
'80.##.168.27':3128
'95.#9.40.52':3128
'20#.#4.234.33':3128
'24.#.252.62':3128
'72.##2.191.109':3128
'87.##6.209.173':3128
'37.#9.73.29':3128
'17#.#1.42.78':3128
'77.##6.49.206':3128
'19#.#3.136.35':3128
'11#.#9.49.101':3128
'11#.#9.56.111':3128
'13#.#05.164.43':3128
'19#.#41.145.61':3128
'80.##.168.76':3128
'11#.#9.55.182':3128
'94.##8.50.140':3128
'2.##9.0.243':3128
'11#.#9.63.175':3128
'17#.#0.19.172':3128
'11#.#9.60.118':3128
'92.##.163.42':3128
'18#.#2.200.29':3128
'11#.#9.63.188':3128
'11#.#9.57.111':3128
'92.##.144.243':3128
'20#.#11.108.212':3128
'10#.#00.27.213':3128
'78.##.108.84':3128
'17#.#.170.174':3128
'92.##.15.249':3128
'11#.#9.60.137':3128
'81.##.194.131':3128
'2.###.170.20':3128
'72.##2.176.94':3128
'41.##0.128.248':3128
'20#.#3.135.163':3128
'85.##5.81.189':3128
'37.##0.19.43':3128
'17#.#22.150.151':3128
'95.##.172.243':3128
'11#.#9.58.230':3128
'11#.#9.62.137':3128
'20#.#23.134.213':3128
'18#.#4.86.196':3128
'20#.#10.26.154':3128
'31.#6.40.88':3128
'11#.#9.63.137':3128
'46.##0.111.133':3128
'76.##.177.221':3128
'80.#0.168.1':3128
'19#.#55.210.85':3128
'79.##7.47.200':3128
'17#.#9.129.127':3128
'80.##1.187.31':3128
'95.#8.47.89':3128
'95.##.190.238':3128
'11#.#9.63.118':3128
'19#.#9.161.206':3128
'41.#20.16.4':3128
'19#.#13.196.1':3128
'11#.#9.56.230':3128
'20#.#3.33.108':3128
'20#.#79.72.122':3128
'41.##.17.192':3128
'83.##1.189.118':3128
'82.##8.48.228':3128
'11#.#9.56.31':3128
'95.##.245.50':3128
'95.##.36.242':3128
'19#.#13.92.238':3128
'46.##.235.191':3128
'18#.#2.122.49':3128
'93.##6.154.250':3128
'92.#7.69.5':3128
'19#.#7.239.45':3128
'95.##.41.103':3128
'19#.#5.160.204':3128
'11#.#9.61.35':3128
'92.##5.19.84':3128
'80.##1.187.25':3128
'95.#8.98.89':3128
'20#.#2.179.24':3128
'11#.#9.48.101':3128
'46.##.208.187':3128
'19#.#4.192.174':3128
'11#.#9.63.55':3128
'19#.#06.118.243':3128
'17#.#8.195.30':3128
'18#.#0.151.167':3128
'95.##.34.204':3128
'11#.#9.59.213':3128
'95.##.236.31':3128
'77.#45.6.14':3128
'84.##0.213.163':3128
'2.###.240.72':3128
'2.###.158.205':3128
'87.##4.163.167':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней