Trojan.DownLoader9.51187

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERfbdc.dir00\svchost.exe.mdmp 16325836412032668

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERfbdc.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#38.104.90':445
'21#.#38.117.197':445
'21#.#38.39.135':445
'21#.#38.20.231':445
'21#.#38.230.61':445
'21#.#38.14.194':445
'21#.#38.215.140':445
'21#.#38.28.254':445
'21#.#38.107.131':445
'21#.#38.253.106':445
'21#.#38.120.117':445
'21#.#38.45.50':445
'21#.#38.176.115':445
'21#.#38.153.176':445
'21#.#38.91.25':445
'21#.#38.44.202':445
'21#.#38.79.177':445
'21#.#38.244.38':445
'21#.#38.104.115':445
'21#.#38.112.38':445
'21#.#38.226.89':445
'21#.#38.87.237':445
'21#.#38.141.236':445
'21#.#38.68.100':445
'21#.#38.166.163':445
'21#.#38.42.249':445
'21#.#38.23.34':445
'21#.#38.209.80':445
'21#.#38.162.82':445
'21#.#38.180.118':445
'21#.#38.89.120':445
'21#.#38.202.22':445
'21#.#38.24.158':445
'21#.#38.104.115':139
'21#.#38.68.100':139
'21#.#38.226.89':139
'21#.#38.244.38':139
'21#.#38.141.236':139
'21#.#38.153.198':139
'21#.#38.166.163':139
'21#.#38.87.237':139
'21#.#38.23.34':139
'21#.#38.202.22':139
'21#.#38.162.82':139
'21#.#38.42.249':139
'21#.#38.89.120':139
'21#.#38.112.38':139
'21#.#38.24.158':139
'21#.#38.180.118':139
'21#.#38.163.153':139
'21#.#38.14.189':139
'21#.#38.167.122':139
'21#.#38.65.13':139
'21#.#38.255.64':139
'21#.#38.20.138':445
'21#.#38.118.17':445
'21#.#38.215.179':139
'21#.#38.21.43':445
'21#.#38.201.27':139
'21#.#38.125.187':139
'21#.#38.125.216':139
'21#.#38.125.132':139
'21#.#38.236.58':139
'21#.#38.85.194':139
'21#.#38.72.213':139
'21#.#38.35.136':139
'21#.#38.230.194':139
'21#.#38.122.61':139
'21#.#38.164.12':139
'21#.#38.114.80':139
'21#.#38.193.79':139
'21#.#38.100.193':139
'21#.#38.114.92':139
'21#.#38.79.114':139
'21#.#38.97.221':139
'21#.#38.112.69':139
'21#.#38.133.218':139
'21#.#38.33.136':139
'21#.#38.64.118':139
'21#.#38.99.92':139
'21#.#38.195.110':139
'21#.#38.114.81':139
'21#.#38.79.166':139
'21#.#38.200.91':139
'21#.#38.186.175':139
'21#.#38.99.164':139
'21#.#38.83.29':139
'21#.#38.85.66':139
'21#.#38.183.60':139
'21#.#38.103.148':139
'21#.#38.5.49':139
'21#.#38.36.208':139
'21#.#38.237.151':139
'21#.#38.67.126':139
'21#.#38.54.42':139
'21#.#38.204.104':139
'21#.#38.81.210':139
'21#.#38.72.237':139
'21#.#38.205.77':139
'21#.#38.65.13':445
'21#.#38.255.64':445
'21#.#38.236.58':445
'21#.#38.85.194':445
'21#.#38.215.179':445
'21#.#38.112.193':139
'21#.#38.14.189':445
'21#.#38.167.122':445
'21#.#38.125.216':445
'21#.#38.125.132':445
'21#.#38.153.198':445
'21#.#38.163.153':445
'21#.#38.72.213':445
'21#.#38.35.136':445
'21#.#38.201.27':445
'21#.#38.125.187':445
'21#.#38.214.5':139
'21#.#38.39.114':139
'21#.#38.197.5':139
'21#.#38.33.126':139
'21#.#38.27.15':139
'21#.#38.43.186':139
'21#.#38.44.131':139
'21#.#38.208.65':139
'21#.#38.134.182':139
'21#.#38.73.232':139
'21#.#38.215.112':139
'21#.#38.181.106':139
'21#.#38.195.216':139
'21#.#38.173.125':139
'21#.#38.151.139':139
'21#.#38.231.197':139
'21#.#38.197.231':139
'21#.#38.209.80':139
'21#.#38.250.22':139
'21#.#38.212.85':139
'21#.#38.128.203':139
'21#.#38.155.128':139
'21#.#38.133.76':139
'21#.#38.165.161':139
'21#.#38.139.173':139
'21#.#38.9.221':139
'21#.#38.196.94':139
'21#.#38.74.234':139
'21#.#38.14.67':139
'21#.#38.123.71':139
'21#.#38.83.168':139
'21#.#38.92.147':139
'21#.#38.189.47':139
'21#.#38.133.109':139
'21#.#38.145.243':139
'21#.#38.224.174':445
'21#.#38.55.40':445
'21#.#38.109.132':445
'21#.#38.196.172':445
'21#.#38.118.83':445
'21#.#38.39.199':445
'21#.#38.130.213':445
'21#.#38.137.130':445
'21#.#38.112.101':445
'21#.#38.141.219':445
'21#.#38.69.69':139
'21#.#38.61.234':445
'21#.#38.115.171':445
'21#.#38.126.115':445
'21#.#38.26.146':445
'21#.#38.133.28':445
'21#.#38.55.40':139
'21#.#38.130.213':139
'21#.#38.196.172':139
'21#.#38.224.174':139
'21#.#38.39.199':139
'21#.#38.164.40':139
'21#.#38.137.130':139
'21#.#38.118.83':139
'21#.#38.61.234':139
'21#.#38.115.171':139
'21#.#38.26.146':139
'21#.#38.141.219':139
'21#.#38.112.101':139
'21#.#38.109.132':139
'21#.#38.133.28':139
'21#.#38.126.115':139
'21#.#38.173.164':139
'21#.#38.193.81':139
'21#.#38.18.64':139
'21#.#38.35.55':139
'21#.#38.106.109':139
'21#.#38.192.45':139
'21#.#38.162.23':139
'21#.#38.56.74':139
'21#.#38.220.52':139
'21#.#38.94.183':139
'21#.#38.93.13':139
'21#.#38.226.173':139
'21#.#38.183.226':139
'21#.#38.73.154':139
'21#.#38.109.226':139
'21#.#38.140.178':139
'21#.#38.154.141':139
'21#.#38.165.161':9988
'21#.#38.196.172':9988
'21#.#38.35.55':9988
'21#.#38.183.226':9988
'21#.#38.20.138':139
'21#.#38.118.17':139
'21#.#38.133.109':9988
'21#.#38.21.43':139
'21#.#38.69.69':445
'21#.#38.226.173':9988
'21#.#38.165.161':445
'21#.#38.145.243':445
'21#.#38.112.101':9988
'21#.#38.61.234':9988
'21#.#38.26.146':9988
'21#.#38.145.243':9988
'21#.#38.120.117':139
'21#.#38.117.197':139
'21#.#38.215.140':139
'21#.#38.20.231':139
'21#.#38.104.90':139
'21#.#38.14.194':139
'21#.#38.79.177':139
'21#.#38.28.254':139
'21#.#38.230.61':139
'21#.#38.253.106':139
'21#.#38.91.25':139
'21#.#38.45.50':139
'21#.#38.107.131':139
'21#.#38.153.176':139
'21#.#38.39.135':139
'21#.#38.44.202':139
'21#.#38.176.115':139
'21#.#38.35.55':445
'21#.#38.106.109':445
'21#.#38.73.154':445
'21#.#38.109.226':445
'21#.#38.56.74':445
'21#.#38.220.52':445
'21#.#38.193.81':445
'21#.#38.18.64':445
'21#.#38.226.173':445
'21#.#38.183.226':445
'21#.#38.164.40':445
'21#.#38.173.164':445
'21#.#38.140.178':445
'21#.#38.154.141':445
'21#.#38.94.183':445
'21#.#38.93.13':445
'21#.#38.192.45':445
'21#.#38.155.128':445
'21#.#38.212.85':445
'21#.#38.92.147':445
'21#.#38.128.203':445
'21#.#38.9.221':445
'21#.#38.133.76':445
'21#.#38.250.22':445
'21#.#38.139.173':445
'21#.#38.123.71':445
'21#.#38.196.94':445
'21#.#38.162.23':445
'21#.#38.14.67':445
'21#.#38.133.109':445
'21#.#38.83.168':445
'21#.#38.74.234':445
'21#.#38.189.47':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней