Trojan.DownLoader10.3440

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER6a84.dir00\svchost.exe.mdmp 16325836412032828

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER6a84.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#3.34.225':445
'21#.#3.120.80':445
'21#.#3.181.49':445
'21#.#3.221.0':445
'21#.#3.7.157':445
'21#.#3.208.3':139
'21#.#3.74.204':139
'21#.#3.27.171':445
'21#.#3.78.28':139
'21#.#3.167.191':445
'21#.#3.225.238':445
'21#.#3.22.70':445
'21#.#3.126.186':445
'21#.#3.109.127':445
'21#.#3.215.105':445
'21#.#3.21.238':445
'21#.#3.247.12':445
'21#.#3.246.214':445
'21#.#3.163.241':445
'21#.#3.219.74':139
'21#.#3.26.205':139
'21#.#3.87.201':139
'21#.#3.220.212':139
'21#.#3.220.7':139
'21#.#3.11.205':139
'21#.#3.3.120':139
'21#.#3.4.129':139
'21#.#3.102.12':139
'21#.#3.42.208':139
'21#.#3.39.160':139
'21#.#3.96.118':139
'21#.#3.109.48':139
'21#.#3.103.133':139
'21#.#3.186.87':139
'21#.#3.184.170':139
'21#.#3.160.240':139
'21#.#3.251.68':139
'21#.#3.128.212':139
'21#.#3.172.107':139
'21#.#3.187.31':445
'21#.#3.79.160':445
'21#.#3.110.101':445
'21#.#3.34.118':445
'21#.#3.196.218':445
'21#.#3.162.148':445
'21#.#3.5.194':445
'21#.#3.24.156':445
'21#.#3.19.223':445
'21#.#3.77.173':445
'21#.#3.84.112':445
'21#.#3.120.80':139
'21#.#3.7.157':139
'21#.#3.221.0':139
'21#.#3.34.225':139
'21#.#3.27.171':139
'21#.#3.107.159':445
'21#.#3.103.99':445
'21#.#3.74.101':445
'21#.#3.45.158':445
'21#.#3.146.253':445
'21#.#3.69.53':445
'21#.#3.248.181':445
'21#.#3.23.26':445
'21#.#3.221.204':445
'21#.#3.29.37':445
'21#.#3.164.246':445
'21#.#3.44.49':445
'21#.#3.71.136':445
'21#.#3.117.197':445
'21#.#3.191.187':445
'21#.#3.60.175':445
'21#.#3.196.53':445
'21#.#3.218.22':445
'21#.#3.125.46':445
'21#.#3.81.52':445
'21#.#3.208.5':445
'21#.#3.202.133':445
'21#.#3.193.3':445
'21#.#3.15.163':445
'21#.#3.34.152':445
'21#.#3.133.211':445
'21#.#3.4.129':445
'21#.#3.149.82':445
'21#.#3.83.134':445
'21#.#3.247.100':445
'21#.#3.19.69':445
'21#.#3.22.83':445
'21#.#3.173.21':445
'21#.#3.3.120':445
'21#.#3.220.212':445
'21#.#3.220.7':445
'21#.#3.251.68':445
'21#.#3.39.160':445
'21#.#3.26.205':445
'21#.#3.102.12':445
'21#.#3.42.208':445
'21#.#3.87.201':445
'21#.#3.11.205':445
'21#.#3.249.39':445
'21#.#3.203.37':445
'21#.#3.192.203':445
'21#.#3.123.37':445
'21#.#3.31.30':445
'21#.#3.233.148':445
'21#.#3.104.14':445
'21#.#3.32.107':445
'21#.#3.13.49':445
'21#.#3.14.110':445
'21#.#3.46.143':445
'21#.#3.25.21':445
'21#.#3.205.62':445
'21#.#3.55.59':445
'21#.#3.47.201':445
'21#.#3.58.241':445
'21#.#3.123.5':445
'21#.#3.218.246':445
'21#.#3.216.173':445
'21#.#3.193.246':445
'21#.#3.160.240':445
'21#.#3.205.62':139
'21#.#3.58.241':139
'21#.#3.47.201':139
'21#.#3.25.21':139
'21#.#3.216.173':139
'21#.#3.218.246':139
'21#.#3.46.143':139
'21#.#3.193.246':139
'21#.#3.123.5':139
'21#.#3.55.59':139
'21#.#3.133.211':139
'21#.#3.83.134':139
'21#.#3.149.82':139
'21#.#3.34.152':139
'21#.#3.22.83':139
'21#.#3.19.69':139
'21#.#3.249.39':139
'21#.#3.173.21':139
'21#.#3.247.100':139
'21#.#3.123.37':139
'21#.#3.103.133':445
'21#.#3.186.87':445
'21#.#3.74.204':445
'21#.#3.219.74':445
'21#.#3.96.118':445
'21#.#3.128.212':445
'21#.#3.172.107':445
'21#.#3.109.48':445
'21#.#3.184.170':445
'21#.#3.208.3':445
'21#.#3.192.203':139
'21#.#3.233.148':139
'21#.#3.31.30':139
'21#.#3.203.37':139
'21#.#3.13.49':139
'21#.#3.32.107':139
'21#.#3.78.28':445
'21#.#3.14.110':139
'21#.#3.104.14':139
'21#.#3.120.76':445
'21#.#3.231.145':445
'21#.#3.51.130':139
'21#.#3.30.221':445
'21#.#3.115.182':445
'21#.#3.122.211':445
'21#.#3.181.147':445
'21#.#3.197.213':445
'21#.#3.254.108':445
'21#.#3.94.190':139
'21#.73.6.48':139
'21#.#3.103.208':139
'21#.#3.91.45':139
'21#.#3.212.142':139
'21#.#3.218.152':139
'21#.#3.44.144':139
'21#.#3.136.229':139
'21#.#3.135.218':139
'21#.#3.20.135':139
'21#.#3.19.42':445
'21#.#3.209.56':445
'21#.#3.51.209':445
'21#.#3.76.200':445
'21#.#3.37.37':445
'21#.73.4.42':445
'21#.#3.156.73':445
'21#.#3.114.94':445
'21#.#3.254.130':445
'21#.#3.9.111':445
'21#.#3.55.246':445
'21#.#3.129.133':445
'21#.#3.89.169':445
'21#.#3.192.252':445
'21#.#3.100.48':445
'21#.#3.135.89':445
'21#.#3.46.115':445
'21#.#3.20.71':445
'21#.#3.51.135':445
'21#.#3.115.51':445
'21#.#3.190.214':139
'21#.#3.89.169':139
'21#.#3.135.89':139
'21#.#3.100.48':139
'21#.#3.129.133':139
'21#.#3.51.135':139
'21#.#3.20.71':139
'21#.#3.55.246':139
'21#.#3.115.51':139
'21#.#3.46.115':139
'21#.#3.192.252':139
'21#.#3.120.76':139
'21#.#3.115.182':139
'21#.#3.231.145':139
'21#.#3.30.221':139
'21#.#3.254.108':139
'21#.#3.181.147':139
'21#.#3.19.42':139
'21#.#3.122.211':139
'21#.#3.197.213':139
'21#.#3.76.200':139
'21#.#3.105.66':139
'21#.#3.165.248':139
'21#.#3.211.52':139
'21#.#3.107.211':139
'21#.#3.111.165':139
'21#.#3.174.158':139
'21#.#3.201.179':139
'21#.#3.154.111':139
'21#.#3.43.97':139
'21#.73.20.6':139
'21#.#3.51.209':139
'21#.73.4.42':139
'21#.#3.37.37':139
'21#.#3.209.56':139
'21#.#3.254.130':139
'21#.#3.114.94':139
'21#.#3.234.114':139
'21#.#3.9.111':139
'21#.#3.156.73':139
'21#.#3.81.52':139
'21#.#3.193.3':139
'21#.#3.60.175':139
'21#.#3.196.53':139
'21#.#3.15.163':139
'21#.#3.191.187':139
'21#.#3.23.26':139
'21#.#3.208.5':139
'21#.#3.202.133':139
'21#.#3.125.46':139
'21#.#3.162.148':139
'21#.#3.19.223':139
'21#.#3.79.160':139
'21#.#3.110.101':139
'21#.#3.77.173':139
'21#.#3.146.253':139
'21#.#3.218.22':139
'21#.#3.5.194':139
'21#.#3.24.156':139
'21#.#3.221.204':139
'21#.#3.215.105':139
'21#.#3.246.214':139
'21#.#3.225.238':139
'21#.#3.22.70':139
'21#.#3.163.241':139
'21#.#3.167.191':139
'21#.#3.181.49':139
'21#.#3.21.238':139
'21#.#3.247.12':139
'21#.#3.109.127':139
'21#.#3.29.37':139
'21#.#3.71.136':139
'21#.#3.69.53':139
'21#.#3.248.181':139
'21#.#3.117.197':139
'21#.#3.187.31':139
'21#.#3.126.186':139
'21#.#3.164.246':139
'21#.#3.44.49':139
'21#.#3.196.218':139
'21#.#3.91.45':445
'21#.#3.212.142':445
'21#.#3.201.179':445
'21#.#3.190.214':445
'21#.73.6.48':445
'21#.#3.135.218':445
'21#.#3.20.135':445
'21#.#3.103.208':445
'21#.#3.218.152':445
'21#.#3.174.158':445
'21#.#3.211.52':445
'21#.#3.107.211':445
'21#.#3.234.114':445
'21#.73.20.6':445
'21#.#3.105.66':445
'21#.#3.154.111':445
'21#.#3.43.97':445
'21#.#3.165.248':445
'21#.#3.111.165':445
'21#.#3.44.144':445
'21#.#3.20.135':9988
'21#.#3.74.101':139
'21#.#3.91.45':9988
'21#.73.6.48':9988
'21#.#3.45.158':139
'21#.#3.84.112':139
'21#.#3.34.118':139
'21#.#3.107.159':139
'21#.#3.103.99':139
'21#.#3.115.182':9988
'21#.#3.51.130':445
'21#.#3.37.37':9988
'21#.#3.94.190':445
'21#.#3.136.229':445
'21#.#3.30.221':9988
'21#.#3.181.147':9988
'21#.#3.254.108':9988
'21#.#3.231.145':9988
'21#.#3.254.130':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней