Trojan.DownLoader10.3424

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER40c7.dir00\svchost.exe.mdmp 16325836412029696

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER40c7.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'12#.#48.105.56':445
'12#.#48.147.80':445
'12#.#48.225.216':445
'12#.#48.186.125':445
'12#.#48.66.164':445
'12#.#48.214.39':445
'12#.#48.20.37':445
'12#.#48.148.193':445
'12#.#48.24.16':445
'12#.#48.157.201':445
'12#.#48.62.124':445
'12#.#48.189.236':445
'12#.#48.254.28':445
'12#.#48.136.82':445
'12#.#48.203.105':445
'12#.#48.127.124':445
'12#.#48.152.214':445
'12#.#48.104.131':445
'12#.#48.181.13':445
'12#.#48.41.55':445
'12#.#48.17.146':445
'12#.#48.217.182':445
'12#.#48.50.8':445
'12#.#48.101.67':445
'12#.#48.55.104':445
'12#.#48.225.158':445
'12#.#48.16.235':445
'12#.#48.86.152':445
'12#.#48.71.16':445
'12#.#48.34.227':445
'12#.#48.36.89':445
'12#.#48.11.178':445
'12#.#48.128.124':445
'12#.#48.181.13':139
'12#.#48.101.67':139
'12#.#48.17.146':139
'12#.#48.104.131':139
'12#.#48.50.8':139
'12#.#48.38.223':139
'12#.#48.55.104':139
'12#.#48.217.182':139
'12#.#48.16.235':139
'12#.#48.11.178':139
'12#.#48.71.16':139
'12#.#48.225.158':139
'12#.#48.36.89':139
'12#.#48.41.55':139
'12#.#48.128.124':139
'12#.#48.34.227':139
'12#.#48.157.204':139
'12#.#48.242.10':139
'12#.#48.108.97':139
'12#.#48.156.107':139
'12#.#48.40.225':139
'12#.#48.56.157':445
'12#.#48.67.180':445
'12#.#48.200.249':139
'12#.#48.16.155':139
'12#.#48.4.215':139
'12#.#48.103.17':139
'12#.#48.212.248':139
'12#.#48.230.17':139
'12#.#48.172.35':139
'12#.#48.0.117':139
'12#.#48.13.12':139
'12#.#48.189.96':139
'12#.#48.38.223':445
'12#.#48.212.21':139
'12#.#48.116.6':139
'12#.#48.69.243':139
'12#.#48.112.132':139
'12#.#48.114.244':139
'12#.#48.61.249':139
'12#.#48.128.160':139
'12#.#48.244.128':139
'12#.#48.187.166':139
'12#.#48.76.32':139
'12#.#48.105.86':139
'12#.#48.212.196':139
'12#.#48.71.42':139
'12#.#48.35.142':139
'12#.#48.3.168':139
'12#.#48.126.240':139
'12#.#48.237.87':139
'12#.#48.107.127':139
'12#.#48.76.122':139
'12#.#48.129.164':139
'12#.#48.50.150':139
'12#.#48.200.8':139
'12#.#48.73.200':139
'12#.#48.128.249':139
'12#.#48.96.237':139
'12#.#48.47.192':139
'12#.#48.180.53':139
'12#.#48.81.67':139
'12#.#48.113.175':139
'12#.#48.117.40':139
'12#.#48.251.53':139
'12#.#48.195.150':139
'12#.#48.224.194':139
'12#.#48.40.225':445
'12#.#48.242.10':445
'12#.#48.0.117':445
'12#.#48.156.107':445
'12#.#48.16.155':445
'12#.#48.27.119':139
'12#.#48.108.97':445
'12#.#48.200.249':445
'12#.#48.230.17':445
'12#.#48.4.215':445
'12#.#48.157.204':445
'12#.#48.212.248':445
'12#.#48.189.96':445
'12#.#48.172.35':445
'12#.#48.103.17':445
'12#.#48.13.12':445
'12#.#48.160.111':139
'12#.#48.0.139':139
'12#.#48.254.176':139
'12#.#48.101.109':139
'12#.#48.210.240':139
'12#.#48.140.242':139
'12#.#48.86.110':139
'12#.#48.130.21':139
'12#.#48.205.203':139
'12#.#48.216.221':139
'12#.#48.214.216':139
'12#.#48.77.186':139
'12#.#48.207.205':139
'12#.#48.222.8':139
'12#.#48.8.66':139
'12#.#48.151.45':139
'12#.#48.8.213':139
'12#.#48.86.152':139
'12#.#48.239.183':139
'12#.#48.22.240':139
'12#.#48.57.221':139
'12#.#48.5.221':139
'12#.#48.76.155':139
'12#.#48.191.254':139
'12#.#48.225.156':139
'12#.#48.6.242':139
'12#.#48.226.71':139
'12#.#48.153.226':139
'12#.#48.26.111':139
'12#.#48.72.67':139
'12#.#48.47.10':139
'12#.#48.220.233':139
'12#.#48.57.54':139
'12#.#48.4.39':139
'12#.#48.89.192':139
'12#.#48.226.215':445
'12#.#48.132.204':445
'12#.#48.160.114':445
'12#.#48.22.4':445
'12#.#48.181.142':445
'12#.#48.13.29':445
'12#.#48.64.227':445
'12#.#48.210.62':445
'12#.#48.63.244':445
'12#.#48.15.9':445
'12#.#48.249.236':139
'12#.#48.88.77':445
'12#.#48.88.129':445
'12#.#48.58.116':445
'12#.#48.122.224':445
'12#.#48.216.5':445
'12#.#48.210.62':139
'12#.#48.88.77':139
'12#.#48.132.204':139
'12#.#48.122.224':139
'12#.#48.13.29':139
'12#.#48.95.34':139
'12#.#48.63.244':139
'12#.#48.181.142':139
'12#.#48.88.129':139
'12#.#48.58.116':139
'12#.#48.226.215':139
'12#.#48.64.227':139
'12#.#48.15.9':139
'12#.#48.216.5':139
'12#.#48.160.114':139
'12#.#48.22.4':139
'12#.#48.190.221':139
'12#.#48.174.25':139
'12#.#48.222.1':139
'12#.#48.235.117':139
'12#.#48.213.235':139
'12#.#48.36.252':139
'12#.#48.250.243':139
'12#.#48.2.52':139
'12#.#48.118.107':139
'12#.#48.103.58':139
'12#.#48.227.103':139
'12#.#48.179.36':139
'12#.#48.58.96':139
'12#.#48.93.72':139
'12#.#48.56.187':139
'12#.#48.98.227':139
'12#.#48.72.99':139
'12#.#48.95.34':445
'12#.#48.98.227':9988
'12#.#48.250.243':9988
'12#.#48.181.142':9988
'12#.#48.58.96':9988
'12#.#48.56.157':139
'12#.#48.67.180':139
'12#.#48.26.111':9988
'12#.#48.153.226':9988
'12#.#48.88.77':9988
'12#.#48.216.5':9988
'12#.#48.89.192':445
'12#.#48.249.236':445
'12#.#48.122.224':9988
'12#.#48.88.129':9988
'12#.#48.63.244':9988
'12#.#48.160.114':9988
'12#.#48.62.124':139
'12#.#48.147.80':139
'12#.#48.20.37':139
'12#.#48.186.125':139
'12#.#48.105.56':139
'12#.#48.214.39':139
'12#.#48.152.214':139
'12#.#48.148.193':139
'12#.#48.66.164':139
'12#.#48.157.201':139
'12#.#48.203.105':139
'12#.#48.189.236':139
'12#.#48.24.16':139
'12#.#48.136.82':139
'12#.#48.225.216':139
'12#.#48.127.124':139
'12#.#48.254.28':139
'12#.#48.213.235':445
'12#.#48.174.25':445
'12#.#48.93.72':445
'12#.#48.235.117':445
'12#.#48.36.252':445
'12#.#48.118.107':445
'12#.#48.222.1':445
'12#.#48.2.52':445
'12#.#48.58.96':445
'12#.#48.103.58':445
'12#.#48.190.221':445
'12#.#48.179.36':445
'12#.#48.72.99':445
'12#.#48.56.187':445
'12#.#48.227.103':445
'12#.#48.98.227':445
'12#.#48.250.243':445
'12#.#48.239.183':445
'12#.#48.22.240':445
'12#.#48.57.221':445
'12#.#48.5.221':445
'12#.#48.76.155':445
'12#.#48.191.254':445
'12#.#48.225.156':445
'12#.#48.6.242':445
'12#.#48.226.71':445
'12#.#48.153.226':445
'12#.#48.26.111':445
'12#.#48.72.67':445
'12#.#48.47.10':445
'12#.#48.220.233':445
'12#.#48.57.54':445
'12#.#48.4.39':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней