Trojan.DownLoader10.8744

Добавлен в вирусную базу Dr.Web: 2013-08-24

Описание добавлено: 2013-08-24

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER5866.dir00\svchost.exe.mdmp 16325836412032608

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER5866.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'58.##4.184.191':445
'58.##4.201.36':445
'58.##4.179.191':445
'58.##4.16.120':445
'58.##4.228.191':445
'58.##4.198.139':445
'58.##4.114.119':445
'58.##4.191.114':445
'58.##4.96.248':445
'58.##4.226.33':445
'58.##4.106.167':139
'58.##4.113.87':445
'58.##4.41.134':445
'58.##4.192.30':445
'58.##4.150.226':445
'58.##4.181.218':445
'58.##4.5.206':445
'58.##4.255.125':445
'58.##4.46.171':445
'58.##4.45.76':445
'58.##4.137.203':445
'58.##4.116.238':445
'58.##4.36.57':445
'58.##4.182.167':445
'58.##4.181.10':445
'58.##4.56.157':445
'58.##4.169.250':445
'58.##4.67.51':445
'58.##4.76.222':445
'58.##4.135.162':445
'58.##4.105.40':445
'58.#04.77.8':445
'58.##4.182.167':139
'58.##4.137.203':139
'58.##4.255.125':139
'58.##4.36.57':139
'58.##4.192.12':139
'58.##4.235.42':139
'58.##4.116.238':139
'58.##4.158.181':139
'58.#04.77.8':139
'58.##4.76.222':139
'58.##4.56.157':139
'58.##4.105.40':139
'58.##4.45.76':139
'58.##4.5.206':139
'58.##4.135.162':139
'58.##4.46.171':139
'58.##4.69.250':139
'58.##4.1.154':139
'58.##4.75.236':139
'58.##4.112.199':139
'58.##4.11.207':139
'58.##4.15.157':139
'58.##4.79.101':139
'58.##4.179.104':139
'58.#04.81.6':139
'58.##4.186.78':139
'58.##4.23.134':139
'58.##4.156.56':139
'58.##4.176.165':139
'58.##4.105.187':139
'58.##4.17.236':139
'58.##4.194.134':139
'58.##4.158.181':445
'58.##4.56.43':139
'58.##4.227.183':139
'58.##4.233.150':139
'58.#04.34.9':139
'58.##4.3.112':139
'58.##4.203.172':139
'58.##4.21.71':139
'58.##4.62.138':139
'58.##4.206.174':139
'58.##4.116.174':139
'58.##4.35.29':139
'58.##4.102.197':139
'58.##4.233.170':139
'58.##4.43.186':139
'58.##4.29.103':139
'58.##4.115.35':139
'58.##4.245.235':139
'58.##4.15.43':139
'58.##4.90.153':139
'58.##4.230.145':139
'58.##4.116.174':445
'58.##4.107.90':445
'58.##4.125.74':139
'58.##4.107.90':139
'58.##4.82.64':139
'58.##4.215.78':139
'58.##4.123.102':139
'58.##4.66.98':139
'58.##4.222.74':139
'58.##4.147.88':139
'58.##4.4.163':139
'58.##4.113.37':139
'58.##4.75.236':445
'58.##4.112.199':445
'58.##4.176.165':445
'58.##4.105.187':445
'58.##4.79.101':445
'58.##4.179.104':445
'58.##4.69.250':445
'58.##4.1.154':445
'58.##4.23.134':445
'58.##4.156.56':445
'58.##4.192.12':445
'58.##4.235.42':445
'58.##4.17.236':445
'58.##4.194.134':445
'58.#04.81.6':445
'58.##4.186.78':445
'58.##4.57.253':139
'58.##4.253.125':139
'58.##4.125.207':139
'58.##4.191.96':139
'58.##4.40.176':139
'58.#04.77.3':139
'58.##4.249.83':139
'58.##4.119.154':139
'58.##4.106.167':445
'58.##4.223.5':139
'58.##4.11.207':445
'58.##4.15.157':445
'58.##4.187.59':139
'58.##4.206.187':139
'58.##4.163.122':139
'58.##4.203.75':139
'58.##4.24.64':139
'58.##4.93.113':139
'58.##4.78.172':139
'58.##4.231.49':139
'58.##4.109.43':139
'58.##4.254.79':139
'58.##4.122.96':139
'58.##4.43.123':139
'58.##4.133.14':139
'58.##4.30.158':139
'58.##4.21.230':139
'58.##4.176.207':139
'58.#04.8.3':139
'58.##4.49.219':139
'58.##4.90.239':139
'58.#04.3.91':139
'58.##4.57.139':445
'58.##4.217.228':445
'58.##4.111.204':445
'58.#04.0.15':445
'58.##4.46.62':445
'58.##4.32.78':445
'58.##4.146.76':445
'58.##4.15.180':445
'58.##4.87.90':139
'58.##4.149.13':445
'58.##4.127.247':139
'58.##4.183.41':139
'58.##4.14.81':445
'58.##4.61.81':445
'58.##4.88.184':445
'58.##4.160.249':445
'58.##4.15.180':139
'58.##4.46.62':139
'58.##4.217.228':139
'58.##4.146.76':139
'58.##4.207.192':139
'58.##4.106.110':139
'58.##4.32.78':139
'58.##4.32.183':139
'58.##4.111.204':139
'58.##4.160.249':139
'58.##4.88.184':139
'58.##4.61.81':139
'58.#04.0.15':139
'58.##4.57.139':139
'58.##4.149.13':139
'58.##4.14.81':139
'58.##4.27.29':139
'58.##4.24.92':139
'58.##4.103.250':139
'58.##4.17.10':139
'58.##4.230.44':139
'58.#04.51.4':139
'58.##4.248.77':139
'58.##4.38.203':139
'58.##4.42.211':139
'58.##4.94.47':139
'58.##4.203.39':139
'58.##4.143.91':139
'58.##4.45.59':139
'58.##4.106.5':139
'58.##4.56.154':139
'58.##4.66.156':139
'58.##4.32.183':445
'58.##4.30.158':9988
'58.##4.90.239':9988
'58.##4.146.76':9988
'58.##4.230.44':9988
'58.##4.113.87':139
'58.##4.96.248':139
'58.##4.127.247':9988
'58.##4.109.43':9988
'58.##4.87.90':445
'58.##4.109.43':445
'58.##4.127.247':445
'58.##4.254.79':445
'58.##4.32.78':9988
'58.##4.88.184':9988
'58.##4.183.41':445
'58.##4.14.81':9988
'58.##4.191.114':139
'58.##4.228.191':139
'58.##4.201.36':139
'58.##4.114.119':139
'58.##4.67.51':139
'58.##4.181.10':139
'58.##4.198.139':139
'58.##4.169.250':139
'58.##4.181.218':139
'58.##4.41.134':139
'58.##4.226.33':139
'58.##4.150.226':139
'58.##4.16.120':139
'58.##4.184.191':139
'58.##4.192.30':139
'58.##4.179.191':139
'58.##4.103.250':445
'58.##4.17.10':445
'58.##4.45.59':445
'58.##4.106.5':445
'58.##4.248.77':445
'58.##4.38.203':445
'58.##4.27.29':445
'58.##4.24.92':445
'58.##4.203.39':445
'58.##4.143.91':445
'58.##4.207.192':445
'58.##4.106.110':445
'58.##4.94.47':445
'58.##4.42.211':445
'58.##4.56.154':445
'58.##4.66.156':445
'58.##4.78.172':445
'58.##4.231.49':445
'58.#04.8.3':445
'58.##4.49.219':445
'58.##4.122.96':445
'58.##4.43.123':445
'58.##4.24.64':445
'58.##4.93.113':445
'58.##4.21.230':445
'58.##4.176.207':445
'58.##4.230.44':445
'58.#04.51.4':445
'58.##4.90.239':445
'58.#04.3.91':445
'58.##4.30.158':445
'58.##4.133.14':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней