Trojan.DownLoader2.28989

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'41.##3.57.72':3128
'21#.#6.136.165':3128
'18#.#5.48.25':3128
'18#.#5.218.108':3128
'46.##7.131.42':3128
'83.##5.73.118':3128
'18#.#21.135.75':3128
'18#.#12.138.52':3128
'77.##4.158.188':3128
'19#.#8.8.117':3128
'18#.#8.164.142':3128
'22#.#2.80.18':3128
'18#.#0.44.196':3128
'94.##8.194.147':3128
'94.##.95.151':3128
'61.##.217.171':3128
'82.##1.88.128':3128
'18#.#20.226.164':3128
'91.##6.161.145':3128
'20#.#6.252.83':3128
'46.##8.201.141':3128
'18#.#6.43.141':3128
'21#.#5.100.178':3128
'92.##5.174.196':3128
'19#.#07.110.169':3128
'12#.#8.95.39':3128
'11#.#04.70.235':3128
'18#.#25.23.157':3128
'21#.#86.50.94':3128
'62.##9.196.203':3128
'12#.#65.113.231':3128
'11#.#12.131.155':3128
'11#.#12.131.207':3128
'24.##2.25.216':3128
'94.##1.188.45':3128
'22#.#6.233.35':3128
'79.##1.18.26':3128
'92.##.38.223':3128
'95.##.71.141':3128
'95.##2.11.132':3128
'95.##2.33.169':3128
'84.#2.8.72':3128
'77.##7.13.118':3128
'95.##.214.37':3128
'79.##3.199.125':3128
'11#.#12.131.138':3128
'19#.#06.212.28':3128
'12#.#65.113.205':3128
'20#.#5.246.141':3128
'41.#8.2.92':3128
'11#.#5.41.19':3128
'79.##9.170.2':3128
'18#.#96.132.93':3128
'41.##1.129.160':3128
'19#.#55.209.74':3128
'19#.#2.184.2':3128
'82.##2.103.247':3128
'11#.#4.65.217':3128
'12#.#7.93.41':3128
'20#.#50.67.253':3128
'18#.#9.20.130':3128
'72.##2.188.10':3128
'21#.#02.24.139':3128
'17#.#56.140.88':3128
'19#.#25.236.208':3128
'79.##5.35.14':3128
'22#.#2.80.14':3128
'17#.#40.114.174':3128
'41.#8.3.5':3128
'11#.#48.73.106':3128
'41.#8.2.215':3128
'20#.#7.212.60':3128
'84.##9.88.71':3128
'17#.#4.226.14':3128
'18#.#73.201.5':3128
'18#.#3.64.157':3128
'18#.#14.34.197':3128
'11#.#36.76.251':3128
'11#.#12.131.200':3128
'87.##6.203.32':3128
'19#.#9.197.242':3128
'11#.#41.136.60':3128
'22#.#43.60.253':3128
'79.##0.198.152':3128
'62.##3.174.192':3128
'88.##5.40.159':3128
'18#.26.8.38':3128
'21#.#46.192.45':3128
'11#.#06.148.138':3128
'11#.#8.240.37':3128
'59.#5.27.8':3128
'77.#1.31.43':3128
'20#.#09.221.23':3128
'18#.#25.22.152':3128
'95.##2.65.207':3128
'22#.#7.120.3':3128
'20#.#17.44.8':3128
'77.##6.168.104':3128
'11#.#04.64.121':3128
'20#.#62.217.100':3128
'19#.#58.53.209':3128
'89.##3.69.41':3128
'89.##2.60.78':3128
'78.##2.45.86':3128
'93.##6.235.9':3128
'89.##7.75.85':3128
'11#.#86.176.225':3128
'62.##8.214.33':3128
'95.##.167.125':3128
'85.##5.57.22':3128
'11#.44.7.63':3128
'41.#8.2.170':3128
'11#.#2.163.177':3128
'19#.#31.213.225':3128
'18#.#37.9.125':3128
'59.#4.66.10':3128
'10#.#6.130.98':3128
'18#.#7.22.150':3128
'84.##9.68.98':3128
'60.##3.48.164':3128
'18#.80.0.50':3128
'21#.#32.182.213':3128
'95.##2.226.113':3128
'60.##4.78.236':3128
'86.##5.190.5':3128
'82.##4.68.29':3128
'87.##0.166.58':3128
'17#.#12.26.110':3128
'19#.#86.144.225':3128
'85.##8.182.128':3128
'20#.#22.206.121':3128
'13#.#.157.199':3128
'19#.#2.243.146':3128
'86.##7.239.143':3128
'20#.#38.120.25':3128
'11#.#6.206.49':3128
'11#.#2.218.27':3128
'85.##8.138.219':3128
'61.##.190.24':3128
'11#.#7.184.29':3128
'11#.#42.120.211':3128
'10#.#4.98.55':3128
'18#.#9.39.34':3128
'17#.#48.245.192':3128
'11#.#12.131.201':3128
'18#.#25.187.120':3128
'12#.#18.153.19':3128
'77.##6.57.118':3128
'11#.#52.138.225':3128
'62.##3.176.118':3128
'59.##3.48.153':3128
'11#.#41.32.76':3128
'81.##3.238.5':3128
'20#.#62.60.235':3128
'12#.#22.108.76':3128
'84.##8.70.161':3128
'12#.#45.22.38':3128
'11#.#6.46.204':3128
'19#.#2.152.21':3128
'11#.#04.64.227':3128
'79.##5.253.7':3128
'11#.#65.14.146':3128
'59.##3.52.133':3128
'19#.#26.148.225':3128
'68.##.102.81':3128
'11#.#48.188.120':3128
'12#.#22.107.202':3128
'11#.#12.131.156':3128
'12#.#40.44.135':3128
'89.##9.226.173':3128
'19#.#86.6.239':3128
'91.##.240.237':3128
'83.#.202.188':3128
'41.#8.3.27':3128
'19#.#2.129.179':3128
'20#.#31.19.250':3128
'11#.#42.167.35':3128
'12#.#58.235.247':3128
'20#.#26.77.113':3128
'20#.#65.165.252':3128
'21#.#32.245.19':3128
'84.##2.49.159':3128
'58.#.53.217':3128
'59.##3.51.21':3128
'11#.#04.66.101':3128
'82.##5.46.58':3128
'18#.#0.144.111':3128
'77.##6.164.130':3128
'11#.#12.131.144':3128
'41.##1.112.152':3128
'19#.#5.233.166':3128
'19#.#25.208.136':3128
'18#.#0.150.204':3128
'18#.#1.154.145':3128
'41.#8.2.189':3128
'11#.#54.127.193':3128
'85.##6.250.116':3128
'79.##9.202.44':3128
'41.##1.150.146':3128
'89.##.251.169':3128
'18#.#62.62.157':3128
'22#.#25.22.14':3128
'18#.#2.135.122':3128
'21#.#2.200.158':3128
'21#.#32.148.188':3128
'18#.#0.218.207':3128
'18#.#8.112.37':3128
'84.##0.153.243':3128
'94.##8.27.97':3128
'19#.#84.8.104':3128
'11#.#41.137.13':3128
'12#.#81.201.75':3128
'95.##.238.24':3128
'59.##3.55.231':3128
'11#.#04.70.247':3128
'14#.#16.1.47':3128
'17#.#2.88.114':3128
'19#.#31.208.120':3128
'89.##3.134.172':3128
'78.##.116.26':3128
'59.##3.51.145':3128
'19#.#06.218.62':3128
'19#.#21.216.173':3128
'22#.#04.213.197':3128
'19#.#13.40.191':3128
'83.##.232.105':3128
'11#.#3.48.97':3128
'22#.#43.182.50':3128
'22#.#27.155.17':3128
'19#.#3.84.19':3128
'95.#6.29.22':3128
'12#.#27.65.149':3128
'61.##.192.32':3128
'11#.#12.131.214':3128
'19#.#3.163.49':3128
'85.##.109.202':3128
'12#.#21.212.131':3128
'77.##4.54.208':3128
'18#.#92.202.209':3128
'77.##4.143.98':3128
'18#.#2.254.74':3128
'21#.#86.183.4':3128
'12#.#44.8.237':3128
'19#.#6.196.3':3128
'91.##6.157.147':3128
'83.##.210.118':3128
'19#.#04.74.153':3128
'84.##9.74.194':3128
'11#.#5.201.189':3128
'89.##2.109.116':3128
'19#.#1.46.12':3128
'12#.#89.106.163':3128
'20#.#01.45.5':3128
'20#.#67.53.132':3128
'77.##4.137.162':3128
'61.##7.100.211':3128
'19#.#2.137.86':3128
'82.##7.106.170':3128
'18#.#5.81.165':3128
'11#.#04.65.78':3128
'20#.#54.63.147':3128
'59.##.163.83':3128
'19#.#06.214.203':3128
'22#.#20.31.112':3128
'93.##3.175.22':3128
'74.#15.5.41':3128
'11#.#04.67.174':3128
'21#.#6.25.163':3128
'22#.#20.58.230':3128
'22#.#43.62.44':3128
'19#.#85.16.45':3128
'19#.#5.26.198':3128
'62.##0.156.34':3128
'11#.#04.66.216':3128
'81.##.215.203':3128
'18#.2.93.9':3128
'18#.#46.40.179':3128
'95.##1.246.86':3128
'41.##1.251.106':3128
'12#.#27.64.26':3128
'17#.#65.19.33':3128
'78.##.73.199':3128
'94.##8.86.48':3128
'11#.#11.37.202':3128
'41.##3.57.74':3128
'11#.#3.240.46':3128
'85.##2.221.8':3128
'88.#7.14.23':3128
'61.##.71.187':3128
'88.##5.193.113':3128
'94.##2.239.203':3128
'59.##3.52.245':3128
'11#.#04.73.9':3128
'11#.#3.66.140':3128
'92.##.86.205':3128
'86.##5.144.234':3128
'83.##8.82.159':3128
'11#.#2.218.96':3128
'12#.#22.108.111':3128
'19#.#2.220.243':3128
'18#.#0.12.20':3128
'18#.#7.17.218':3128
'11#.#41.136.43':3128
'19#.#51.53.33':3128
'19#.#7.38.89':3128
'41.#43.6.14':3128
'19#.#1.125.206':3128
'20#.#9.201.9':3128
'77.##6.141.8':3128
'11#.#65.2.118':3128
'19#.#31.208.144':3128
'18#.#0.233.63':3128
'95.##8.203.1':3128
'62.##3.159.36':3128
'12#.#22.106.169':3128
'18#.80.4.59':3128
'12#.#25.18.187':3128
'41.##5.54.223':3128
'19#.#7.188.133':3128
'94.#78.4.40':3128
'11#.#8.240.45':3128
'12#.#00.3.29':3128
'18#.#3.208.68':3128
'17#.#48.249.122':3128
'17#.#02.191.42':3128
'19#.#03.111.51':3128
'12#.#71.120.81':3128
'85.##0.81.228':3128
'11#.#41.136.150':3128
'18#.#92.154.187':3128
'70.##.116.31':3128
'87.##7.49.67':3128
'19#.#5.139.39':3128
'11#.#04.64.252':3128
'18#.#.196.28':3128
'77.##0.161.40':3128
'82.##4.163.132':3128
'95.##.152.16':3128
'20#.#65.242.198':3128
'84.##8.128.231':3128
'89.#.168.48':3128
'20#.#17.51.159':3128
'59.##3.49.42':3128
'20#.#64.238.149':3128
'11#.#16.62.235':3128
'41.##1.205.181':3128
'18#.#2.80.42':3128
'21#.#19.69.150':3128
'59.##3.54.57':3128
'77.##7.55.44':3128
'77.##2.209.143':3128
'11#.#04.64.202':3128
'18#.#08.214.22':3128
'82.##1.88.129':3128
'61.##7.192.67':3128
'20#.#43.5.17':3128
'77.##4.238.137':3128
'41.##4.174.117':3128
'20#.#09.62.172':3128
'19#.#32.139.32':3128
'85.##6.139.163':3128
'41.##3.57.76':3128
'11#.#12.131.132':3128
'11#.#68.150.66':3128
'11#.#84.53.156':3128
'94.##8.141.84':3128
'59.##3.48.191':3128
'19#.#03.81.118':3128
'95.##2.47.54':3128
'17#.#23.78.135':3128
'59.#6.91.50':3128
'18#.80.69.5':3128
'22#.52.80.2':3128
'62.##.110.66':3128
'60.##0.147.209':3128
'41.##1.42.115':3128
'19#.#1.117.6':3128
'18#.#2.85.136':3128
'88.##7.39.20':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней