Trojan.DownLoader5.18354

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Tcpz-x86] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\dumprep.exe 1144 -dm 7 7 %TEMP%\WERfeff.dir00\svchost.exe.mdmp 16325836412032396

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Templates\Tcpz-x86.sys

Присваивает атрибут 'скрытый' для следующих файлов:

<Полный путь к вирусу>

Удаляет следующие файлы:

%HOMEPATH%\Templates\Tcpz-x86.sys

Сетевая активность:

Подключается к:

'9.##5.129.7':445
'9.##5.129.5':445
'9.###.129.10':445
'9.###.129.11':445
'9.##5.129.9':445
'9.###.128.158':1433
'9.###.128.159':1433
'9.##5.129.4':445
'9.##5.129.8':445
'9.##5.129.6':445
'9.##5.129.3':445
'9.###.128.160':1433
'9.###.128.194':1433
'9.###.128.189':1433
'9.###.128.174':1433
'9.###.128.168':1433
'9.###.128.186':1433
'9.###.128.162':1433
'9.###.128.172':1433
'9.###.128.205':1433
'9.##5.129.2':445
'9.###.128.251':445
'9.###.128.248':445
'9.###.128.252':445
'9.###.128.254':445
'9.###.128.253':445
'9.###.128.246':445
'9.###.128.163':1433
'9.###.128.249':445
'9.###.128.157':1433
'9.###.128.124':1433
'9.###.128.171':1433
'9.##5.129.1':445
'9.###.128.184':1433
'9.###.128.193':1433
'9.###.128.155':1433
'9.###.128.192':1433
'9.###.128.169':1433
'9.###.128.255':445
'9.###.128.148':1433
'9.##5.129.0':445
'9.###.128.181':1433
'9.###.129.25':445
'9.###.128.178':1433
'9.###.129.27':445
'9.###.129.26':445
'9.###.129.24':445
'9.###.128.179':1433
'9.###.128.212':1433
'9.###.128.225':1433
'9.###.128.190':1433
'9.###.129.15':1433
'9.###.129.31':445
'9.###.129.35':445
'9.###.129.32':445
'9.###.129.18':1433
'9.###.129.29':445
'9.###.129.28':445
'9.###.128.229':1433
'9.###.129.30':445
'9.###.128.221':1433
'9.###.129.23':445
'9.###.129.17':445
'9.###.128.187':1433
'9.###.129.15':445
'9.###.129.16':445
'9.###.129.19':445
'9.###.129.13':445
'9.###.128.198':1433
'9.###.129.12':445
'9.###.129.14':445
'9.###.128.255':1433
'9.###.129.21':445
'9.###.129.22':445
'9.###.128.183':1433
'9.###.128.173':1433
'9.###.128.200':1433
'9.###.128.208':1433
'9.###.128.250':1433
'9.###.129.18':445
'9.###.129.20':445
'9.###.128.246':1433
'9.###.128.218':445
'9.###.128.212':445
'9.###.128.153':1433
'9.###.128.215':445
'9.###.128.213':445
'9.###.128.113':1433
'9.###.128.167':1433
'9.###.128.123':1433
'9.###.128.214':445
'9.###.128.216':445
'9.###.128.220':445
'9.###.128.177':1433
'9.###.128.170':1433
'9.###.128.110':1433
'9.###.128.136':1433
'9.###.128.217':445
'9.###.128.219':445
'9.###.128.154':1433
'9.###.128.180':1433
'9.###.128.207':1433
'9.###.128.107':1433
'9.###.128.126':1433
'9.###.128.209':445
'9.###.128.132':1433
'9.###.128.109':1433
'9.###.128.191':1433
'9.###.128.188':1433
'9.###.128.108':1433
'9.###.128.137':1433
'9.###.128.128':1433
'9.###.128.185':1433
'9.###.128.211':445
'9.###.128.210':445
'9.###.128.199':1433
'9.###.128.147':1433
'9.###.128.201':1433
'9.###.128.115':1433
'9.###.128.119':1433
'9.###.128.196':1433
'9.###.128.195':1433
'9.###.128.133':1433
'9.###.128.239':445
'9.###.128.238':445
'9.###.128.151':1433
'9.###.128.240':445
'9.###.128.241':445
'9.###.128.165':1433
'9.###.128.235':445
'9.###.128.236':445
'9.###.128.237':445
'9.###.128.152':1433
'9.###.128.245':445
'9.###.128.227':1433
'9.###.128.161':1433
'9.###.128.247':445
'9.###.128.250':445
'9.###.128.243':445
'9.###.128.242':445
'9.###.128.244':445
'9.###.128.164':1433
'9.###.128.176':1433
'9.###.128.233':445
'9.###.128.225':445
'9.###.128.203':1433
'9.###.128.224':445
'9.###.128.122':1433
'9.###.128.226':445
'9.###.128.156':1433
'9.###.128.221':445
'9.###.128.222':445
'9.###.128.204':1433
'9.###.128.223':445
'9.###.128.230':445
'9.###.128.149':1433
'9.###.128.231':445
'9.###.128.234':445
'9.###.128.232':445
'9.###.128.228':445
'9.###.128.150':1433
'9.###.128.229':445
'9.###.128.210':1433
'9.###.128.227':445
'9.###.128.240':1433
'9.###.129.92':445
'9.###.128.237':1433
'9.###.129.23':1433
'9.###.128.249':1433
'9.###.129.90':445
'9.###.129.89':445
'9.###.129.93':445
'9.###.129.91':445
'9.###.129.35':1433
'9.###.129.95':445
'9.##5.129.3':1433
'9.###.129.96':445
'9.###.128.253':1433
'9.###.129.13':1433
'9.##5.129.5':1433
'9.###.129.22':1433
'9.###.129.12':1433
'9.##5.129.6':1433
'9.###.129.94':445
'9.###.129.87':445
'9.###.129.47':1433
'9.##5.129.1':1433
'9.###.129.77':445
'9.###.129.78':445
'9.###.128.242':1433
'9.###.129.69':445
'9.###.129.72':445
'9.###.129.75':445
'9.###.129.71':445
'9.###.129.73':445
'9.###.129.84':445
'9.###.129.83':445
'9.###.129.85':445
'9.###.129.88':445
'9.###.129.86':445
'9.###.129.61':1433
'9.###.129.81':445
'9.###.129.80':445
'9.###.129.82':445
'9.###.129.79':445
'9.###.129.105':445
'9.###.129.20':1433
'9.###.129.106':445
'9.###.129.107':445
'9.###.129.104':445
'9.###.129.36':1433
'9.###.129.30':1433
'9.###.129.103':445
'9.###.129.102':445
'9.###.129.33':1433
'9.###.129.110':445
'9.###.129.31':1433
'9.###.129.108':445
'9.###.129.109':445
'9.###.129.44':1433
'9.###.129.34':1433
'9.###.129.29':1433
'9.###.129.32':1433
'9.###.129.84':1433
'9.###.129.21':1433
'9.###.129.100':445
'9.###.129.76':1433
'9.###.129.28':1433
'9.###.129.82':1433
'9.###.129.97':445
'9.###.129.17':1433
'9.##5.129.9':1433
'9.##5.129.7':1433
'9.###.129.11':1433
'9.###.129.72':1433
'9.##5.129.8':1433
'9.##5.129.2':1433
'9.###.129.92':1433
'9.###.129.99':445
'9.###.129.101':445
'9.###.129.98':445
'9.###.129.79':1433
'9.###.129.75':1433
'9.###.129.80':1433
'9.###.129.24':1433
'9.###.129.90':1433
'9.###.129.46':445
'9.###.129.47':445
'9.###.128.213':1433
'9.###.129.49':445
'9.###.128.231':1433
'9.###.129.43':445
'9.###.129.41':445
'9.###.129.25':1433
'9.###.129.48':445
'9.###.129.45':445
'9.###.128.219':1433
'9.###.129.53':445
'9.###.128.182':1433
'9.###.128.202':1433
'9.###.128.175':1433
'9.##5.129.0':1433
'9.###.129.50':445
'9.###.129.51':445
'9.###.128.217':1433
'9.###.129.52':445
'9.###.129.14':1433
'9.###.128.206':1433
'9.###.128.223':1433
'9.###.129.36':445
'9.###.128.209':1433
'9.###.128.238':1433
'9.###.129.33':445
'9.###.129.34':445
'9.###.128.216':1433
'9.###.128.236':1433
'9.###.128.166':1433
'9.###.129.42':445
'9.###.129.40':445
'9.###.129.44':445
'9.###.129.16':1433
'9.###.129.19':1433
'9.###.128.218':1433
'9.###.128.197':1433
'9.###.129.37':445
'9.###.129.39':445
'9.###.129.38':445
'9.###.128.254':1433
'9.###.128.251':1433
'9.###.128.248':1433
'9.###.128.243':1433
'9.###.129.65':445
'9.###.129.62':445
'9.###.129.10':1433
'9.###.129.63':445
'9.###.129.64':445
'9.###.128.220':1433
'9.###.129.67':445
'9.###.129.66':445
'9.###.129.70':445
'9.###.129.76':445
'9.###.129.74':445
'9.###.128.226':1433
'9.###.128.215':1433
'9.###.129.68':445
'9.###.128.239':1433
'9.###.128.228':1433
'9.###.128.232':1433
'9.###.129.55':445
'9.###.128.241':1433
'9.###.129.54':445
'9.##5.129.4':1433
'9.###.128.211':1433
'9.###.128.244':1433
'9.###.128.234':1433
'9.###.128.214':1433
'9.###.129.56':445
'9.###.128.222':1433
'9.###.128.233':1433
'9.###.128.245':1433
'9.###.128.252':1433
'9.###.129.60':445
'9.###.129.61':445
'9.###.129.57':445
'9.###.129.58':445
'9.###.128.224':1433
'9.###.129.59':445
'9.###.128.247':1433
'9.###.128.19':1433
'9.###.128.18':1433
'9.###.128.20':1433
'9.###.128.23':1433
'9.###.128.21':1433
'9.###.128.99':445
'9.###.128.98':445
'9.###.128.100':445
'9.###.128.17':1433
'9.###.128.101':445
'9.###.128.27':1433
'9.###.128.26':1433
'9.###.128.48':1433
'9.###.128.28':1433
'9.###.128.102':445
'9.###.128.24':1433
'9.###.128.22':1433
'9.###.128.25':1433
'9.###.128.68':1433
'9.###.128.43':1433
'9.###.128.97':445
'9.###.128.86':445
'9.###.128.85':445
'9.###.128.14':1433
'9.###.128.88':445
'9.###.128.87':445
'9.###.128.81':445
'9.###.128.13':1433
'9.###.128.82':445
'9.###.128.84':445
'9.###.128.83':445
'9.###.128.93':445
'9.###.128.94':445
'9.###.128.95':445
'9.###.128.16':1433
'9.###.128.96':445
'9.###.128.90':445
'9.###.128.89':445
'9.###.128.91':445
'9.###.128.15':1433
'9.###.128.92':445
'9.###.128.100':1433
'9.###.128.97':1433
'9.###.128.38':1433
'9.###.128.107':445
'9.###.128.31':1433
'9.###.128.94':1433
'9.###.128.57':1433
'9.###.128.32':1433
'9.###.128.99':1433
'9.###.128.106':445
'9.###.128.111':445
'9.###.128.110':445
'9.###.128.112':445
'9.###.128.114':445
'9.###.128.113':445
'9.###.128.63':1433
'9.###.128.60':1433
'9.###.128.108':445
'9.###.128.70':1433
'9.###.128.109':445
'9.###.128.105':445
'9.###.128.103':445
'9.###.128.80':1433
'9.###.128.82':1433
'9.###.128.86':1433
'9.###.128.51':1433
'9.###.128.77':1433
'9.###.128.29':1433
'9.###.128.78':1433
'9.###.128.81':1433
'9.###.128.79':1433
'9.###.128.54':1433
'9.###.128.90':1433
'9.###.128.56':1433
'9.###.128.91':1433
'9.###.128.93':1433
'9.###.128.50':1433
'9.###.128.49':1433
'9.###.128.104':445
'9.###.128.30':1433
'9.###.128.87':1433
'9.###.128.27':445
'9.###.128.26':445
'9.###.128.28':445
'9.###.128.30':445
'9.###.128.29':445
'9.###.128.22':445
'9.###.128.21':445
'9.###.128.23':445
'9.###.128.25':445
'9.###.128.24':445
'9.###.128.37':445
'9.###.128.36':445
'9.###.128.38':445
'9.###.128.40':445
'9.###.128.39':445
'9.###.128.32':445
'9.###.128.31':445
'9.###.128.33':445
'9.###.128.35':445
'9.###.128.34':445
'9.###.128.20':445
'9.##5.128.6':445
'9.##5.128.5':445
'9.##5.128.7':445
'9.##5.128.9':445
'9.##5.128.8':445
'www.ip##8.com':80
'so##.into4.info':80
'9.##5.128.4':445
'9.##5.128.2':445
'9.##5.128.3':445
'9.###.128.16':445
'9.###.128.15':445
'9.###.128.17':445
'9.###.128.19':445
'9.###.128.18':445
'9.###.128.11':445
'9.###.128.10':445
'9.###.128.12':445
'9.###.128.14':445
'9.###.128.13':445
'9.###.128.68':445
'9.###.128.67':445
'9.###.128.69':445
'9.###.128.71':445
'9.###.128.70':445
'9.###.128.63':445
'9.###.128.62':445
'9.###.128.64':445
'9.###.128.66':445
'9.###.128.65':445
'9.###.128.77':445
'9.###.128.76':445
'9.###.128.78':445
'9.###.128.80':445
'9.###.128.79':445
'9.###.128.12':1433
'9.###.128.72':445
'9.###.128.73':445
'9.###.128.75':445
'9.###.128.74':445
'9.###.128.61':445
'9.###.128.47':445
'9.###.128.46':445
'9.###.128.48':445
'9.###.128.50':445
'9.###.128.49':445
'9.###.128.42':445
'9.###.128.41':445
'9.###.128.43':445
'9.###.128.45':445
'9.###.128.44':445
'9.###.128.57':445
'9.###.128.56':445
'9.###.128.59':445
'9.###.128.60':445
'9.###.128.58':445
'9.###.128.52':445
'9.###.128.51':445
'9.###.128.53':445
'9.###.128.55':445
'9.###.128.54':445
'9.###.128.166':445
'9.###.128.167':445
'9.###.128.168':445
'9.###.128.170':445
'9.###.128.169':445
'9.###.128.96':1433
'9.###.128.88':1433
'9.###.128.69':1433
'9.###.128.89':1433
'9.###.128.101':1433
'9.###.128.175':445
'9.###.128.176':445
'9.###.128.177':445
'9.###.128.179':445
'9.###.128.178':445
'9.###.128.171':445
'9.###.128.62':1433
'9.###.128.172':445
'9.###.128.173':445
'9.###.128.174':445
'9.###.128.98':1433
'9.###.128.140':1433
'9.###.128.142':1433
'9.###.128.138':1433
'9.###.128.141':1433
'9.###.128.139':1433
'9.###.128.158':445
'9.###.128.117':1433
'9.###.128.159':445
'9.###.128.161':445
'9.###.128.160':445
'9.###.128.144':1433
'9.###.128.146':1433
'9.###.128.165':445
'9.###.128.85':1433
'9.###.128.145':1433
'9.###.128.143':1433
'9.###.128.162':445
'9.###.128.163':445
'9.###.128.59':1433
'9.###.128.164':445
'9.###.128.202':445
'9.###.128.204':445
'9.###.128.203':445
'9.###.128.131':1433
'9.###.128.121':1433
'9.###.128.199':445
'9.###.128.198':445
'9.###.128.201':445
'9.###.128.120':1433
'9.###.128.200':445
'9.###.128.206':445
'9.###.128.104':1433
'9.###.128.207':445
'9.###.128.72':1433
'9.###.128.208':445
'9.###.128.127':1433
'9.###.128.83':1433
'9.###.128.105':1433
'9.###.128.102':1433
'9.###.128.205':445
'9.###.128.103':1433
'9.###.128.186':445
'9.###.128.187':445
'9.###.128.185':445
'9.###.128.189':445
'9.###.128.188':445
'9.###.128.181':445
'9.###.128.180':445
'9.###.128.183':445
'9.###.128.184':445
'9.###.128.182':445
'9.###.128.75':1433
'9.###.128.194':445
'9.###.128.197':445
'9.###.128.196':445
'9.###.128.195':445
'9.###.128.190':445
'9.###.128.106':1433
'9.###.128.191':445
'9.###.128.193':445
'9.###.128.192':445
'9.###.128.42':1433
'9.###.128.133':445
'9.###.128.134':445
'9.###.128.136':445
'9.###.128.135':445
'9.###.128.130':445
'9.###.128.129':445
'9.###.128.131':445
'9.###.128.65':1433
'9.###.128.132':445
'9.###.128.45':1433
'9.###.128.41':1433
'9.###.128.140':445
'9.###.128.141':445
'9.###.128.142':445
'9.###.128.33':1433
'9.###.128.35':1433
'9.###.128.137':445
'9.###.128.138':445
'9.###.128.139':445
'9.###.128.128':445
'9.###.128.71':1433
'9.###.128.118':445
'9.###.128.52':1433
'9.###.128.120':445
'9.###.128.119':445
'9.###.128.115':445
'9.###.128.76':1433
'9.###.128.117':445
'9.###.128.39':1433
'9.###.128.116':445
'9.###.128.37':1433
'9.###.128.34':1433
'9.###.128.126':445
'9.###.128.36':1433
'9.###.128.127':445
'9.###.128.122':445
'9.###.128.121':445
'9.###.128.123':445
'9.###.128.125':445
'9.###.128.124':445
'9.###.128.67':1433
'9.###.128.154':445
'9.###.128.95':1433
'9.###.128.125':1433
'9.###.128.111':1433
'9.###.128.55':1433
'9.###.128.84':1433
'9.###.128.74':1433
'9.###.128.47':1433
'9.###.128.153':445
'9.###.128.157':445
'9.###.128.129':1433
'9.###.128.58':1433
'9.###.128.134':1433
'9.###.128.135':1433
'9.###.128.92':1433
'9.###.128.155':445
'9.###.128.156':445
'9.###.128.112':1433
'9.###.128.130':1433
'9.###.128.61':1433
'9.###.128.147':445
'9.###.128.146':445
'9.###.128.148':445
'9.###.128.150':445
'9.###.128.149':445
'9.###.128.143':445
'9.###.128.44':1433
'9.###.128.144':445
'9.###.128.40':1433
'9.###.128.145':445
'9.###.128.66':1433
'9.###.128.118':1433
'9.###.128.73':1433
'9.###.128.64':1433
'9.###.128.152':445
'9.###.128.114':1433
'9.###.128.46':1433
'9.###.128.53':1433
'9.###.128.116':1433
'9.###.128.151':445

TCP:

Запросы HTTP GET:

www.ip##8.com/ip2city.asp
so##.into4.info/it.asp?in########

UDP:

DNS ASK www.ip##8.com
DNS ASK km###.in.into4.info
DNS ASK so##.into4.info
DNS ASK www.google.com
'<IP-адрес в локальной сети>':1035

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней