Trojan.FakeAV.10908

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'17#.#48.128.156':3128
'18#.#0.5.109':3128
'11#.#35.71.156':3128
'18#.#4.206.18':3128
'78.##.151.25':3128
'17#.#22.153.32':3128
'11#.#49.99.195':3128
'17#.#0.224.118':3128
'93.##6.154.250':3128
'2.###.245.14':3128
'13#.#69.142.85':3128
'19#.#3.231.234':3128
'19#.#13.207.107':3128
'31.#9.14.97':3128
'2.###.127.115':3128
'17#.#00.136.231':3128
'80.##.168.20':3128
'14.##.235.225':3128
'86.#26.9.9':3128
'41.##.17.192':3128
'19#.#99.13.7':3128
'19#.#5.160.204':3128
'18#.#84.94.3':3128
'95.##1.151.172':3128
'41.##7.100.100':3128
'78.##.149.250':3128
'91.##5.9.231':3128
'19#.#.80.193':3128
'89.#8.6.113':3128
'20#.#4.201.240':3128
'18#.#8.240.63':3128
'18#.#94.141.104':3128
'17#.#23.191.233':3128
'13#.#45.74.58':3128
'19#.#7.239.45':3128
'82.##2.65.253':3128
'19#.#13.15.230':3128
'89.##9.73.254':3128
'31.#9.9.119':3128
'14.#6.14.84':3128
'89.##6.237.248':3128
'31.#.238.176':3128
'84.##0.213.252':3128
'80.##.196.114':3128
'20#.#43.101.123':3128
'89.##.45.224':3128
'8.##.48.21':3128
'81.#0.0.18':3128
'41.##0.200.219':3128
'46.##5.108.254':3128
'77.##5.6.251':3128
'20#.#.145.157':3128
'61.##5.165.16':3128
'20#.#65.18.56':3128
'89.##3.98.138':3128
'11#.#10.81.152':3128
'92.##.187.242':3128
'20#.#2.189.14':3128
'66.##0.204.39':3128
'18#.#0.200.114':3128
'20#.#8.112.165':3128
'11#.#60.52.79':3128
'18#.#96.140.12':3128
'41.##3.57.74':3128
'18#.#2.213.213':3128
'41.##.17.190':3128
'46.#8.132.8':3128
'67.##0.51.16':3128
'41.##1.43.37':3128
'95.##.238.175':3128
'91.##.251.199':3128
'2.###.44.196':3128
'20#.#48.3.233':3128
'14.##.150.154':3128
'46.##.195.95':3128
'2.###.252.199':3128
'18#.#52.168.116':3128
'19#.#0.93.82':3128
'81.##.108.246':3128
'78.#3.47.42':3128
'18#.#7.189.97':3128
'41.##.160.211':3128
'19#.#2.137.78':3128
'17#.#22.170.125':3128
'11#.43.53.6':3128
'41.##1.47.42':3128
'41.##1.50.141':3128
'18#.#2.136.138':3128
'80.##.196.104':3128
'19#.#9.16.252':3128
'19#.#9.190.227':3128
'87.##.198.162':3128
'18#.#6.165.79':3128
'21#.#9.35.15':3128
'19#.#64.232.64':3128
'11#.#06.122.167':3128
'20#.#15.204.247':3128
'11#.#39.101.66':3128
'11#.#42.101.101':3128
'2.###.242.45':3128
'19#.#3.172.7':3128
'19#.#3.129.250':3128
'41.##3.57.73':3128
'17#.#23.156.114':3128
'11#.#10.54.6':3128
'17#.#9.61.122':3128
'11#.#20.209.219':3128
'77.#45.6.14':3128
'11#.#52.25.118':3128
'18#.#5.186.139':3128
'14.#9.76.57':3128
'18#.#66.29.159':3128
'2.###.243.170':3128
'19#.#4.168.223':3128
'11#.#9.60.175':3128
'41.##3.82.250':3128
'20#.#65.199.58':3128
'82.##0.168.67':3128
'14#.#85.30.114':3128
'37.##.86.167':3128
'18#.#0.52.64':3128
'11#.43.47.4':3128
'41.##3.57.75':3128
'46.##5.106.86':3128
'20#.#34.44.146':3128
'20#.#91.247.37':3128
'24.##7.164.141':3128
'79.##7.47.198':3128
'19#.#79.34.96':3128
'19#.#3.141.119':3128
'20#.#44.158.182':3128
'74.#15.0.21':3128
'70.##0.64.179':3128
'14#.#1.133.158':3128
'95.#9.4.116':3128
'19#.#02.112.106':3128
'18#.#3.17.71':3128
'19#.#03.167.5':3128
'41.##1.183.180':3128
'84.##0.209.139':3128
'95.#5.36.51':3128
'19#.#05.147.8':3128
'19#.#02.242.242':3128
'2.###.242.197':3128
'14.##.66.233':3128
'18#.#16.160.2':3128
'19#.#45.114.5':3128
'18#.#7.189.244':3128
'19#.#3.163.105':3128
'98.##7.156.86':3128
'19#.#.97.196':3128
'12#.#23.167.78':3128
'20#.#55.37.136':3128
'18#.#2.135.4':3128
'77.##5.6.231':3128
'18#.#94.251.254':3128
'80.##.108.138':3128
'12#.#01.139.109':3128
'20#.#65.196.28':3128
'41.##.118.174':3128
'17#.#25.154.36':3128
'37.##.67.142':3128
'14.##.80.178':3128
'31.##.16.177':3128
'18#.#20.181.158':3128
'75.#4.6.220':3128
'78.##.79.222':3128
'84.##.80.118':3128
'18#.#19.124.185':3128
'12#.#2.115.8':3128
'98.##6.110.103':3128
'74.##2.93.77':3128
'80.##1.40.108':3128
'19#.#99.20.84':3128
'2.###.240.217':3128
'17#.#66.128.213':3128
'20#.#64.5.144':3128
'20#.#04.66.213':3128
'21#.#12.170.65':3128
'74.#15.3.63':3128
'91.##.146.41':3128
'37.##.85.238':3128
'95.##.228.37':3128
'98.##3.35.199':3128
'92.##.169.37':3128
'19#.#0.53.132':3128
'11#.#09.246.77':3128
'20#.#32.15.72':3128
'77.#45.6.90':3128
'19#.#21.184.54':3128
'18#.#98.148.162':3128
'85.##0.98.101':3128
'20#.#05.34.98':3128
'71.##8.141.141':3128
'61.##4.150.206':3128
'66.##4.111.198':3128
'19#.#77.80.183':3128
'91.##1.159.1':3128
'18#.#14.128.172':3128
'75.##.118.62':3128
'41.##5.229.1':3128
'18#.#0.121.197':3128
'81.##.19.171':3128
'20#.#10.235.147':3128
'17#.#1.7.112':3128
'80.##1.94.60':3128
'86.##.120.163':3128
'81.##.23.180':3128
'19#.#42.10.21':3128
'17#.#3.72.152':3128
'95.##.248.238':3128
'80.##.168.16':3128
'18#.#8.39.102':3128
'12#.#9.77.157':3128
'41.##0.37.93':3128
'46.##5.102.118':3128
'20#.#3.186.177':3128
'20#.#95.38.163':3128
'24.#.209.53':3128
'17#.#9.144.137':3128
'95.##.141.33':3128
'20#.#66.192.146':3128
'17#.#1.109.210':3128
'41.##7.98.67':3128
'18#.#19.223.149':3128
'79.##7.47.197':3128
'85.##0.52.119':3128
'18#.#6.164.175':3128
'79.##9.16.217':3128
'18#.#92.188.93':3128
'95.#7.12.91':3128
'18#.#4.144.90':3128
'2.##3.41.39':3128
'14.##.52.141':3128
'19#.#20.162.3':3128
'77.##.45.219':3128
'80.##.168.14':3128
'19#.#5.133.67':3128
'46.##0.109.158':3128
'89.##.176.51':3128
'31.##3.85.76':3128
'91.##5.141.145':3128
'84.##8.143.240':3128
'19#.#42.242.185':3128
'2.###.247.94':3128
'21#.96.2.58':3128
'17#.#27.67.17':3128
'41.##8.214.147':3128
'18#.#0.6.165':3128
'18#.#5.114.159':3128
'46.##5.103.66':3128
'82.##.218.17':3128
'87.##.199.246':3128
'11#.#06.146.224':3128
'18#.#6.1.107':3128
'37.##.89.229':3128
'2.###.50.173':3128
'19#.#3.231.210':3128
'80.#0.168.1':3128
'19#.#05.19.235':3128
'84.#7.229.6':3128
'71.##5.43.226':3128
'19#.#1.173.15':3128
'19#.#13.158.29':3128
'19#.#9.151.244':3128
'42.##.13.105':3128
'19#.#4.209.230':3128
'46.##.26.159':3128
'20#.#19.4.10':3128
'41.##7.105.58':3128
'18#.#96.148.179':3128
'18#.#7.203.185':3128
'31.#9.27.37':3128
'19#.#13.165.31':3128
'84.##0.212.134':3128
'77.#45.6.24':3128
'78.##4.130.76':3128
'93.##5.70.28':3128
'16#.#67.84.222':3128
'14.##.32.182':3128
'37.#9.66.72':3128
'93.##6.41.38':3128
'84.##.230.244':3128
'17#.#25.130.231':3128
'92.##.95.215':3128
'46.#0.2.58':3128
'18#.#92.223.152':3128
'13#.#45.203.17':3128
'19#.#6.196.3':3128
'71.##.180.88':3128
'11#.#02.124.187':3128
'87.##7.35.76':3128
'12#.#9.20.108':3128
'13#.#05.165.232':3128
'31.##8.11.139':3128
'46.##.138.78':3128
'18#.#25.107.14':3128
'92.#7.68.43':3128
'19#.#62.233.169':3128
'17#.#1.195.15':3128
'86.##6.40.27':3128
'12#.#5.248.82':3128
'13#.#05.164.36':3128
'20#.#67.25.76':3128
'64.##0.246.5':3128
'2.##3.66.56':3128
'80.##1.38.165':3128
'41.##1.247.93':3128
'20#.#7.15.133':3128
'20#.#64.75.145':3128
'17#.#23.248.213':3128
'2.###.51.161':3128
'41.##3.228.17':3128
'11#.#39.64.177':3128
'19#.#55.209.74':3128
'41.##.249.104':3128
'80.##6.0.109':3128
'2.##4.11.25':3128
'46.#.245.38':3128
'18#.#0.99.52':3128
'83.#.53.203':3128
'20#.#64.117.5':3128
'79.##7.47.194':3128
'41.##2.124.217':3128
'19#.#.86.231':3128
'20#.#63.52.115':3128
'19#.#3.147.241':3128
'79.##6.50.112':3128
'20#.#79.72.122':3128
'19#.#0.77.169':3128
'14#.#31.100.50':3128
'14.#9.4.200':3128
'16#.#67.212.235':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней