Trojan.FakeAV.10910

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'46.#.245.38':3128
'11#.#84.123.12':3128
'18#.#0.52.64':3128
'46.##5.108.254':3128
'41.##.160.211':3128
'37.##.108.219':3128
'41.##5.229.1':3128
'19#.#99.13.7':3128
'61.##4.150.206':3128
'17#.#1.7.112':3128
'20#.#10.220.224':3128
'87.##7.35.76':3128
'19#.#64.232.64':3128
'19#.#9.190.227':3128
'41.##1.247.93':3128
'24.#.209.53':3128
'91.##5.141.145':3128
'2.###.127.115':3128
'87.##.198.162':3128
'18#.#92.188.93':3128
'71.##8.141.141':3128
'2.##0.71.54':3128
'86.##.120.163':3128
'16#.#67.84.222':3128
'13#.#05.164.36':3128
'41.##3.228.17':3128
'41.##7.98.67':3128
'81.##.19.171':3128
'41.##.17.190':3128
'19#.#3.141.119':3128
'18#.#98.148.162':3128
'19#.#77.252.32':3128
'19#.#77.80.183':3128
'17#.#25.154.36':3128
'18#.#92.223.152':3128
'2.###.245.14':3128
'87.##1.19.76':3128
'79.##6.50.112':3128
'18#.#4.206.18':3128
'77.##.233.235':3128
'19#.#6.196.3':3128
'18#.#0.99.52':3128
'17#.#66.128.213':3128
'95.##.225.135':3128
'85.##0.81.228':3128
'14.##.52.141':3128
'77.#45.6.24':3128
'78.##.151.25':3128
'19#.#21.184.54':3128
'12#.#23.167.78':3128
'19#.#3.100.38':3128
'19#.#1.173.15':3128
'19#.#3.231.210':3128
'20#.#04.66.213':3128
'31.#9.9.119':3128
'19#.#5.160.204':3128
'74.#15.3.63':3128
'91.##.146.41':3128
'19#.#13.158.29':3128
'20#.#32.15.72':3128
'17#.#25.130.231':3128
'14#.#31.100.50':3128
'18#.#16.160.2':3128
'11#.#09.246.77':3128
'21#.#12.170.65':3128
'17#.#27.105.199':3128
'86.#26.9.9':3128
'98.##3.35.199':3128
'78.##4.130.76':3128
'83.#.53.203':3128
'13#.#45.203.17':3128
'18#.#66.29.159':3128
'93.##6.154.250':3128
'93.##6.41.38':3128
'11#.#8.215.123':3128
'14.##.32.182':3128
'77.#45.6.14':3128
'70.##.129.218':3128
'95.##.180.151':3128
'20#.#91.247.37':3128
'18#.#95.3.58':3128
'68.##6.140.232':3128
'19#.#7.231.139':3128
'18#.#27.163.237':3128
'71.##.106.234':3128
'21#.#98.41.225':3128
'89.##5.244.229':3128
'19#.#13.233.222':3128
'84.##.80.118':3128
'81.##.23.180':3128
'37.##.86.167':3128
'79.##7.47.194':3128
'2.###.44.196':3128
'18#.#45.207.99':3128
'98.##8.193.19':3128
'16#.#67.212.235':3128
'13#.#45.74.58':3128
'92.##.169.37':3128
'11#.#10.54.6':3128
'98.##7.156.86':3128
'85.##0.52.119':3128
'17#.#48.128.156':3128
'2.###.252.199':3128
'77.##5.6.251':3128
'20#.#65.196.28':3128
'14.##.150.154':3128
'18#.#5.186.139':3128
'70.##0.64.179':3128
'20#.#63.52.115':3128
'41.##1.183.180':3128
'20#.#34.44.146':3128
'19#.#4.168.223':3128
'20#.#4.201.240':3128
'89.##.176.51':3128
'31.##3.85.76':3128
'18#.#3.54.111':3128
'19#.#6.32.34':3128
'37.##.89.229':3128
'18#.#96.140.12':3128
'18#.#3.17.71':3128
'11#.#60.52.79':3128
'80.##.196.114':3128
'85.##5.83.227':3128
'14.#9.76.57':3128
'20#.#15.204.247':3128
'41.##.17.192':3128
'84.##.230.244':3128
'17#.#23.191.233':3128
'80.##1.38.165':3128
'98.##6.110.103':3128
'19#.#20.162.3':3128
'19#.#22.233.166':3128
'95.##.228.37':3128
'11#.#06.122.167':3128
'95.##1.151.172':3128
'17#.#00.136.231':3128
'17#.#75.198.23':3128
'75.#4.6.220':3128
'19#.#9.192.244':3128
'95.#9.4.116':3128
'80.##1.40.108':3128
'19#.#02.242.242':3128
'19#.#01.73.253':3128
'19#.#02.112.106':3128
'41.##1.50.141':3128
'89.##.45.224':3128
'19#.#3.129.250':3128
'18#.#0.200.114':3128
'2.###.50.173':3128
'18#.#8.39.102':3128
'84.##0.209.139':3128
'84.##0.213.252':3128
'41.##1.43.37':3128
'18#.#7.189.97':3128
'20#.#8.112.165':3128
'78.##.149.250':3128
'80.##.168.20':3128
'20#.#65.199.58':3128
'84.##0.212.134':3128
'84.##8.143.240':3128
'46.##5.106.86':3128
'46.##5.102.118':3128
'82.##0.168.67':3128
'87.##7.15.108':3128
'98.##.152.196':3128
'11#.#20.209.219':3128
'17#.#96.216.199':3128
'19#.#05.21.150':3128
'80.##.108.138':3128
'74.#15.0.21':3128
'11#.#06.2.15':3128
'11#.#39.64.177':3128
'19#.#79.34.96':3128
'67.##0.51.16':3128
'66.##0.204.39':3128
'18#.#96.148.179':3128
'19#.#4.167.184':3128
'92.##.95.215':3128
'17#.#22.153.32':3128
'17#.#0.243.26':3128
'71.##.180.88':3128
'79.##7.47.197':3128
'18#.#8.240.63':3128
'12#.#09.182.182':3128
'14.#6.14.84':3128
'77.##2.230.85':3128
'12#.#9.93.86':3128
'80.#0.168.1':3128
'20#.#3.186.177':3128
'46.##.138.78':3128
'37.#9.66.72':3128
'19#.#03.167.5':3128
'17#.#1.109.210':3128
'46.##.26.159':3128
'19#.#49.23.233':3128
'41.##3.57.76':3128
'14.#9.4.200':3128
'82.##5.11.142':3128
'46.##.147.202':3128
'11#.#06.146.224':3128
'19#.#.80.193':3128
'19#.#3.147.241':3128
'20#.#48.3.233':3128
'11#.#49.99.195':3128
'92.##.187.242':3128
'79.##7.47.198':3128
'19#.#8.255.167':3128
'20#.#43.101.123':3128
'19#.#2.137.78':3128
'95.#7.12.91':3128
'19#.#45.114.5':3128
'12#.#05.136.103':3128
'64.##0.246.5':3128
'13#.#05.165.232':3128
'12#.#21.246.89':3128
'20#.#19.4.10':3128
'18#.#7.203.185':3128
'21#.#9.35.15':3128
'41.##3.57.75':3128
'20#.#55.37.136':3128
'19#.#0.77.169':3128
'11#.#9.60.175':3128
'31.##3.94.53':3128
'19#.#52.82.7':3128
'2.###.242.45':3128
'81.##.108.246':3128
'41.##.118.174':3128
'67.##1.41.155':3128
'20#.#7.15.133':3128
'17#.#22.170.125':3128
'21#.96.2.58':3128
'66.##4.111.198':3128
'24.##7.164.141':3128
'19#.#3.231.234':3128
'80.##1.94.60':3128
'92.##.250.198':3128
'19#.#.97.196':3128
'80.##.168.14':3128
'31.#.238.176':3128
'18#.#94.251.254':3128
'2.##4.11.25':3128
'19#.#05.19.235':3128
'14#.#85.30.114':3128
'17#.#16.25.33':3128
'41.##3.82.250':3128
'19#.#42.10.21':3128
'81.#0.0.17':3128
'80.##.168.16':3128
'89.##6.237.248':3128
'20#.#95.38.163':3128
'95.##.141.33':3128
'18#.#19.223.149':3128
'19#.#9.151.244':3128
'72.##2.168.108':3128
'93.##5.70.28':3128
'20#.#65.18.56':3128
'41.##1.47.42':3128
'80.##.196.104':3128
'18#.#0.5.109':3128
'19#.#62.233.169':3128
'31.#9.14.97':3128
'19#.#6.101.76':3128
'11#.43.53.6':3128
'17#.#0.224.118':3128
'79.##7.47.200':3128
'2.##3.66.56':3128
'71.##5.43.226':3128
'18#.#2.213.213':3128
'12#.#01.139.109':3128
'18#.#94.141.104':3128
'61.##5.165.16':3128
'11#.#42.101.101':3128
'11#.#02.124.187':3128
'19#.#13.199.20':3128
'18#.#2.136.138':3128
'98.##6.159.183':3128
'18#.#2.135.4':3128
'77.#45.6.90':3128
'18#.#84.94.3':3128
'91.##1.159.1':3128
'31.##8.11.139':3128
'18#.#25.107.14':3128
'18#.#6.164.175':3128
'91.##5.9.231':3128
'18#.#96.111.61':3128
'19#.#0.53.132':3128
'79.##9.16.217':3128
'12#.#69.142.139':3128
'17#.#1.195.15':3128
'14.##.235.225':3128
'12#.#9.20.108':3128
'2.###.51.161':3128
'20#.#64.5.144':3128
'95.#5.36.51':3128
'2.###.245.145':3128
'17#.#1.42.78':3128
'20#.#64.75.145':3128
'14.##.66.233':3128
'20#.#10.190.85':3128
'11#.#52.25.118':3128
'18#.#7.189.244':3128
'41.##.249.104':3128
'77.##.45.219':3128
'46.##5.103.66':3128
'14.##.80.178':3128
'18#.#7.188.240':3128
'19#.#9.16.252':3128
'17#.#23.248.213':3128
'93.##6.41.48':3128
'12#.#2.115.8':3128
'92.#7.68.43':3128
'2.###.242.197':3128
'11#.#10.81.152':3128
'19#.#76.147.197':3128
'20#.#67.25.76':3128
'12#.#9.77.157':3128
'18#.#52.168.116':3128
'11#.43.47.4':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней