Trojan.DownLoader6.8930

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'88.##5.193.113':3128
'59.##.118.126':3128
'22#.#43.60.153':3128
'87.#.40.237':3128
'19#.#29.153.122':3128
'20#.#17.163.230':3128
'19#.#1.116.19':3128
'10#.#82.14.108':3128
'11#.#65.225.77':3128
'10#.#69.132.241':3128
'19#.#29.144.228':3128
'19#.#39.82.200':3128
'21#.#43.253.101':3128
'20#.#17.182.206':3128
'12#.#.41.218':3128
'70.##.238.152':3128
'22#.#43.63.238':3128
'92.##6.178.113':3128
'19#.#39.83.212':3128
'87.#.42.171':3128
'19#.#0.157.14':3128
'20#.#48.205.14':3128
'81.##.215.203':3128
'80.##4.94.148':3128
'21#.#86.183.4':3128
'11#.#65.226.33':3128
'20#.#87.228.5':3128
'21#.#97.10.106':3128
'70.##.78.132':3128
'11#.#40.223.61':3128
'82.##.141.64':3128
'12#.#27.64.54':3128
'85.##8.165.53':3128
'18#.#24.18.151':3128
'79.##5.216.109':3128
'95.#7.24.0':3128
'20#.#17.185.167':3128
'84.##0.69.127':3128
'85.##.106.150':3128
'20#.#53.206.51':3128
'81.##8.141.145':3128
'84.##1.104.241':3128
'22#.#43.59.48':3128
'19#.#29.144.28':3128
'82.##1.24.215':3128
'19#.#78.99.211':3128
'11#.#41.40.47':3128
'19#.#7.161.125':3128
'20#.#17.182.137':3128
'71.##6.135.4':3128
'89.##7.75.85':3128
'95.##.196.47':3128
'20#.#53.206.175':3128
'18#.#4.204.198':3128
'95.##.194.68':3128
'70.##.195.231':3128
'20#.#53.206.164':3128
'41.##5.182.124':3128
'20#.#17.166.162':3128
'79.##4.71.152':3128
'21#.#6.47.24':3128
'19#.#39.88.249':3128
'20#.#53.205.68':3128
'21#.#19.69.149':3128
'11#.24.42.5':3128
'61.#5.240.3':3128
'22#.#06.106.204':3128
'19#.3.229.6':3128
'11#.#39.57.44':3128
'85.##8.160.89':3128
'19#.#25.200.109':3128
'18#.#92.189.249':3128
'20#.#5.34.228':3128
'61.##.13.198':3128
'20#.#17.166.249':3128
'96.##.168.115':3128
'20#.#53.205.12':3128
'11#.#97.101.31':3128
'21#.#38.4.164':3128
'89.##6.188.219':3128
'95.##.44.162':3128
'95.##.194.101':3128
'95.##.207.12':3128
'22#.#07.121.167':3128
'18#.#78.107.124':3128
'18#.#24.43.167':3128
'19#.#39.88.20':3128
'74.#15.5.41':3128
'22#.#43.176.183':3128
'10#.#82.47.59':3128
'22#.#41.4.219':3128
'18#.#24.41.100':3128
'92.##.136.23':3128
'20#.#53.206.170':3128
'60.##0.147.209':3128
'20#.#17.184.237':3128
'22#.#41.7.96':3128
'19#.#5.68.28':3128
'22#.#43.62.129':3128
'84.##.224.13':3128
'20#.#54.81.118':3128
'19#.#6.123.129':3128
'22#.#41.10.81':3128
'79.##4.24.130':3128
'18#.#24.16.53':3128
'20#.#17.166.76':3128
'18#.#20.200.250':3128
'21#.#98.142.157':3128
'20#.#53.205.154':3128
'84.##8.50.94':3128
'22#.#43.59.124':3128
'41.##1.197.167':3128
'83.##2.81.217':3128
'13#.#32.68.126':3128
'59.##.188.170':3128
'20#.#17.163.240':3128
'12#.#05.186.8':3128
'11#.#01.52.94':3128
'17#.#44.22.189':3128
'78.##9.50.38':3128
'19#.#39.82.51':3128
'14.#6.4.162':3128
'82.##5.226.110':3128
'89.##6.130.201':3128
'12#.#30.109.248':3128
'11#.#65.3.20':3128
'94.##9.159.48':3128
'12#.#38.13.191':3128
'19#.#8.51.184':3128
'18#.#24.159.43':3128
'10#.#82.85.83':3128
'79.#2.40.68':3128
'18#.#24.155.237':3128
'18#.#4.237.177':3128
'18#.#24.158.167':3128
'92.##6.183.84':3128
'16#.#7.221.216':3128
'93.##0.28.178':3128
'89.##2.111.110':3128
'20#.#88.191.122':3128
'19#.#29.150.98':3128
'91.##1.34.172':3128
'22#.#41.11.184':3128
'41.##3.57.72':3128
'94.##5.28.172':3128
'11#.#97.218.182':3128
'18#.#25.47.101':3128
'19#.#29.148.34':3128
'89.##2.58.171':3128
'19#.#07.110.169':3128
'79.##4.82.85':3128
'22#.#.206.111':3128
'11#.#35.30.232':3128
'95.##.162.73':3128
'21#.#18.233.50':3128
'11#.#02.26.111':3128
'85.##6.196.130':3128
'85.##7.165.12':3128
'11#.#65.226.165':3128
'11#.#05.96.202':3128
'22#.#43.63.82':3128
'20#.#72.105.100':3128
'12#.#5.40.100':3128
'20#.#53.205.81':3128
'19#.#10.247.11':3128
'84.##9.229.218':3128
'89.##2.237.240':3128
'22#.#06.111.177':3128
'78.##.10.241':3128
'79.##5.219.217':3128
'20#.#2.79.82':3128
'18#.#24.13.45':3128
'79.#64.73.5':3128
'20#.#17.164.228':3128
'78.##.242.233':3128
'86.##9.130.35':3128
'20#.#64.211.106':3128
'20#.#17.166.2':3128
'84.#31.6.70':3128
'19#.#24.145.2':3128
'82.##.143.28':3128
'11#.#65.224.42':3128
'83.##.153.57':3128
'59.##3.55.207':3128
'59.##.99.230':3128
'17#.#5.130.127':3128
'85.##4.169.5':3128
'20#.#17.166.226':3128
'21#.#74.251.105':3128
'82.##.146.34':3128
'92.##5.96.123':3128
'18#.#24.36.141':3128
'18#.#24.40.182':3128
'62.##3.174.192':3128
'11#.#46.86.131':3128
'11#.#2.205.59':3128
'79.##.40.181':3128
'22#.#36.68.229':3128
'17#.137.2.4':3128
'92.##3.183.44':3128
'20#.#17.164.240':3128
'11#.#52.45.119':3128
'18#.#24.152.101':3128
'20#.#53.208.238':3128
'87.#1.44.62':3128
'80.##3.35.161':3128
'20#.#53.207.41':3128
'22#.#41.11.175':3128
'20#.#1.160.62':3128
'11#.#65.6.77':3128
'19#.#1.117.220':3128
'20#.#17.164.183':3128
'82.##2.103.247':3128
'18#.#24.17.92':3128
'18#.#27.42.6':3128
'41.##9.96.68':3128
'41.##1.230.9':3128
'20#.#53.207.86':3128
'20#.#5.134.65':3128
'41.##3.57.74':3128
'79.##5.216.41':3128
'19#.#24.140.185':3128
'19#.#19.180.11':3128
'95.##.205.210':3128
'18#.#06.15.55':3128
'20#.#17.185.135':3128
'95.##.33.217':3128
'20#.#17.184.15':3128
'20#.#53.211.209':3128
'95.##.196.59':3128
'24.##2.25.216':3128
'20#.#17.164.196':3128
'20#.#53.204.48':3128
'18#.#24.18.178':3128
'41.##1.196.255':3128
'82.##6.61.184':3128
'20#.#53.207.116':3128
'19#.#29.150.50':3128
'84.##9.234.44':3128
'59.##.102.122':3128
'80.##4.15.250':3128
'19#.#24.140.199':3128
'89.##2.101.241':3128
'19#.#29.146.56':3128
'18#.#24.43.252':3128
'81.##5.4.137':3128
'22#.#41.13.95':3128
'41.##3.57.76':3128
'77.#31.34.6':3128
'20#.#17.184.22':3128
'86.##4.51.170':3128
'94.##2.156.132':3128
'18#.#24.16.170':3128
'59.##3.53.100':3128
'10#.#89.128.133':3128
'59.##.177.239':3128
'19#.#31.84.118':3128
'19#.#0.17.14':3128
'11#.#27.7.26':3128
'79.##4.27.190':3128
'19#.#.200.175':3128
'41.##1.230.4':3128
'85.##6.250.116':3128
'18#.#24.16.30':3128
'18#.#24.152.8':3128
'18#.#24.156.165':3128
'95.#7.17.59':3128
'74.##.209.166':3128
'85.##7.57.116':3128
'20#.#38.31.155':3128
'11#.#02.202.42':3128
'19#.#29.149.29':3128
'18#.#24.158.129':3128
'87.##0.166.58':3128
'84.##7.229.205':3128
'59.##3.53.124':3128
'19#.#39.80.60':3128
'17#.#68.42.151':3128
'11#.#02.143.168':3128
'87.#.40.191':3128
'18#.#29.208.111':3128
'19#.#0.145.225':3128
'11#.#48.231.53':3128
'19#.#29.159.134':3128
'20#.#17.182.49':3128
'91.##8.97.106':3128
'20#.#48.103.189':3128
'20#.#28.146.69':3128
'87.#.44.249':3128
'22#.#41.6.191':3128
'22#.#41.1.210':3128
'87.#1.44.19':3128
'20#.#53.209.130':3128
'58.##4.176.3':3128
'19#.#0.18.66':3128
'93.##3.135.32':3128
'82.##.174.207':3128
'94.##6.150.228':3128
'19#.#51.53.33':3128
'11#.#08.253.56':3128
'18#.#24.17.95':3128
'95.#7.175.0':3128
'79.##4.26.142':3128
'19#.#49.49.0':3128
'88.##5.195.249':3128
'99.##7.197.172':3128
'85.##5.100.50':3128
'84.##7.161.221':3128
'84.##7.229.130':3128
'92.##.155.105':3128
'82.##.109.34':3128
'18#.#24.39.88':3128
'20#.#17.163.47':3128
'95.##9.207.220':3128
'11#.#60.61.239':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней