Trojan.FakeAV.11019

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'18#.#81.26.58':3128
'21#.#6.9.182':3128
'19#.#.218.213':3128
'19#.#9.16.252':3128
'41.##0.37.54':3128
'20#.#7.116.159':3128
'24.##9.159.77':3128
'92.##.140.118':3128
'19#.#50.4.75':3128
'41.##5.229.1':3128
'18#.#14.99.129':3128
'24.#.209.53':3128
'17#.#25.85.114':3128
'17#.#66.128.213':3128
'2.###.65.217':3128
'95.#5.36.51':3128
'19#.#6.228.227':3128
'21#.#41.20.31':3128
'2.##2.67.96':3128
'41.#9.7.53':3128
'87.##.100.41':3128
'20#.#59.212.85':3128
'18#.#94.251.254':3128
'21#.#46.218.57':3128
'18#.#16.160.2':3128
'19#.#5.160.204':3128
'20#.#8.128.80':3128
'20#.#.47.120':3128
'87.##0.166.58':3128
'19#.#50.13.17':3128
'21#.#9.35.15':3128
'95.##.35.110':3128
'84.##.230.244':3128
'20#.#65.181.129':3128
'37.##.66.183':3128
'95.##.54.251':3128
'15#.#81.188.209':3128
'12#.#2.115.8':3128
'77.##5.15.116':3128
'80.##1.38.165':3128
'18#.#80.80.19':3128
'92.#7.72.8':3128
'19#.#50.3.77':3128
'11#.#9.55.101':3128
'2.###.249.180':3128
'18#.#8.85.241':3128
'20#.#1.216.225':3128
'19#.#29.50.248':3128
'11#.#9.48.172':3128
'18#.#84.206.109':3128
'18#.#8.75.56':3128
'2.###.122.36':3128
'19#.#6.54.168':3128
'20#.#19.4.10':3128
'2.###.10.181':3128
'2.###.243.170':3128
'41.##3.82.250':3128
'21#.#33.172.247':3128
'78.#3.47.42':3128
'82.##2.65.253':3128
'20#.#67.15.217':3128
'62.##.46.191':3128
'11#.#06.12.115':3128
'85.##4.253.12':3128
'41.##5.21.229':3128
'17#.#25.151.13':3128
'20#.#64.75.145':3128
'70.##.244.203':3128
'92.##.183.80':3128
'18#.#2.200.29':3128
'20#.#09.156.166':3128
'98.##7.188.102':3128
'95.##1.151.172':3128
'2.###.199.146':3128
'41.##2.49.188':3128
'2.###.40.244':3128
'18#.#8.80.32':3128
'80.##.108.138':3128
'21#.#07.229.228':3128
'41.##7.116.230':3128
'46.##0.245.150':3128
'46.#8.132.8':3128
'31.##.25.203':3128
'18#.#6.199.147':3128
'92.##.15.249':3128
'20#.#4.204.104':3128
'2.##2.56.58':3128
'17#.#2.172.221':3128
'18#.#4.243.187':3128
'20#.#7.115.209':3128
'17#.#1.114.77':3128
'98.##6.159.183':3128
'89.##5.244.229':3128
'18#.#8.59.232':3128
'41.##2.49.181':3128
'18#.#95.46.87':3128
'66.##4.107.193':3128
'41.##2.231.102':3128
'58.##3.125.236':3128
'84.##.245.107':3128
'65.##.67.118':3128
'2.##2.57.72':3128
'64.##0.246.224':3128
'19#.#4.168.223':3128
'19#.#4.209.230':3128
'18#.42.20.9':3128
'19#.#98.195.50':3128
'19#.#86.112.59':3128
'93.#26.35.4':3128
'83.#.53.203':3128
'92.##.76.179':3128
'98.##3.35.199':3128
'20#.#07.242.62':3128
'41.##.89.226':3128
'74.#15.0.21':3128
'85.##0.98.101':3128
'19#.#1.36.106':3128
'19#.#20.156.106':3128
'24.##7.164.141':3128
'80.##.168.20':3128
'37.#9.73.63':3128
'87.##7.39.181':3128
'18#.#14.97.126':3128
'18#.http':0
'12#.#69.142.139':3128
'2.###.38.164':3128
'95.#9.15.58':3128
'20#.#7.154.195':3128
'72.##2.207.162':3128
'82.##5.17.103':3128
'50.##3.22.15':3128
'10#.#53.113.112':3128
'18#.#94.194.45':3128
'41.##.184.254':3128
'18#.92.4.30':3128
'14#.#85.30.114':3128
'20#.#7.153.40':3128
'localhost':5798
'21#.#98.26.199':3128
'17#.#22.170.125':3128
'20#.#09.175.103':3128
'92.##0.215.231':3128
'74.#15.3.67':3128
'11#.#9.51.172':3128
'79.##7.45.154':3128
'41.##2.210.106':3128
'17#.#00.136.231':3128
'18#.#5.114.159':3128
'64.##0.246.5':3128
'79.#.79.155':3128
'82.##0.168.67':3128
'18#.#7.12.186':3128
'19#.#6.76.68':3128
'12#.#20.63.207':3128
'89.##9.100.164':3128
'17#.#27.205.189':3128
'77.##.45.219':3128
'18#.#6.87.230':3128
'72.##2.168.108':3128
'82.##.23.180':3128
'2.##2.48.85':3128
'66.##5.219.88':3128
'19#.#4.243.152':3128
'41.##3.57.75':3128
'80.##.168.43':3128
'20#.#04.66.213':3128
'19#.#3.152.196':3128
'11#.#39.101.66':3128
'87.##1.19.76':3128
'84.##0.207.80':3128
'77.##.129.213':3128
'41.##7.116.34':3128
'18#.#8.39.102':3128
'95.#6.1.6':3128
'10#.#9.146.224':3128
'74.#15.3.63':3128
'19#.#03.28.182':3128
'19#.#98.154.40':3128
'31.##.235.100':3128
'21#.#12.254.91':3128
'46.##9.114.170':3128
'93.##6.41.54':3128
'80.##.168.27':3128
'18#.#22.136.3':3128
'21#.96.2.58':3128
'17#.#25.47.182':3128
'18#.#59.141.115':3128
'17#.#78.139.96':3128
'82.##.218.17':3128
'18#.#80.114.10':3128
'19#.#52.82.7':3128
'41.##3.57.78':3128
'19#.#06.234.208':3128
'80.##.168.127':3128
'17#.#2.172.201':3128
'78.##.244.94':3128
'18#.#0.222.9':3128
'20#.#67.25.76':3128
'41.##.17.192':3128
'19#.#55.210.80':3128
'20#.#48.3.233':3128
'20#.#32.56.152':3128
'18#.#81.181.202':3128
'17#.#48.45.36':3128
'17#.#17.73.187':3128
'19#.#0.53.132':3128
'20#.#4.26.210':3128
'19#.#1.164.150':3128
'84.##.103.91':3128
'11#.#9.53.172':3128
'2.###.34.106':3128
'19#.#4.86.122':3128
'86.##9.52.121':3128
'19#.#42.33.87':3128
'12#.#38.184.171':3128
'19#.#9.147.157':3128
'19#.#01.75.104':3128
'18#.#81.187.137':3128
'27.##1.137.118':3128
'77.##7.133.37':3128
'46.##5.100.81':3128
'80.##.76.179':3128
'2.###.245.44':3128
'21#.#49.86.130':3128
'19#.#98.24.179':3128
'19#.#9.130.10':3128
'31.##.234.148':3128
'41.##2.27.179':3128
'92.#7.96.97':3128
'19#.#13.207.107':3128
'68.##5.66.202':3128
'50.##1.147.143':3128
'2.###.44.222':3128
'80.##.168.144':3128
'19#.#86.112.150':3128
'18#.#6.230.116':3128
'17#.#96.216.199':3128
'70.##.129.218':3128
'17#.#39.144.158':3128
'18#.#8.45.228':3128
'41.##2.36.24':3128
'17#.#0.94.162':3128
'37.#9.67.46':3128
'95.#6.58.64':3128
'19#.#02.203.110':3128
'19#.#42.238.65':3128
'2.###.240.217':3128
'20#.#09.207.154':3128
'91.##.152.206':3128
'11#.#9.49.172':3128
'91.##1.159.1':3128
'19#.#.80.193':3128
'21#.#3.15.59':3128
'11#.#49.99.195':3128
'41.##1.50.141':3128
'41.##7.123.46':3128
'2.##2.61.21':3128
'77.##5.6.251':3128
'41.##2.147.248':3128
'84.##8.143.240':3128
'2.###.217.199':3128
'19#.#22.233.166':3128
'18#.#8.64.136':3128
'19#.#3.101.58':3128
'41.##2.34.54':3128
'14#.#55.133.69':3128
'19#.#00.145.63':3128
'2.##2.51.25':3128
'84.##.110.184':3128
'67.##0.47.37':3128
'95.##.248.174':3128
'20#.#5.120.24':3128
'11#.#8.0.130':3128
'19#.#3.165.73':3128
'13#.#05.165.34':3128
'21#.#19.209.131':3128
'15#.#81.171.132':3128
'20#.#04.110.23':3128
'20#.8.94.29':3128
'19#.#45.114.5':3128
'89.##.45.224':3128
'95.##.32.186':3128
'2.###.219.232':3128
'18#.#2.116.18':3128
'95.##.124.38':3128
'67.##7.145.130':3128
'46.##4.151.194':3128
'21#.#8.140.44':3128
'2.##2.37.84':3128
'84.##8.121.56':3128
'11#.#9.48.101':3128
'16#.#67.84.222':3128
'19#.#99.20.84':3128
'85.##5.83.227':3128
'17#.#44.161.209':3128
'19#.#45.114.4':3128
'76.##1.89.146':3128
'18#.#14.101.56':3128
'17#.#75.204.158':3128
'19#.#74.71.52':3128
'77.##.233.235':3128
'19#.#13.15.230':3128
'19#.#11.134.80':3128
'18#.#14.97.87':3128
'19#.#6.11.170':3128
'41.##2.124.217':3128
'18#.#5.240.29':3128
'19#.#20.153.49':3128
'78.##.151.25':3128
'19#.#07.142.177':3128
'95.##.228.37':3128
'18#.#0.45.250':3128
'65.##5.112.162':3128
'79.##5.253.7':3128
'21#.#9.141.17':3128
'67.##0.45.117':3128
'11#.#9.54.172':3128
'11#.#20.209.219':3128
'41.##2.123.137':3128
'98.##7.180.139':3128
'21#.#9.181.49':3128
'19#.#74.77.184':3128
'19#.#7.239.45':3128
'17#.#5.14.97':3128
'17#.#1.195.132':3128
'11#.81.33.8':3128
'41.##2.60.146':3128
'41.##8.138.77':3128
'18#.#2.133.182':3128
'11#.#9.48.28':3128
'82.##8.97.240':3128
'20#.#1.190.170':3128
'96.##7.166.214':3128
'17#.#68.44.113':3128
'37.#9.67.80':3128
'2.###.65.225':3128
'98.#95.76.6':3128
'11#.#9.50.101':3128
'18#.#61.143.224':3128
'18#.#4.241.171':3128
'37.#9.25.64':3128
'70.##0.64.179':3128
'11#.#93.65.200':3128
'91.##5.141.145':3128
'20#.#22.53.220':3128
'18#.#81.119.57':3128
'2.###.35.192':3128
'11#.#09.222.32':3128
'19#.#50.0.36':3128
'17#.#25.68.206':3128
'20#.#73.13.27':3128
'19#.#9.17.88':3128
'93.##6.154.250':3128
'19#.#50.3.10':3128
'59.##.210.166':3128
'11#.#8.215.123':3128
'98.##8.202.56':3128
'61.##4.150.206':3128
'19#.#9.16.102':3128
'77.#45.6.14':3128
'85.##.151.242':3128
'20#.#4.201.240':3128
'2.###.169.53':3128
'2.###.240.86':3128
'31.#.238.176':3128
'41.##.139.57':3128
'46.#0.2.58':3128
'98.##6.110.103':3128
'21#.#12.106.132':3128
'80.##.168.140':3128
'18#.#14.97.240':3128
'72.##2.176.94':3128
'11#.#9.12.38':3128
'41.##2.197.241':3128
'21#.#30.98.194':3128
'19#.#9.135.30':3128
'41.##3.57.76':3128
'12#.#5.248.82':3128
'20#.#3.216.26':3128
'2.###.197.249':3128
'2.##2.50.90':3128
'20#.#05.34.98':3128
'19#.#13.207.4':3128
'17#.#0.42.201':3128
'98.##.154.203':3128
'95.#6.18.34':3128
'84.##0.194.4':3128
'2.###.65.197':3128
'2.###.244.48':3128
'16#.#67.212.235':3128
'19#.#7.208.172':3128

UDP:

DNS ASK 18#.http

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней