Trojan.DownLoader6.28624

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\urdvxc.exe /uninstallservice patch:<Полный путь к вирусу>
<SYSTEM32>\urdvxc.exe /service
<SYSTEM32>\urdvxc.exe /installservice
<SYSTEM32>\urdvxc.exe /start

Запускает на исполнение:

<SYSTEM32>\dumprep.exe 1136 -dm 7 7 %TEMP%\WER127e.dir00\svchost.exe.mdmp 16325836412032344

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%TEMP%\WER127e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'60.##4.232.214':139
'60.##4.145.25':139
'60.##4.174.109':139
'60.##4.54.57':139
'60.##4.132.62':139
'60.##4.167.69':139
'60.##4.158.166':139
'60.##4.217.42':139
'60.#04.21.0':139
'60.##4.247.125':139
'60.##4.93.46':139
'60.##4.39.36':139
'60.##4.53.21':139
'60.##4.32.195':139
'60.##4.230.149':139
'60.#04.59.5':139
'60.##4.188.237':139
'60.##4.86.232':139
'60.##4.65.38':445
'60.##4.62.102':445
'60.##4.16.84':445
'60.##4.95.154':445
'60.##4.122.127':445
'60.##4.110.75':445
'60.##4.112.101':445
'60.##4.189.213':445
'60.##4.251.94':445
'60.##4.111.97':445
'60.##4.91.188':445
'60.##4.251.129':445
'60.##4.5.252':445
'60.##4.210.2':445
'60.##4.241.228':445
'60.##4.25.93':445
'60.##4.18.162':445
'60.##4.47.201':445
'60.##4.157.133':139
'60.##4.91.188':139
'60.##4.18.162':139
'60.##4.210.2':139
'60.##4.111.97':139
'60.##4.47.201':139
'60.##4.25.93':139
'60.##4.95.154':139
'60.##4.241.228':139
'60.##4.16.84':139
'60.##4.70.154':9988
'60.##4.117.134':9988
'60.##4.184.197':9988
'60.##4.134.59':9988
'60.##4.24.27':9988
'60.##4.251.129':139
'60.##4.5.252':139
'60.##4.29.177':9988
'60.##4.229.243':9988
'60.##4.122.32':139
'60.##4.110.75':139
'60.##4.136.122':139
'60.##4.189.213':139
'60.##4.11.101':139
'60.##4.101.253':139
'60.##4.253.48':139
'60.##4.157.160':139
'60.##4.253.156':139
'60.##4.65.38':139
'60.##4.20.56':139
'60.##4.122.127':139
'60.##4.62.102':139
'60.##4.126.181':139
'60.##4.251.94':139
'60.##4.112.101':139
'60.##4.233.66':139
'60.##4.71.174':139
'60.##4.218.80':139
'60.##4.174.218':139
'60.##4.37.128':139
'60.##4.147.116':139
'60.##4.106.61':139
'60.##4.68.91':139
'60.##4.183.56':139
'60.##4.156.62':139
'60.##4.14.14':139
'60.##4.203.138':139
'60.##4.172.52':139
'60.##4.184.30':139
'60.##4.16.241':139
'60.##4.129.164':139
'60.##4.96.159':139
'60.##4.127.212':139
'60.##4.238.129':139
'60.##4.158.238':139
'60.##4.240.82':139
'60.##4.143.244':445
'60.##4.150.226':139
'60.#04.0.41':139
'60.##4.58.79':445
'60.##4.27.106':445
'60.##4.240.194':445
'60.##4.58.150':445
'60.##4.167.121':445
'60.##4.206.97':139
'60.##4.219.39':139
'60.##4.2.166':139
'60.##4.219.80':139
'60.##4.19.27':139
'60.##4.28.68':139
'60.##4.226.204':139
'60.##4.162.154':139
'60.##4.77.197':139
'60.##4.120.99':139
'60.##4.39.36':445
'60.##4.253.48':445
'60.##4.86.232':445
'60.##4.101.253':445
'60.##4.247.125':445
'60.##4.188.237':445
'60.#04.59.5':445
'60.##4.93.46':445
'60.##4.157.133':445
'60.##4.71.174':445
'60.##4.253.156':445
'60.##4.126.181':445
'60.##4.11.101':445
'60.##4.20.56':445
'60.##4.136.122':445
'60.##4.157.160':445
'60.##4.122.32':445
'60.##4.233.66':445
'60.#04.21.0':445
'60.##4.58.79':139
'60.##4.232.214':445
'60.##4.167.69':445
'60.##4.58.150':139
'60.##4.240.194':139
'60.##4.27.106':139
'60.##4.143.244':139
'60.##4.167.121':139
'60.##4.132.62':445
'60.##4.158.166':445
'60.##4.230.149':445
'60.##4.145.25':445
'60.##4.174.109':445
'60.##4.217.42':445
'60.##4.53.21':445
'60.##4.54.57':445
'60.##4.32.195':445
'60.##4.131.122':139
'60.##4.160.4':139
'60.##4.59.87':139
'60.##4.122.59':139
'60.##4.151.118':139
'60.##4.37.159':445
'60.##4.159.37':445
'60.##4.209.73':445
'60.##4.181.171':445
'60.##4.192.213':139
'60.##4.204.150':139
'60.##4.58.34':139
'60.##4.24.134':139
'60.##4.63.173':139
'60.##4.20.144':139
'60.##4.87.20':139
'60.##4.211.252':139
'60.##4.144.212':139
'60.##4.91.232':445
'60.##4.184.197':445
'60.##4.66.113':445
'60.##4.226.185':445
'60.##4.107.11':445
'60.##4.229.243':445
'60.#04.36.1':445
'60.##4.131.98':445
'60.##4.73.10':445
'60.##4.35.159':445
'60.##4.116.156':445
'60.##4.17.15':445
'60.##4.113.155':445
'60.##4.35.116':445
'60.##4.67.37':445
'60.##4.17.217':445
'60.#04.7.50':445
'60.##4.117.134':445
'60.##4.72.58':139
'60.##4.67.37':139
'60.##4.17.217':139
'60.##4.117.134':139
'60.#04.7.50':139
'60.##4.66.113':139
'60.##4.184.197':139
'60.##4.107.11':139
'60.##4.226.185':139
'60.##4.91.232':139
'60.##4.181.171':139
'60.##4.37.159':139
'60.##4.159.37':139
'60.##4.209.73':139
'60.##4.17.15':139
'60.##4.116.156':139
'60.##4.35.116':139
'60.##4.113.155':139
'60.##4.35.159':139
'60.##4.19.144':139
'60.##4.24.27':139
'60.##4.21.102':139
'60.##4.29.177':139
'60.##4.186.24':139
'60.##4.192.164':139
'60.##4.134.59':139
'60.##4.77.217':139
'60.##4.60.102':139
'60.##4.73.10':139
'60.#04.36.1':139
'60.##4.229.243':139
'60.##4.131.98':139
'60.##4.72.120':139
'60.#04.98.0':139
'60.##4.70.154':139
'60.##4.0.190':139
'60.##4.190.72':139
'60.##4.190.72':9988
'60.##4.77.217':9988
'60.##4.21.102':9988
'60.##4.0.190':9988
'60.##4.73.10':9988
'60.##4.144.212':9988
'60.##4.87.20':9988
'60.##4.186.24':9988
'60.##4.122.59':9988
'60.##4.107.11':9988
'60.##4.159.37':9988
'60.##4.113.155':9988
'60.##4.67.37':9988
'60.##4.17.15':9988
'60.##4.131.98':9988
'60.##4.226.185':9988
'60.##4.66.113':9988
'60.##4.160.4':9988
'60.#04.36.1':9988
'60.##4.72.120':9988
'60.##4.151.118':9988
'60.##4.72.58':9988
'60.#04.7.50':9988
'60.##4.116.156':9988
'60.##4.37.159':9988
'60.##4.63.173':9988
'60.##4.35.116':9988
'60.##4.131.122':9988
'60.##4.20.144':9988
'60.##4.58.34':9988
'60.##4.91.232':9988
'60.##4.211.252':9988
'60.##4.24.134':9988
'60.##4.59.87':9988
'60.##4.19.144':9988
'60.##4.204.150':9988
'60.##4.192.213':9988
'60.##4.77.217':445
'60.##4.134.59':445
'60.##4.186.24':445
'60.##4.60.102':445
'60.##4.192.164':445
'60.##4.24.134':445
'60.##4.192.213':445
'60.##4.72.58':445
'60.##4.58.34':445
'60.##4.190.72':445
'60.##4.0.190':445
'60.#04.98.0':445
'60.##4.72.120':445
'60.##4.70.154':445
'60.##4.24.27':445
'60.##4.19.144':445
'60.##4.21.102':445
'60.##4.29.177':445
'60.##4.35.159':9988
'60.##4.209.73':9988
'60.##4.160.4':445
'60.##4.151.118':445
'60.##4.17.217':9988
'60.##4.192.164':9988
'60.##4.60.102':9988
'60.#04.98.0':9988
'60.##4.181.171':9988
'60.##4.211.252':445
'60.##4.20.144':445
'60.##4.204.150':445
'60.##4.63.173':445
'60.##4.144.212':445
'60.##4.131.122':445
'60.##4.122.59':445
'60.##4.87.20':445
'60.##4.59.87':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней