Trojan.Packed.23045

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'24.##.114.81':3128
'18#.#47.110.156':3128
'91.##5.50.65':3128
'91.##.183.242':3128
'17#.#00.178.27':3128
'20#.#08.33.15':3128
'71.##.126.210':3128
'95.##1.151.172':3128
'78.##.239.90':3128
'95.#6.74.34':3128
'21#.#30.96.59':3128
'95.##.241.113':3128
'2.###.242.197':3128
'41.#20.16.4':3128
'12#.#38.71.233':3128
'2.###.246.138':3128
'49.##8.168.62':3128
'18#.#8.215.201':3128
'11#.#9.58.55':3128
'17#.#19.115.117':3128
'41.##0.37.54':3128
'20#.#09.193.225':3128
'81.##.24.123':3128
'18#.#64.75.171':3128
'46.##0.243.190':3128
'98.##.155.100':3128
'46.##3.178.198':3128
'18#.#8.171.1':3128
'41.##8.138.77':3128
'24.#.209.53':3128
'19#.#79.209.107':3128
'17#.#.205.107':3128
'20#.#0.114.25':3128
'62.#4.46.93':3128
'77.#45.6.90':3128
'41.##8.229.131':3128
'19#.#02.244.173':3128
'20#.#72.84.183':3128
'87.##0.166.58':3128
'18#.#90.145.77':3128
'21#.#41.21.177':3128
'61.#.33.12':3128
'95.#7.99.76':3128
'92.##.44.223':3128
'84.##.77.105':3128
'2.###.42.223':3128
'79.##7.47.200':3128
'19#.#07.2.118':3128
'20#.#42.146.44':3128
'31.#.60.189':3128
'91.##.16.104':3128
'78.##.174.247':3128
'20#.#.46.245':3128
'19#.#49.8.117':3128
'77.##.233.235':3128
'21#.#30.70.162':3128
'89.##.49.179':3128
'2.###.118.228':3128
'46.##.249.105':3128
'89.##3.98.138':3128
'18#.#53.32.171':3128
'19#.#6.196.3':3128
'41.#18.93.4':3128
'18#.#84.255.207':3128
'80.##1.187.8':3128
'41.##0.27.70':3128
'92.##5.143.129':3128
'2.##0.0.175':3128
'41.##2.124.217':3128
'91.##1.159.1':3128
'95.##.180.115':3128
'19#.#20.51.251':3128
'17#.#9.58.213':3128
'2.##0.51.72':3128
'81.##.23.180':3128
'41.##4.80.95':3128
'18#.#18.222.73':3128
'74.#15.3.63':3128
'20#.#7.14.81':3128
'24.##9.126.200':3128
'20#.#73.146.224':3128
'21#.96.2.58':3128
'19#.#04.105.158':3128
'19#.#22.233.166':3128
'20#.#6.23.45':3128
'19#.#4.221.96':3128
'87.##1.19.76':3128
'46.##3.211.50':3128
'19#.#.47.224':3128
'11#.#01.247.153':3128
'19#.#79.220.72':3128
'41.##.17.190':3128
'75.##9.134.187':3128
'77.##7.66.117':3128
'69.##7.219.41':3128
'74.#15.1.93':3128
'31.#9.1.123':3128
'18#.#84.200.126':3128
'20#.#48.99.55':3128
'41.##7.232.251':3128
'41.#6.8.141':3128
'2.###.217.230':3128
'50.##.153.52':3128
'95.##.21.223':3128
'59.#5.5.144':3128
'20#.#55.44.57':3128
'17#.#47.103.133':3128
'77.##6.194.247':3128
'88.##6.81.229':3128
'20#.#64.79.46':3128
'20#.#72.80.156':3128
'2.###.204.216':3128
'41.##.129.183':3128
'78.##.242.233':3128
'20#.#23.134.153':3128
'20#.#42.162.143':3128
'10#.#74.18.101':3128
'2.###.52.185':3128
'19#.#13.160.5':3128
'19#.#4.182.168':3128
'17#.#73.133.122':3128
'19#.#79.240.197':3128
'95.##.207.42':3128
'20#.#.123.227':3128
'19#.#04.1.186':3128
'20#.#60.37.56':3128
'20#.#60.136.179':3128
'41.##1.43.146':3128
'98.##6.110.103':3128
'20#.#0.102.85':3128
'18#.#99.100.70':3128
'77.##5.6.251':3128
'20#.#1.175.2':3128
'11#.#9.56.55':3128
'19#.#13.92.57':3128
'85.##3.247.22':3128
'2.###.122.36':3128
'2.##3.216.3':3128
'41.##.143.191':3128
'19#.#55.210.85':3128
'20#.#67.9.175':3128
'89.##5.244.229':3128
'93.#16.4.98':3128
'17#.#73.19.83':3128
'18#.#3.35.97':3128
'2.##2.48.61':3128
'17#.#19.126.78':3128
'2.###.188.123':3128
'2.##0.0.193':3128
'20#.#04.110.211':3128
'19#.#20.153.58':3128
'92.##.129.41':3128
'41.##5.8.190':3128
'18#.#05.251.47':3128
'31.##6.47.142':3128
'20#.#10.189.6':3128
'localhost':51
'20#.#67.16.16':3128
'17#.#66.128.213':3128
'92.##.250.198':3128
'localhost':510
'87.##7.50.133':3128
'20#.#09.168.142':3128
'19#.#0.44.49':3128
'18#.#1.192.248':3128
'20#.#43.151.93':3128
'77.##5.2.199':3128
'41.##.186.208':3128
'46.##.255.197':3128
'18#.#5.203.51':3128
'31.##0.227.212':3128
'65.##.129.50':3128
'19#.#79.219.201':3128
'20#.#09.184.225':3128
'20#.#1.231.34':3128
'78.#3.47.42':3128
'78.##.129.176':3128
'20#.#6.140.21':3128
'20#.#23.130.40':3128
'41.##5.253.225':3128
'19#.#28.5.11':3128
'19#.#20.153.48':3128
'19#.#55.210.80':3128
'85.##3.247.38':3128
'31.##6.56.174':3128
'84.##5.47.147':3128
'41.##.172.121':3128
'31.##.95.203':3128
'64.##.73.202':3128
'92.##.131.42':3128
'10#.#25.169.124':3128
'20#.#3.162.99':3128
'41.##3.57.75':3128
'21#.#12.106.132':3128
'20#.#65.172.24':3128
'41.##.205.112':3128
'19#.#01.249.188':3128
'2.###.242.45':3128
'19#.#19.213.37':3128
'72.##.132.68':3128
'20#.#22.102.3':3128
'19#.#13.196.6':3128
'localhost':130
'16#.#67.84.222':3128
'18#.#1.39.90':3128
'41.##2.49.188':3128
'85.##4.253.12':3128
'37.##.81.143':3128
'91.##.106.119':3128
'20#.#04.66.213':3128
'18#.#8.155.149':3128
'95.#6.83.54':3128
'79.##7.47.198':3128
'19#.#9.179.111':3128
'20#.#0.111.14':3128
'76.##.176.88':3128
'11#.#9.57.41':3128
'94.##.70.150':3128
'20#.#19.4.10':3128
'61.##.87.222':3128
'20#.#65.65.51':3128
'2.##0.0.200':3128
'50.##.152.35':3128
'20#.#0.115.170':3128
'41.##7.205.114':3128
'74.##3.119.224':3128
'41.##7.32.25':3128
'2.###.231.184':3128
'74.#15.0.21':3128
'84.##8.82.170':3128
'20#.#6.131.150':3128
'19#.#20.153.46':3128
'11#.#52.191.187':3128
'19#.#07.10.6':3128
'21#.#6.151.227':3128
'41.##.17.192':3128
'2.###.49.174':3128
'46.##0.111.146':3128
'20#.#2.169.28':3128
'46.##5.102.118':3128
'41.##.172.185':3128
'18#.#26.78.243':3128
'2.##4.0.205':3128
'2.##5.53.74':3128
'80.##.168.76':3128
'21#.#3.15.59':3128
'77.##5.6.231':3128
'17#.#8.195.30':3128
'95.##.31.214':3128
'18#.#15.96.194':3128
'80.#0.168.1':3128
'19#.#79.199.69':3128
'2.###.244.48':3128
'17#.#3.169.29':3128
'95.##.29.196':3128
'5.##.55.164':3128
'20#.#4.234.227':3128
'22#.#20.237.99':3128
'74.#15.1.41':3128
'20#.#04.225.147':3128
'20#.#65.14.174':3128
'18#.#98.213.35':3128
'76.##.178.176':3128
'2.###.63.231':3128
'20#.#3.57.123':3128
'62.##.43.105':3128
'2.###.94.160':3128
'2.###.245.146':3128
'20#.#65.170.209':3128
'84.##.93.115':3128
'2.##0.0.174':3128
'18#.#8.144.28':3128
'19#.#20.152.82':3128
'19#.#13.196.7':3128
'19#.#98.81.219':3128
'21#.#41.22.138':3128
'20#.#1.190.170':3128
'81.##.24.100':3128
'85.##3.247.145':3128
'20#.#59.209.181':3128
'18#.#14.133.135':3128
'18#.#84.221.134':3128
'19#.#9.168.38':3128
'2.###.218.191':3128
'46.##0.159.36':3128
'31.#.180.198':3128
'19#.#04.198.77':3128
'17#.#.204.82':3128
'95.##7.217.5':3128
'80.##.168.27':3128
'93.##6.12.53':3128
'19#.#3.76.71':3128
'95.##.220.118':3128
'20#.#10.157.122':3128
'21#.#36.101.35':3128
'17#.#9.86.35':3128
'19#.#1.111.59':3128
'95.##.194.118':3128
'20#.#3.49.99':3128
'17#.#7.89.222':3128
'2.##1.61.25':3128
'19#.#02.194.192':3128
'24.#.252.62':3128
'20#.#09.175.103':3128
'46.##.243.47':3128
'92.##.66.136':3128
'2.###.135.249':3128
'19#.#98.80.43':3128
'17#.#19.93.145':3128
'95.##.123.32':3128
'80.##.168.127':3128
'83.##1.191.239':3128
'95.##.232.85':3128
'87.##4.163.167':3128
'19#.#79.242.143':3128
'92.##.175.219':3128
'37.##.76.164':3128
'85.##3.247.220':3128
'2.###.248.47':3128
'18#.#94.249.188':3128
'31.#7.8.195':3128
'19#.#18.241.19':3128
'21#.#6.9.182':3128
'77.#45.6.24':3128
'19#.#14.255.234':3128
'19#.#01.3.98':3128
'46.##1.181.199':3128
'10#.#29.170.12':3128
'85.##5.235.210':3128
'46.#8.132.8':3128
'20#.#11.158.159':3128
'41.#9.7.53':3128
'41.##2.240.175':3128
'19#.#13.196.4':3128
'20#.#64.130.251':3128
'46.##1.139.243':3128
'41.##.172.252':3128
'41.#9.6.15':3128
'87.##7.47.123':3128
'92.##.48.170':3128
'19#.#00.223.214':3128
'86.##6.40.27':3128
'19#.#2.57.77':3128
'81.##3.5.112':3128
'17#.#9.140.147':3128
'19#.#.97.196':3128
'20#.#2.90.111':3128
'92.##.138.102':3128
'21#.#49.86.130':3128
'95.#7.71.39':3128
'85.##0.81.228':3128
'95.##.228.199':3128
'19#.#4.192.174':3128
'46.##1.181.229':3128
'22#.#55.224.27':3128
'83.##8.206.107':3128
'41.##3.159.82':3128
'80.##6.0.109':3128
'17#.#44.161.209':3128
'41.##3.57.76':3128
'20#.#09.223.210':3128
'84.##.103.195':3128
'20#.#6.33.36':3128
'41.##0.200.219':3128
'20#.#1.32.99':3128
'20#.#7.137.226':3128
'92.##.214.208':3128
'11#.#9.60.41':3128
'86.##9.52.121':3128
'18#.#85.211.236':3128
'20#.#73.146.161':3128
'37.##.35.101':3128
'19#.#14.255.38':3128
'95.##.171.46':3128
'19#.#20.153.51':3128
'82.##5.17.115':3128
'17#.#9.151.95':3128
'19#.72.17.3':3128
'41.##3.57.78':3128
'20#.#.220.188':3128
'20#.#2.151.138':3128
'82.##0.168.67':3128
'84.##.73.193':3128
'95.##.205.137':3128
'89.##.57.252':3128
'84.##0.194.4':3128
'19#.#01.47.159':3128
'20#.#42.176.90':3128
'19#.#20.153.22':3128
'74.#15.3.67':3128
'18#.#1.12.193':3128
'71.##.98.110':3128
'19#.#07.25.161':3128
'19#.#13.196.1':3128
'18#.#98.248.16':3128
'84.##.230.244':3128
'19#.#83.74.251':3128
'21#.#30.120.129':3128
'41.##.76.218':3128
'20#.#09.98.235':3128
'19#.#20.64.3':3128
'18#.#1.209.197':3128
'83.##9.65.51':3128
'10#.#10.6.212':3128
'95.#9.2.148':3128
'19#.#20.153.45':3128
'94.##.150.57':3128
'20#.#09.156.166':3128
'18#.#16.0.38':3128
'2.###.145.41':3128
'24.##8.124.163':3128
'19#.#79.224.240':3128
'93.##6.154.250':3128
'87.##7.48.48':3128
'95.#7.66.58':3128
'18#.#7.32.152':3128
'95.##.45.246':3128
'92.##.45.219':3128
'82.##5.17.81':3128
'85.##.179.83':3128
'2.###.97.161':3128
'20#.#64.177.131':3128
'2.##0.0.189':3128
'46.##1.150.109':3128
'19#.#07.23.116':3128
'18#.#94.212.130':3128
'20#.#7.144.42':3128
'20#.#22.53.220':3128
'2.###.180.255':3128
'21#.#12.253.80':3128
'80.##1.202.72':3128
'19#.#13.196.3':3128
'95.##.203.21':3128
'18#.#0.223.24':3128
'41.##.145.172':3128
'10#.#60.9.38':3128
'80.##.168.131':3128
'2.##.150.19':3128
'41.##3.228.17':3128
'21#.#30.116.211':3128
'46.##0.109.253':3128
'17#.#19.126.26':3128
'46.##.143.216':3128
'46.##1.222.152':3128
'95.##.102.58':3128
'41.##5.83.146':3128
'81.#3.24.97':3128
'20#.#0.94.147':3128
'17#.#73.187.136':3128
'18#.#15.78.72':3128
'46.##.235.191':3128
'2.##0.0.181':3128
'72.##2.191.109':3128
'41.##0.68.10':3128
'17#.#75.198.211':3128
'17#.#2.138.45':3128
'20#.#67.11.109':3128
'19#.#20.68.82':3128
'82.##5.47.41':3128
'46.##.192.101':3128
'80.##1.187.32':3128
'20#.#22.17.153':3128
'12#.#62.231.164':3128
'85.##5.81.183':3128
'95.##.36.251':3128
'18#.#1.50.164':3128
'21#.#30.87.251':3128
'77.#45.6.14':3128
'11#.#9.56.41':3128
'19#.#55.210.74':3128
'17#.#73.43.245':3128
'19#.#79.197.46':3128
'20#.#1.216.225':3128
'2.###.52.101':3128
'19#.#7.232.118':3128
'11#.81.33.8':3128
'37.##.108.37':3128
'95.##.111.176':3128
'20#.#3.33.108':3128
'21#.#30.70.245':3128
'81.#3.24.99':3128

UDP:

DNS ASK 85.ttp

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней