Trojan.DownLoader6.50900

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20247' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12808' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27077' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17847' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3426' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12540' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8169' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5887' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4977' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7458' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31784' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23705' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23493' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23341' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21641' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13198' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14899' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30083' = '<Полный путь к вирусу>'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Создает и запускает на исполнение:

C:\lsass.exe exe <Полный путь к вирусу>

Изменения в файловой системе:

Создает следующие файлы:

C:\lsass.exe

Сетевая активность:

Подключается к:

'93.##4.55.65':3128
'17#.#0.100.79':3128
'24.##.108.208':3128
'22#.#08.73.180':3128
'21#.#2.184.129':3128
'24.##5.158.82':3128
'19#.#2.232.10':3128
'70.##6.116.174':3128
'70.##7.109.173':3128
'71.##2.189.198':3128
'74.##3.123.238':3128
'85.##0.100.57':3128
'75.##0.202.167':3128
'18#.#5.92.66':3128
'18#.#8.166.18':3128
'98.#0.65.78':3128
'20#.#55.140.78':3128
'21#.#48.255.97':3128
'20#.#.57.122':3128
'21#.#53.156.209':3128
'24.##6.48.12':3128
'67.#75.27.8':3128
'59.##.76.200':3128
'76.##.223.90':3128
'18#.#1.241.42':3128
'88.##2.154.138':3128
'24.#.146.212':3128
'71.##.232.116':3128
'68.##9.208.229':3128
'98.##3.203.2':3128
'68.##8.32.93':3128
'78.##.131.149':3128
'69.##3.197.73':3128
'79.#78.0.34':3128
'20#.#53.246.101':3128
'18#.#9.164.119':3128
'19#.#4.103.24':3128
'78.##.210.31':3128
'24.##.113.67':3128
'21#.#9.177.56':3128
'80.##.139.153':3128
'94.##.214.226':3128
'69.##1.220.89':3128
'68.##.118.183':3128
'21#.#.194.194':3128
'81.##5.59.143':3128
'68.#.163.214':3128
'94.##9.207.229':3128
'20#.#73.147.106':3128
'20#.#38.240.62':3128
'19#.#7.157.42':3128
'86.##0.211.8':3128
'20#.#2.137.93':3128
'84.##.74.199':3128
'68.##5.124.123':3128
'20#.#0.109.11':3128
'71.#0.70.92':3128
'24.##5.158.124':3128
'75.##6.197.166':3128
'19#.#42.73.122':3128
'17#.#8.205.88':3128
'12#.#9.152.99':3128
'65.##5.145.141':3128
'82.##.223.105':3128
'82.##.106.18':3128
'78.##.117.96':3128
'20#.#09.95.118':3128
'93.##6.98.198':3128
'21#.#53.158.182':3128
'18#.#9.229.109':3128
'92.##0.118.228':3128
'99.##.229.242':3128
'79.#6.89.8':3128
'24.##3.76.97':3128
'20#.#1.251.242':3128
'24.##7.39.108':3128
'69.##2.43.235':3128
'18#.#.220.129':3128
'19#.#8.135.56':3128
'18#.#23.56.156':3128
'21#.#53.155.189':3128
'20#.#49.82.170':3128
'69.##9.49.85':3128
'20#.#5.246.12':3128
'24.##6.70.130':3128
'20#.#18.147.97':3128
'71.##9.182.113':3128
'18#.#4.133.117':3128
'11#.#50.87.16':3128
'20#.#0.68.189':3128
'82.##4.208.95':3128
'20#.#08.239.132':3128
'89.#35.13.5':3128
'67.##7.62.51':3128
'22#.#49.77.169':3128
'58.##.92.108':3128
'68.#6.93.8':3128
'72.##7.26.110':3128
'12#.#69.31.157':3128
'74.##3.123.ttp':0
'65.#5http':0
'localhost':833
'localhost':38
'localhost':383
'41.##1.64.137':3128
'94.##.186.56':3128
'85.##.188.101':3128
'11#.#6.119.1':3128
'21#.#27.18.101':3128
'21#.#27.18.93':3128
'20#.#0.90.48':3128
'21#.#0.232.236':3128
'95.#7.0.160':3128
'96.#8.69.82':3128
'19#.#83.82.91':3128
'76.##0.14.58':3128
'70.##7.56.37':3128
'64.##9.127.141':3128
'19#.#40.185.213':3128
'74.##6.226.38':3128
'68.##.70.206':3128
'80.##2.240.210':3128
'68.##.176.233':3128
'85.##.209.212':3128
'68.##9.49.117':3128
'24.##2.206.140':3128
'24.##.29.123':3128
'18#.#23.213.173':3128
'67.##1.137.134':3128
'20#.6.52.44':3128
'70.##2.208.102':3128
'67.##7.179.152':3128
'20#.#9.201.32':3128
'24.#90.1.4':3128
'19#.#98.230.62':3128
'12#.#90.117.130':3128
'71.##4.147.85':3128
'98.##0.208.194':3128
'20#.#46.213.28':3128
'85.#6.20.23':3128
'21#.#6.212.109':3128
'15#.#3.67.249':3128
'18#.#9.145.69':3128
'22#.#17.183.182':3128
'18#.#8.153.89':3128
'21#.#0.36.157':3128
'67.##.183.115':3128
'68.#.67.93':3128
'78.##.164.77':3128
'24.##.122.78':3128
'70.##3.133.165':3128
'77.##.185.226':3128
'72.##4.6.237':3128
'82.#3.7.30':3128
'75.##.45.224':3128
'89.##.248.127':3128
'20#.#49.65.10':3128
'24.##0.137.17':3128
'75.##8.168.91':3128
'18#.#23.61.175':3128
'86.##6.113.162':3128
'24.##9.121.0':3128
'68.#.113.109':3128
'18#.#4.132.23':3128
'67.##2.112.171':3128
'17#.#91.51.170':3128
'76.##.123.28':3128
'20#.#44.7.234':3128
'66.##8.245.98':3128
'20#.#68.156.243':3128
'86.#2.41.72':3128
'81.##0.59.235':3128
'19#.#50.108.214':3128
'77.#9.220.8':3128
'20#.#49.79.23':3128
'12#.#41.213.240':3128
'67.#4.24.91':3128
'89.##4.116.101':3128
'18#.#3.173.41':3128
'11#.#3.78.60':3128
'20#.#15.115.117':3128
'72.##0.114.96':3128
'20#.#2.196.169':3128
'19#.#05.142.42':3128
'97.##1.39.223':3128
'94.##2.49.43':3128
'19#.#17.49.22':3128
'21#.#31.135.235':3128
'83.##.148.12':3128
'91.#8.46.66':3128
'75.##.139.21':3128
'68.##.236.201':3128
'72.##6.65.161':3128
'65.##0.146.33':3128
'70.##0.83.31':3128
'24.##.232.196':3128
'18#.#4.186.156':3128
'68.##.135.118':3128
'67.##2.191.152':3128
'19#.#2.145.105':3128
'98.##3.163.223':3128
'79.##8.39.146':3128
'18#.#1.99.176':3128
'76.##9.59.198':3128
'97.##.24.152':3128
'66.##.228.107':3128
'19#.#07.111.81':3128
'81.##3.164.86':3128
'83.##0.36.147':3128
'85.##9.84.108':3128
'71.##.206.148':3128
'76.##.99.173':3128
'75.##2.12.31':3128
'12#.#22.128.219':3128
'11#.#62.7.229':3128
'20#.#9.209.58':3128
'79.##7.113.250':3128
'77.##.196.21':3128
'20#.#20.222.72':3128
'19#.#42.218.91':3128
'79.##7.57.145':3128
'89.##.98.154':3128
'24.##8.74.91':3128
'20#.#14.70.147':3128
'71.##2.129.216':3128
'21#.#07.38.12':3128
'19#.#47.62.253':3128
'20#.#3.202.106':3128
'64.##4.56.136':3128
'68.##4.123.97':3128
'69.##5.90.14':3128
'96.##.227.51':3128
'87.##7.120.157':3128
'74.##5.21.43':3128
'82.##.206.171':3128
'68.##3.43.149':3128
'69.##9.80.49':3128
'89.##.63.223':3128
'19#.#4.225.104':3128
'21#.#17.89.245':3128
'75.##.107.76':3128
'98.#5.78.68':3128
'24.##.232.175':3128
'72.##7.95.146':3128
'82.#36.99.8':3128
'12#.#34.75.160':3128
'78.##9.80.106':3128
'98.##4.149.92':3128
'11#.#5.129.36':3128
'20#.#5.105.44':3128
'11#.#4.89.68':3128
'67.##1.237.165':3128
'70.#61.5.54':3128
'12#.#38.132.30':3128
'19#.#74.235.162':3128
'78.##.167.42':3128
'66.##1.232.142':3128
'76.##4.39.199':3128
'70.##9.61.190':3128
'67.#2.3.13':3128
'19#.#03.124.84':3128
'84.##.144.188':3128
'80.##.115.132':3128
'18#.#.230.75':3128
'18#.#06.16.162':3128
'67.##4.228.190':3128
'65.##.67.247':3128
'72.##4.118.42':3128
'98.##9.144.177':3128
'68.##.42.179':3128
'11#.#03.114.70':3128
'68.##6.155.196':3128
'20#.#.62.238':3128
'98.##1.147.84':3128
'17#.#0.189.240':3128
'20#.#1.170.159':3128
'21#.#27.18.79':3128
'76.##.15.188':3128
'24.##.78.180':3128
'24.##1.155.22':3128
'16#.#7.196.152':3128
'77.##6.243.231':3128
'70.##1.253.221':3128
'87.##6.75.219':3128
'82.##8.193.185':3128
'24.##6.44.58':3128
'78.##.115.242':3128
'18#.#9.204.68':3128
'20#.#49.82.172':3128
'19#.#9.69.253':3128
'21#.#17.93.51':3128
'89.##.94.130':3128
'18#.#6.182.108':3128
'88.##7.188.31':3128
'80.#5.77.3':3128
'82.##.100.232':3128
'20#.#.210.202':3128
'79.##3.254.210':3128
'64.##5.206.199':3128
'11#.#96.234.113':3128
'58.##2.23.93':3128
'68.##3.218.50':3128
'19#.#46.179.165':3128
'76.##.13.201':3128
'69.##3.126.92':3128

UDP:

DNS ASK 75.##.139TSOPh.tttp
DNS ASK 18#.##.241.TSOPh.tdhttp
DNS ASK dT##Ph.tttp
DNS ASK 74.##3.123.ttp
DNS ASK 65.#5http

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней