Trojan.DownLoader33.18342

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\tbcdeeoce.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\s.bat
%TEMP%\<Имя файла>.exe.pid

Сетевая активность

Подключается к

'fo####roptical.com':443
'ge###obio.com':80
'ge###lata.com':80
'ge###fety.com':80
'ge####fashion.com':80

TCP

Запросы HTTP GET

http://17#.##1.14.53:8888/bots/knock?wo###################################### via 17#.#21.14.53
http://fo##r.co.in/rss/catalog/notifystock/
http://fo###zoom.com/rss/catalog/notifystock/
http://fo#####amsperfumes.com/rss/catalog/notifystock/
http://fr####lelements.com/rss/catalog/notifystock/
http://www.fo####computers.com/downloader//downloader/
http://fr####aileron.fr/rss/catalog/notifystock/
http://fn###cords.net/rss/catalog/notifystock/
http://www.fo#######otfloristgulfport.com/index.php/admin/index/
http://www.fo###rama.com/downloader//downloader/index.php
http://www.fl######flascolinastx.com/index.php/admin/index/
http://www.fl######flascolinastx.com/index.php/admin/sales_order/
http://fr###iashop.ru/rss/catalog/notifystock/
http://fr###oblue.com/rss/catalog/notifystock/
http://fr##talk.me/rss/catalog/notifystock/
http://fo#####edicalsupply.com/rss/catalog/notifystock/
http://fo###mall.com/rss/catalog/notifystock/
http://fo####roptical.com/rss/catalog/notifystock/
http://fo###rafium.com/rss/catalog/notifystock/
http://fo####ietnam.com/rss/catalog/notifystock/
http://17#.##1.14.53:8888/bots/chkVersion?cu#################### via 17#.#21.14.53
http://17#.##1.14.53:8888/gw?wo############### via 17#.#21.14.53
http://17#.##1.14.53:8888/gw?wo##### via 17#.#21.14.53
http://fl###press.com/rss/catalog/notifystock/
http://fo###2go.com/rss/catalog/notifystock/
http://fo###mass.ru/rss/catalog/notifystock/
http://fr###ite.com/rss/catalog/notifystock/
http://fr####4rides.com/rss/catalog/notifystock/
http://fo#####odservice.com/rss/catalog/notifystock/
http://fo####riends.com/rss/catalog/notifystock/
http://fo###arket.com/rss/catalog/notifystock/
http://fo###wap.com/rss/catalog/notifystock/
http://fo###piano.com/rss/catalog/notifystock/
http://fo##igi.com/rss/catalog/notifystock/
http://fo####ecpusa.com/rss/catalog/notifystock/
http://17#.##1.14.53:8888/project/active via 17#.#21.14.53
http://fl####elerated.com/rss/catalog/notifystock/
http://fr##sby.com/rss/catalog/notifystock/

Запросы HTTP POST

http://fl####shoppenc.com/index.php/admin/sales_order/
http://fo##r.co.in/downloader//downloader/index.php
http://fo###mall.com/index.php/admin/sales_order/
http://fo####ietnam.com/index.php/admin/sales_order/
http://fo##bbq.com/index.php/admin/
http://fo##bbq.com/index.php/admin
http://fo##bbq.com/downloader//downloader/index.php
http://fo###mall.com/index.php/admin/login/
http://fo###mall.com/downloader//downloader/index.php
http://fo###mall.com/index.php/admin/index.php/rss/
http://fo###zoom.com/index.php/admin/sales_order/
http://fo###zoom.com/downloader//downloader/index.php
http://fo###mall.com/index.php/admin/index.php/index.php/
http://fo#####ds-trading.com/index.php/admin/sales_order/
http://fo###iden.com/downloader//downloader/index.php
http://fo#####ds-trading.com/downloader//downloader/index.php
http://fr####ein-spitz.de/downloader//downloader/index.php
http://fo#####ds-trading.com/index.php/admin/index/
http://fo#####ds-trading.com/index.php/admin/
http://fo#####ds-trading.com/index.php/admin
http://fr####lelements.com/downloader//downloader/index.php
http://fo####nster.com.hk/index.php/admin/
http://fr####nces.com.ng/downloader//downloader/index.php
http://fr#####is-fishing.com/downloader//downloader/index.php
http://fo##bbq.com/index.php/admin/index/
http://fl###pply.com/index.php/admin/index/
http://fo#####edicalsupply.com/index.php/admin/
http://fo#####edicalsupply.com/index.php/admin/sales_order/
http://fl###pply.com/index.php/admin/
http://fl###pply.com/index.php/admin
http://fo###tay.com/downloader//downloader/index.php
http://fo###m-bg.com/downloader//downloader/index.php
http://fo####angels.com/index.php/admin/index.php/Store/
http://fl####elerated.com/index.php/admin/
http://fo######flectionsstore.com/downloader//downloader/index.php
http://fl####elerated.com/downloader//downloader/index.php
http://fo#####reflections.com/downloader//downloader/index.php
http://fo#####amsperfumes.com/index.php/admin/sales_order/
http://fo#####amsperfumes.com/index.php/admin/index/
http://fo#####amsperfumes.com/downloader//downloader/index.php
http://fo###rtruck.com/downloader//downloader/index.php
http://fo####edbangles.com/downloader//downloader/index.php
http://fl#####hop-yahiro.com/index.php/admin/
http://fo####allery.com/index.php/admin/index/
http://fo###direct.com/downloader//downloader/index.php
http://fo#####edicalsupply.com/index.php/admin
http://fl####elerated.com/index.php/admin/sales_order/
http://fl####elerated.com/index.php/admin
http://fl###2share.com/downloader//downloader/index.php
http://fo###rama.com/downloader//downloader/index.php
http://fo########defenseandsecurity.com/downloader//downloader/index.php
http://fo#####edicalsupply.com/index.php/admin/index/
http://fl######flascolinastx.com/index.php/admin/index/
http://fr####ein-spitz.com/downloader//downloader/index.php
http://fr#####etuves-store.com/downloader//downloader/index.php
http://fr####nchlabs.com/downloader//downloader/index.php
http://fr####rygarlic.com/downloader//downloader/index.php
http://fr######ecurityproducts.com/downloader//downloader/index.php
http://fr###ydeco.com/index.php/admin/index/
http://fr###ascot.com/downloader//downloader/index.php
http://fr###ite.com/index.php/admin/index/
http://fr###ite.com/index.php/admin/sales_order/
http://fr###ite.com/downloader//downloader/index.php
http://fr###rich23.com/downloader//downloader/index.php
http://fr###ydeco.com/index.php/admin
http://fo#####odservice.com/index.php/admin
http://fr###chskys.com/downloader//downloader/index.php
http://fr###ydeco.com/index.php/admin/
http://fr#####delcentre.com/downloader//downloader/index.php
http://fr####ndfrill.com/downloader//downloader/index.php
http://fr###ylove.com/downloader//downloader/index.php
http://fr########childer-grabschilder.com/index.php/admin/sales_order/
http://fr####online.com/downloader//downloader/index.php
http://fr###ftsshop.dk/downloader//downloader/index.php
http://fr######rtcandlecompany.com/downloader//downloader/index.php
http://fr###oni.com/downloader//downloader/index.php
http://fr#####-shopping.com/index.php/admin/
http://fr####rotika.com/downloader//downloader/index.php
http://fr###-hair.com/downloader//downloader/index.php
http://fo#####predictions.com/downloader//downloader/index.php
http://fr###-shop.si/downloader//downloader/index.php
http://fr####rdshop.com/downloader//downloader/index.php
http://fr####aileron.fr/downloader//downloader/index.php
http://fr####4rides.com/index.php/admin
http://fr####ndoptic.com/downloader//downloader/index.php
http://fr####4rides.com/index.php/admin/sales_order/
http://fr#####ani-garden.de/index.php/admin/sales_order/
http://fr####nestyles.com/downloader//downloader/index.php
http://fr####4rides.com/index.php/admin/
http://fr####directshop.fr/downloader//downloader/index.php
http://fr######storefinland.com/downloader//downloader/index.php
http://fr###iashop.ru/index.php/admin/index.php/Store/
http://fr###iashop.ru/index.php/en/admin/index/
http://fr###iashop.ru/index.php/admin/index/
http://fr###iashop.ru/index.php/admin/index.php/rss/
http://fr###iashop.ru/index.php/admin/sales_order/
http://fr###iashop.ru/downloader//downloader/index.php
http://fr#####ani-garden.de/index.php/admin/index/
http://fr#####ani-garden.de/downloader//downloader/index.php
http://fr####isdeli.com/downloader//downloader/index.php
http://fr######osecosmetics.com/downloader//downloader/index.php
http://fr###nschuh.com/downloader//downloader/index.php
http://fr#####floraldesign.com/index.php/admin/index/
http://fr####coreshop.nl/downloader//downloader/index.php
http://fr####-shops.com/downloader//downloader/index.php
http://fr#####rosencimera.com/downloader//downloader/index.php
http://fo####angels.com/downloader//downloader/index.php
http://fo####angels.com/index.php/admin/index.php/rss/
http://fo####angels.com/index.php/admin/index/
http://fo#####nductionkits.com/index.php/admin/index/
http://fo####ontivy.com/downloader//downloader/index.php
http://fo####t-malo.com/downloader//downloader/index.php
http://fo#####bespoke.co.uk/downloader//downloader/index.php
http://fo####rengland.com/downloader//downloader/index.php
http://fo####t-nazaire.com/downloader//downloader/index.php
http://fo###vatar.com/downloader//downloader/index.php
http://fo##buy.com/index.php/admin/sales_order/
http://fo###vannes.com/downloader//downloader/index.php
http://fo######elaboratorio.com/index.php/admin/sales_order/
http://fo###doma.com/index.php/admin/sales_order/
http://fo###2go.com/downloader//downloader/index.php
http://fo##r.co/downloader//downloader/index.php
http://fo#######.avery-zweckform.com/downloader//downloader/index.php
http://fo#####sboutique.com/downloader//downloader/index.php
http://fo###dinan.com/downloader//downloader/index.php
http://fo###max.com/index.php/admin/sales_order/
http://fo###eroak.com/downloader//downloader/index.php
http://fo###wap.com/index.php/admin/sales_order/
http://fo###wap.com/index.php/admin/index/
http://fo###max.com/index.php/admin
http://fo###wap.com/downloader//downloader/index.php
http://fo###earus.com/downloader//downloader/index.php
http://fo###max.com/index.php/admin/
http://fo######shoulderpads.com/downloader//downloader/index.php
http://fo###cesson.com/downloader//downloader/index.php
http://fl###pply.com/index.php/admin/sales_order/
http://fo#####-gregoire.com/downloader//downloader/index.php
http://fo####riends.com/downloader//downloader/index.php
http://fl###rsds.com/index.php/admin/sales_order/
http://fo##ard.gr/downloader//downloader/index.php
http://fl####oncept24.com/downloader//downloader/index.php
http://fl####reyewear.com/downloader//downloader/index.php
http://fl##y.com/downloader//downloader/index.php
http://fl######flascolinastx.com/index.php/admin/sales_order/
http://fm###mport.com/index.php/admin/sales_order/
http://fl#####ngiftonline.com/downloader//downloader/index.php
http://fl###flex.ch/downloader//downloader/index.php
http://fo#r.nl/downloader//downloader/index.php
http://fo####as-lacon.com/index.php/admin/sales_order/
http://fo####gtablesuk.com/downloader//downloader/index.php
http://fo#####lspainshop.com/downloader//downloader/index.php
http://fl####wawards.com/downloader//downloader/index.php
http://fl####sontime.com/downloader//downloader/index.php
http://fo###pans.com/downloader//downloader/index.php
http://fo###ishops.nl/downloader//downloader/index.php
http://fo####intsearth.com/downloader//downloader/index.php
http://fo###-shop.ru/downloader//downloader/index.php
http://fo#####l-univers.com/downloader//downloader/index.php
http://fo###reze.com/downloader//downloader/index.php
http://fo###doma.com/index.php/admin/index/
http://fo####ndbody.com/downloader//downloader/index.php
http://fo###max.com/downloader//downloader/index.php
http://fo####as-lacon.com/index.php/admin/index/
http://fo####rflawless.sg/index.php/admin/index/
http://fo##igi.com/index.php/admin/index/
http://fm###mport.com/index.php/admin/
http://fo###arket.com/index.php/admin
http://fo##igi.com/downloader//downloader/index.php
http://fo###piano.com/downloader//downloader/index.php
http://fm###mport.com/index.php/admin
http://fo###piano.com/index.php/admin
http://fo###piano.com/index.php/admin/sales_order/
http://fl###rsds.com/index.php/admin/index/
http://fo###rtruck.com/index.php/admin/index/
http://fo###ourier.com/downloader//downloader/index.php
http://fo####angels.com/index.php/admin/sales_order/
http://fo##am.us/index.php/admin/sales_order/
http://fo###ega.com/downloader//downloader/index.php
http://fo###mass.ru/downloader//downloader/index.php
http://fo####roptical.com/downloader//downloader/index.php
http://fo####ansfers.co.uk/downloader//downloader/index.php
http://fo####brillante.com/index.php/admin/index/
http://fo###sascom.com/downloader//downloader/index.php
http://fo####ietnam.com/downloader//downloader/index.php
http://fo###arket.com/index.php/admin/sales_order/
http://fo###arket.com/index.php/admin/
http://fo###piano.com/index.php/admin/
http://fo##igi.com/index.php/admin
http://fo##igi.com/index.php/admin/
http://fo###max.com/index.php/admin/index/
http://fo####uritysake.com/downloader//downloader/index.php
http://fo###doma.com/index.php/admin
http://fo###doma.com/downloader//downloader/index.php
http://fo##hop.com/downloader//downloader/index.php
http://fo#####odservice.com/downloader//downloader/index.php
http://fo######elaboratorio.com/downloader//downloader/index.php
http://fo######elaboratorio.com/index.php/admin/index/
http://fo##buy.com/downloader//downloader/index.php
http://fl###oducts.com/downloader//downloader/index.php
http://fo#####odservice.com/index.php/admin/index/
http://fr######eraquatics.co.uk/downloader//downloader/index.php
http://fr###ydeco.com/downloader//downloader/index.php
http://fo#####odservice.com/index.php/admin/
http://fo####rflawless.sg/index.php/admin/sales_order/
http://fo####ecpusa.com/index.php/admin/sales_order/
http://fo####brillante.com/index.php/admin/sales_order/
http://fo###nantes.com/downloader//downloader/index.php
http://fo##igi.com/index.php/admin/sales_order/
http://fo####ecpusa.com/index.php/admin/index/
http://fo####ecpusa.com/downloader//downloader/index.php
http://fo####computers.com/downloader//downloader/index.php
http://fo####eproducts.com/downloader//downloader/index.php
http://fo######notfloristofms.com/index.php/admin/index/
http://fo###doma.com/index.php/admin/
http://fo######mputersystems.com/downloader//downloader/index.php
http://fr###el.com.br/downloader//downloader/index.php

'fo###rama.com':443

'fo####gtablesuk.com':443

'fr####nces.com.ng':443

'fo###mall.com':443

'fo###rafium.com':443

'fl####sontime.com':443

'hu###omains.com':443

'fo#####nductionkits.com':443

'fo###ega.com':443

'fo###dinan.com':443

'fo###doma.com':443

'fo###wap.com':443

'fl###press.com':443

'fl####wawards.com':443

'fo####uritysake.com':443

UDP

DNS ASK fl###rsds.com
DNS ASK fr####-shops.com
DNS ASK fr####aileron.fr
DNS ASK fr####directshop.fr
DNS ASK fr####nestyles.com
DNS ASK fr####isdeli.com
DNS ASK fr#####ani-garden.de
DNS ASK fr######osecosmetics.com
DNS ASK fr###iashop.ru
DNS ASK fr###nschuh.com
DNS ASK fr####sibility.com
DNS ASK fr#####etuves-store.com
DNS ASK fo#######otfloristgulfport.com
DNS ASK fr######ecurityproducts.com
DNS ASK fr####nchlabs.com
DNS ASK fr###ascot.com
DNS ASK fr###ite.com
DNS ASK fr###pen.com.br
DNS ASK fr######ertyshowcase.com
DNS ASK fr#####floraldesign.com
DNS ASK fr##talk.me
DNS ASK fr####adecity.com
DNS ASK fr###2shop.com
DNS ASK fr######storefinland.com
DNS ASK fo#####amsperfumes.com
DNS ASK fr####rdshop.com
DNS ASK fo###rama.com
DNS ASK fo###obile.com
DNS ASK fo#####usandfour.com
DNS ASK fo#####ds-trading.com
DNS ASK fo####ansfers.co.uk
DNS ASK fo###iden.com
DNS ASK fo##r.co.in
DNS ASK fo##bbq.com
DNS ASK fp#i.cn
DNS ASK fq#o.cn
DNS ASK fr###ydeco.com
DNS ASK fr##o.ng
DNS ASK hu###omains.com
DNS ASK fr####ein-spitz.com
DNS ASK fr####ein-spitz.de
DNS ASK fr#####is-fishing.com
DNS ASK fr####nces.com.ng
DNS ASK fr###-shop.si
DNS ASK fr####ndoptic.com
DNS ASK gr###e-dmd.fr
DNS ASK fr####4rides.com
DNS ASK fr#####ndframing.com
DNS ASK fl###2share.com
DNS ASK fr####lelements.com
DNS ASK fq#w.cn
DNS ASK fr#####rosencimera.com
DNS ASK fr###oblue.com
DNS ASK fr###row.uk.com
DNS ASK ge###fety.com
DNS ASK ge##ear.com
DNS ASK ge###euk.com
DNS ASK ge##ush.com
DNS ASK ge#####hcare-webshop.de
DNS ASK ge######ountryfabrics.com
DNS ASK ge####products.com
DNS ASK ge####rology.com
DNS ASK fr#####r-drilling.com
DNS ASK fr###pose.com
DNS ASK ge###nhardt.com
DNS ASK ge#####icsnutrition.com
DNS ASK ge#####ionflooring.com
DNS ASK fl#######lascolinasflorist.com
DNS ASK ge#####ristbands.com
DNS ASK ge####lighting.com
DNS ASK ge####tsupply.com
DNS ASK ge####fashion.com
DNS ASK ge#####-leather.com.ua
DNS ASK ge###rill.com
DNS ASK ge###lata.com
DNS ASK ge###obio.com
DNS ASK fr####travel.com.au
DNS ASK fr####coreshop.nl
DNS ASK fr####ndfrill.com
DNS ASK fr###-hair.com
DNS ASK fr####rygarlic.com
DNS ASK fr#####rdenroses.com
DNS ASK fr###junky.com
DNS ASK fr####adesign.com
DNS ASK fr###park.com
DNS ASK fr###picks.com
DNS ASK fr######rtcandlecompany.com
DNS ASK fr###els.com
DNS ASK fr####rotika.com
DNS ASK fr#####delcentre.com
DNS ASK fr######eraquatics.co.uk
DNS ASK fr###oni.com
DNS ASK fr###partes.com
DNS ASK fr####online.com
DNS ASK fr###ftsshop.dk
DNS ASK fr###el.com.br
DNS ASK fr#####-shopping.com
DNS ASK fr###ylove.com
DNS ASK fr##sby.com
DNS ASK fr########childer-grabschilder.com
DNS ASK fr###rich23.com
DNS ASK fr###chskys.com
DNS ASK fo####incandles.com
DNS ASK fo####roptical.com
DNS ASK fo###zoom.com
DNS ASK fo##r.co
DNS ASK fo####as-lacon.com
DNS ASK fo###pans.com
DNS ASK fo#r.nl
DNS ASK fo###piano.com
DNS ASK fo####gtablesuk.com
DNS ASK fo###arket.com
DNS ASK fo###2go.com
DNS ASK fo###mass.ru
DNS ASK fo##hop.com
DNS ASK fo###earus.com
DNS ASK fo#####odservice.com
DNS ASK fo#####vicequipment.com
DNS ASK fo####ietnam.com
DNS ASK fo##buy.com
DNS ASK fo#####l-univers.com
DNS ASK fo######shoulderpads.com
DNS ASK fo#####lspainshop.com
DNS ASK fo####ndbody.com
DNS ASK fo####intsearth.com
DNS ASK fo#####sboutique.com
DNS ASK fo###ourier.com
DNS ASK fo###vatar.com
DNS ASK fo####nster.com.hk
DNS ASK fn#o.cn
DNS ASK fl####elerated.com
DNS ASK fl####shoppenc.com
DNS ASK fl####sleeds.com
DNS ASK fl#####ngiftonline.com
DNS ASK fl######flascolinastx.com
DNS ASK fl####sontime.com
DNS ASK fl###pply.com
DNS ASK fl####oncept24.com
DNS ASK fl###press.com
DNS ASK fl##y.com
DNS ASK fo####riends.com
DNS ASK fo###-shop.ru
DNS ASK fl#####hop-yahiro.com
DNS ASK fl####wawards.com
DNS ASK fq#v.cn
DNS ASK fl###flex.ch
DNS ASK fl###oducts.com
DNS ASK fl###gear.com
DNS ASK fm###mport.com
DNS ASK fn###cords.net
DNS ASK fn#y.cn
DNS ASK fn#w.cn
DNS ASK fl#t.cn
DNS ASK fl####reyewear.com
DNS ASK fo####brillante.com
DNS ASK fo#####nductionkits.com
DNS ASK fo###direct.com
DNS ASK fo###wap.com
DNS ASK fo#######.avery-zweckform.com
DNS ASK fo####ashop.com.br
DNS ASK fo######elaboratorio.com
DNS ASK fo###max.com
DNS ASK fo####uritysake.com
DNS ASK fo###tay.com
DNS ASK fo####ecpusa.com
DNS ASK fo###sascom.com
DNS ASK fo####computers.com
DNS ASK fo###mall.com
DNS ASK fo#####predictions.com
DNS ASK fo###m-bg.com
DNS ASK fo##am.us
DNS ASK fo########defenseandsecurity.com
DNS ASK fo#####edicalsupply.com
DNS ASK fo###rtruck.com
DNS ASK fo###rafium.com
DNS ASK fo###ega.com
DNS ASK fq#u.cn
DNS ASK fo####edbangles.com
DNS ASK fo##ard.gr
DNS ASK fo####angels.com
DNS ASK fo######mputersystems.com
DNS ASK fo####allery.com
DNS ASK fo###gento.com
DNS ASK fo###ishops.nl
DNS ASK fo###cesson.com
DNS ASK fo###dinan.com
DNS ASK fo###nantes.com
DNS ASK fo####ontivy.com
DNS ASK fo###reze.com
DNS ASK fo#####-gregoire.com
DNS ASK fo####t-malo.com
DNS ASK fo####t-nazaire.com
DNS ASK fo###vannes.com
DNS ASK fo#####tproducts.com
DNS ASK fo##igi.com
DNS ASK fo######flectionsstore.com
DNS ASK fo#####bespoke.co.uk
DNS ASK fo####rengland.com
DNS ASK fo#####extensions.com
DNS ASK fo####rflawless.sg
DNS ASK fo###eroak.com
DNS ASK fo######notfloristofms.com
DNS ASK fo####eproducts.com
DNS ASK fo####aomagento.com
DNS ASK fo###doma.com
DNS ASK fo#####reflections.com
DNS ASK ge#####-surveying.com
DNS ASK ge####icaltools.com

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /Q /C %LOCALAPPDATA%\Temp/s.bat' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /Q /C %LOCALAPPDATA%\Temp/s.bat

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней