Trojan.DownLoader7.6770

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'11#.#9.17.181':3128
'95.#6.19.97':3128
'89.##8.179.164':3128
'19#.#05.214.27':3128
'11#.#9.58.28':3128
'37.#08.46.2':3128
'85.#.87.115':3128
'46.##5.13.153':3128
'31.##.94.144':3128
'67.##.151.156':3128
'11#.#9.17.54':3128
'18#.#36.166.213':3128
'19#.#14.243.236':3128
'41.##1.193.125':3128
'19#.#05.129.223':3128
'10#.#04.157.99':3128
'11#.#9.63.118':3128
'18#.#4.55.181':3128
'12#.#62.231.164':3128
'10#.#39.39.7':3128
'19#.#6.245.30':3128
'77.#45.6.90':3128
'5.##.18.94':3128
'83.##1.184.188':3128
'20#.#12.136.88':3128
'2.###.229.114':3128
'87.##1.19.76':3128
'11#.#9.57.31':3128
'17#.#0.88.55':3128
'72.#7.11.23':3128
'11#.#9.63.55':3128
'95.##2.109.119':3128
'20#.#65.89.75':3128
'89.##.91.239':3128
'85.##5.81.184':3128
'20#.#29.48.211':3128
'17#.#44.161.209':3128
'19#.#49.75.61':3128
'18#.#9.151.13':3128
'11#.#9.58.230':3128
'18#.#3.228.13':3128
'19#.#21.158.218':3128
'19#.#7.175.63':3128
'21#.#19.183.140':3128
'85.##5.81.183':3128
'10#.#74.18.101':3128
'11#.#9.59.28':3128
'18#.#81.176.160':3128
'11#.#9.19.14':3128
'18#.#9.176.99':3128
'37.#9.69.98':3128
'95.##.110.46':3128
'74.##5.0.132':3128
'19#.#19.223.232':3128
'83.##1.187.52':3128
'2.###.248.96':3128
'19#.#6.11.92':3128
'12#.#20.115.174':3128
'11#.#9.57.55':3128
'82.##5.17.110':3128
'98.##8.81.40':3128
'11#.#9.18.252':3128
'11#.#52.191.187':3128
'19#.#1.111.59':3128
'19#.#4.192.174':3128
'19#.#54.208.114':3128
'19#.#03.136.244':3128
'11#.#9.56.237':3128
'11#.#9.63.137':3128
'78.##.190.194':3128
'15#.#81.164.234':3128
'18#.#0.175.91':3128
'20#.#10.23.58':3128
'19#.#3.74.143':3128
'17#.#0.255.8':3128
'82.##0.168.67':3128
'95.##.237.207':3128
'17#.#0.46.184':3128
'19#.#7.97.165':3128
'85.##5.219.122':3128
'11#.#9.63.243':3128
'19#.#06.196.62':3128
'41.##.165.44':3128
'21#.#19.183.39':3128
'41.##0.37.54':3128
'92.##.88.153':3128
'19#.#54.103.4':3128
'19#.#13.196.1':3128
'95.##.185.189':3128
'11#.#9.48.12':3128
'19#.#7.207.32':3128
'2.###.97.161':3128
'19#.#1.126.140':3128
'95.#8.77.40':3128
'46.##.235.191':3128
'18#.#16.160.2':3128
'11#.#9.19.202':3128
'90.##.127.17':3128
'2.##8.1.44':3128
'18#.#9.182.46':3128
'85.#.88.100':3128
'11#.#9.57.213':3128
'19#.#23.223.65':3128
'19#.#55.210.72':3128
'11#.#9.19.67':3128
'18#.#42.164.9':3128
'11#.#9.56.35':3128
'11#.#9.56.31':3128
'19#.#49.22.176':3128
'41.##.17.192':3128
'74.#15.1.97':3128
'20#.#32.20.9':3128
'2.###.252.199':3128
'41.##2.171.156':3128
'89.##.91.133':3128
'19#.#7.45.148':3128
'46.##0.243.190':3128
'19#.#3.141.58':3128
'19#.#00.76.47':3128
'11#.81.33.8':3128
'18#.#2.212.6':3128
'18#.#13.192.21':3128
'19#.#7.211.24':3128
'89.##6.95.89':3128
'11#.#9.17.194':3128
'91.##9.159.211':3128
'20#.#1.175.2':3128
'13#.#48.99.188':3128
'67.##0.44.52':3128
'19#.#05.26.10':3128
'19#.#0.198.163':3128
'95.##1.131.134':3128
'11#.#9.58.137':3128
'2.###.234.155':3128
'85.##3.247.178':3128
'19#.#07.2.213':3128
'19#.#3.236.100':3128
'37.##.36.171':3128
'20#.#11.26.250':3128
'19#.#7.39.161':3128
'85.##0.81.228':3128
'19#.#3.138.35':3128
'2.###.245.44':3128
'18#.#18.7.207':3128
'10#.#00.27.213':3128
'19#.#00.23.29':3128
'19#.#55.210.85':3128
'20#.#73.146.224':3128
'2.###.154.192':3128
'11#.#9.58.170':3128
'19#.#18.156.217':3128
'41.##3.57.76':3128
'37.#9.73.11':3128
'18#.#9.230.213':3128
'localhost':21
'localhost':2
'20#.#22.53.220':3128
'19#.#20.68.82':3128
'18#.#59.131.173':3128
'11#.#9.60.35':3128
'92.##.222.46':3128
'19#.#50.162.64':3128
'19#.#20.64.3':3128
'20#.#4.232.176':3128
'41.##1.118.13':3128
'19#.#03.85.159':3128
'89.##.50.182':3128
'20#.#2.242.127':3128
'11#.#9.56.230':3128
'18#.#38.151.77':3128
'19#.#98.7.125':3128
'46.##.146.135':3128
'72.##.161.14':3128
'95.##.110.60':3128
'20#.#6.220.208':3128
'82.##5.17.71':3128
'11#.#9.19.117':3128
'92.##.137.183':3128
'11#.#9.57.230':3128
'19#.#4.210.178':3128
'18#.#.201.56':3128
'19#.#7.248.114':3128
'20#.#65.238.43':3128
'74.#15.0.21':3128
'92.##.139.227':3128
'18#.#59.133.118':3128
'95.#9.65.89':3128
'11#.#4.132.113':3128
'89.##6.247.173':3128
'20#.#0.216.58':3128
'18#.#81.32.226':3128
'76.##.176.134':3128
'15#.#55.32.160':3128
'18#.#5.64.17':3128
'20#.#.92.211':3128
'41.##.175.39':3128
'92.#6.42.34':3128
'11#.#9.61.41':3128
'95.##5.72.177':3128
'19#.#99.42.124':3128
'78.##.237.66':3128
'2.###.38.247':3128
'16#.#67.84.222':3128
'20#.#32.195.169':3128
'11#.#9.63.79':3128
'18#.#8.211.67':3128
'20#.#4.242.58':3128
'20#.#4.67.53':3128
'19#.#03.141.16':3128
'2.###.224.158':3128
'21#.#57.180.200':3128
'20#.#22.80.192':3128
'17#.#22.149.29':3128
'19#.#2.222.94':3128
'85.##3.247.22':3128
'11#.#9.18.194':3128
'78.##.129.176':3128
'20#.#2.236.226':3128
'11#.#9.60.137':3128
'24.##9.245.137':3128
'21#.#81.163.214':3128
'11#.#9.58.41':3128
'17#.#1.113.240':3128
'20#.#3.92.139':3128
'80.##.168.131':3128
'95.#9.77.33':3128
'31.#.180.198':3128
'19#.#52.0.31':3128
'11#.#9.63.175':3128
'95.##.44.139':3128
'5.###.235.166':3128
'19#.#05.74.147':3128
'17#.#8.170.254':3128
'18#.#2.130.246':3128
'18#.#3.234.46':3128
'19#.#7.37.84':3128
'11#.#9.62.230':3128
'12#.#7.227.77':3128
'41.##5.16.223':3128
'18#.#7.150.135':3128
'17#.#.170.174':3128
'2.###.130.221':3128
'20#.#27.72.131':3128
'74.#15.1.41':3128
'20#.#6.162.56':3128
'20#.#48.209.90':3128
'81.#0.0.17':3128
'41.##.47.178':3128
'19#.#13.91.163':3128
'18#.#9.190.223':3128
'11#.#9.62.137':3128
'41.##7.58.92':3128
'19#.#00.129.242':3128
'95.##1.151.172':3128
'87.##6.209.173':3128
'11#.#9.59.243':3128
'91.##1.49.26':3128
'11#.#9.63.140':3128
'17#.#36.38.96':3128
'95.##.225.135':3128
'10#.#1.83.192':3128
'11#.#9.17.140':3128
'11#.#9.61.175':3128
'19#.#19.213.37':3128
'18#.#0.9.182':3128
'17#.#4.117.83':3128
'19#.#00.22.2':3128
'20#.#4.67.101':3128
'19#.#37.163.69':3128
'19#.#55.210.74':3128
'19#.#13.196.3':3128
'17#.#66.128.213':3128
'95.#9.41.83':3128
'95.#9.76.12':3128
'11#.#1.60.252':3128
'20#.#42.63.54':3128
'11#.#9.56.213':3128
'87.##7.33.136':3128
'2.###.218.65':3128
'17#.#.204.82':3128
'20#.#73.146.161':3128
'41.##2.29.105':3128
'74.#15.3.63':3128
'19#.#02.231.101':3128
'95.#8.231.7':3128
'95.##.225.149':3128
'78.##.222.20':3128
'19#.#01.249.184':3128
'72.##1.193.202':3128
'11#.#9.58.31':3128
'19#.#00.129.83':3128
'41.##.17.190':3128
'92.#7.96.97':3128
'18#.#93.96.43':3128
'11#.#9.60.31':3128
'2.###.86.170':3128
'91.##1.159.1':3128
'46.#8.132.8':3128
'11#.#9.60.213':3128
'11#.#9.63.31':3128
'20#.#0.92.77':3128
'37.##5.31.32':3128
'20#.#65.203.118':3128
'11#.#9.63.28':3128
'87.##7.33.228':3128
'11#.#32.156.46':3128
'41.#3.1.2':3128
'18#.3.6.48':3128
'19#.#4.240.214':3128
'19#.#05.133.146':3128
'87.##7.39.10':3128
'20#.#29.218.204':3128
'84.##.253.60':3128
'19#.#55.210.80':3128
'21#.#19.217.140':3128
'19#.#55.210.89':3128
'20#.#73.146.186':3128
'11#.#9.59.230':3128
'59.##3.24.183':3128
'18#.#15.141.79':3128
'19#.#4.151.251':3128
'20#.#.122.52':3128
'93.##5.71.146':3128
'98.##4.87.137':3128
'76.##.88.236':3128
'84.#4.75.73':3128
'11#.#9.61.174':3128
'20#.#1.216.225':3128
'19#.#52.0.33':3128
'17#.#7.68.179':3128
'11#.#9.63.35':3128
'82.##5.17.84':3128
'77.##.129.75':3128
'95.##.75.134':3128
'19#.#8.185.58':3128
'19#.#04.160.125':3128
'17#.#2.74.33':3128
'21#.#36.101.35':3128
'2.###.199.146':3128
'21#.#30.78.45':3128
'19#.#7.239.45':3128
'82.##5.19.231':3128
'19#.#3.162.132':3128
'19#.#13.196.7':3128
'17#.#8.214.72':3128
'18#.#2.14.153':3128
'19#.#06.243.30':3128
'11#.#9.63.225':3128
'19#.#42.208.114':3128
'18#.#.107.240':3128
'87.##0.166.58':3128
'11#.#9.16.181':3128
'18#.#4.76.121':3128
'95.##.192.126':3128
'19#.#4.30.250':3128
'2.###.211.133':3128
'11#.#9.18.202':3128
'19#.#3.140.242':3128
'77.##8.193.49':3128
'2.###.39.166':3128
'19#.#06.252.199':3128
'18#.#27.189.86':3128
'64.##.73.202':3128
'19#.#4.167.72':3128
'19#.#4.235.185':3128
'19#.#83.69.186':3128
'74.#15.1.93':3128
'41.##3.57.78':3128
'17#.#22.152.241':3128
'18#.#9.251.98':3128
'78.#3.47.42':3128
'31.#9.13.42':3128
'11#.#9.19.244':3128
'41.##5.21.149':3128
'85.##4.253.12':3128
'19#.#04.138.234':3128
'11#.#9.62.188':3128
'11#.#9.60.55':3128
'20#.#19.4.10':3128
'85.#7.29.96':3128
'41.##5.21.27':3128
'2.###.144.56':3128
'20#.#.141.172':3128
'2.###.240.86':3128
'21#.#41.20.254':3128
'41.##.125.138':3128
'11#.#9.19.181':3128
'74.#15.3.67':3128
'2.##4.0.216':3128
'11#.#9.58.35':3128
'85.##3.247.145':3128
'19#.#99.64.53':3128
'21#.#30.101.128':3128
'95.##.168.75':3128
'72.##2.176.94':3128
'20#.#4.232.160':3128
'19#.#13.196.6':3128
'17#.#.186.30':3128
'21#.#12.106.132':3128
'19#.#03.240.146':3128
'18#.#95.153.140':3128
'11#.#9.18.117':3128
'17#.#1.62.25':3128
'95.##.70.227':3128
'19#.#4.193.233':3128
'88.##.167.215':3128
'2.##6.7.201':3128
'19#.#13.90.146':3128
'22#.#4.202.23':3128
'17#.88.55.3':3128
'21#.#19.183.50':3128
'18#.#2.45.188':3128
'41.#9.7.53':3128
'17#.#8.227.246':3128
'15#.#00.37.45':3128
'18#.#45.10.134':3128
'41.##1.32.222':3128
'95.##.231.142':3128
'41.##2.53.34':3128
'18#.#3.140.237':3128
'17#.#0.74.150':3128
'2.###.94.160':3128
'11#.#9.59.213':3128
'17#.#25.99.108':3128
'11#.#9.16.54':3128
'18#.#60.178.143':3128
'19#.#3.140.219':3128
'31.##9.4.231':3128
'18#.#.118.163':3128
'89.##3.238.169':3128
'17#.90.3.80':3128
'19#.#19.223.57':3128
'75.##2.8.109':3128
'5.###.232.19':3128
'11#.#9.58.243':3128
'19#.#00.145.108':3128
'87.##5.65.39':3128
'11#.#9.56.137':3128
'19#.#13.196.4':3128
'2.###.249.180':3128
'19#.#8.162.102':3128
'22#.#55.224.27':3128
'19#.#45.114.4':3128
'17#.#.224.133':3128
'22#.#20.237.99':3128
'18#.#12.149.101':3128
'95.##.35.184':3128
'19#.#13.160.5':3128
'18#.#54.58.245':3128
'11#.#9.18.244':3128
'37.##.152.218':3128
'95.##.41.168':3128
'11#.#9.17.14':3128
'21#.96.2.58':3128
'18#.#2.11.23':3128
'19#.#5.169.115':3128
'91.##6.94.94':3128
'18#.#84.225.128':3128
'11#.#9.57.41':3128
'19#.#3.249.45':3128
'21#.#54.248.142':3128
'18#.#2.223.67':3128
'19#.#06.199.89':3128
'92.##.33.234':3128
'18#.#59.128.200':3128
'20#.#1.177.18':3128
'14.##.207.49':3128
'11#.#9.59.35':3128
'2.##2.9.134':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней