Trojan.DownLoader7.30608

Добавлен в вирусную базу Dr.Web: 2012-11-25

Описание добавлено: 2012-11-25

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2460' = '<Полный путь к вирусу>'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Сетевая активность:

Подключается к:

'78.##.64.134':3128
'59.##.178.145':3128
'22#.#25.210.185':3128
'18#.1.3.65':3128
'61.##.77.213':3128
'67.##4.228.190':3128
'12#.#50.0.61':3128
'76.##5.211.200':3128
'18#.#5.175.153':3128
'18#.#7.18.211':3128
'20#.#2.22.252':3128
'11#.19.2.69':3128
'17#.#0.133.101':3128
'12#.#3.163.104':3128
'15#.#4.19.250':3128
'89.##3.142.181':3128
'77.#9.88.2':3128
'99.##3.178.26':3128
'18#.#0.215.243':3128
'76.##2.13.246':3128
'24.#8.6.87':3128
'22#.#39.163.216':3128
'20#.#61.186.173':3128
'21#.#8.69.77':3128
'22#.#5.139.113':3128
'20#.#61.120.219':3128
'18#.#.196.146':3128
'99.##0.50.214':3128
'72.##6.65.161':3128
'77.#7.1.106':3128
'85.##.197.77':3128
'97.##.185.236':3128
'68.##6.88.185':3128
'99.##3.176.153':3128
'20#.#0.93.126':3128
'12#.#9.152.99':3128
'12#.#03.35.253':3128
'19#.#42.238.145':3128
'18#.#23.167.155':3128
'20#.37.87.1':3128
'20#.#9.201.32':3128
'84.#6.37.78':3128
'89.##9.140.15':3128
'85.##9.253.227':3128
'59.#.54.231':3128
'72.##4.6.237':3128
'20#.#4.232.243':3128
'19#.#9.69.253':3128
'70.##6.124.152':3128
'19#.#8.9.163':3128
'19#.#4.203.174':3128
'20#.#3.172.38':3128
'67.#2.3.13':3128
'68.#3.17.42':3128
'81.##.120.194':3128
'19#.#0.147.75':3128
'18#.#5.13.92':3128
'70.##.98.208':3128
'18#.#01.238.154':3128
'88.##3.45.56':3128
'69.##3.126.92':3128
'81.##5.234.251':3128
'88.##2.152.120':3128
'20#.#.177.223':3128
'78.##.64.178':3128
'18#.#4.20.235':3128
'80.##.213.30':3128
'89.##.10.177':3128
'12#.#1.233.2':3128
'88.##3.175.222':3128
'18#.#7.174.34':3128
'18#.#23.181.178':3128
'12#.#43.254.142':3128
'89.##.38.155':3128
'11#.#2.138.168':3128
'18#.7.11.54':3128
'85.##4.190.183':3128
'20#.#46.230.2':3128
'19#.#05.99.197':3128
'60.#4.9.156':3128
'89.##3.225.111':3128
'62.#4.59.23':3128
'20#.#71.167.35':3128
'20#.#07.64.164':3128
'18#.#5.84.74':3128
'18#.#.231.198':3128
'69.##6.213.245':3128
'89.##5.187.36':3128
'89.##.139.112':3128
'11#.#97.2.66':3128
'89.#4.88.79':3128
'20#.#5.244.20':3128
'89.#6.211.4':3128
'71.##8.96.240':3128
'98.##8.146.0':3128
'19#.#5.247.19':3128
'12#.#62.233.186':3128
'64.##8.192.77':3128
'19#.#04.151.197':3128
'86.##6.14.42':3128
'89.#0.4.251':3128
'75.##0.202.167':3128
'91.##5.132.118':3128
'77.##.176.167':3128
'19#.#3.96.108':3128
'18#.24.8.57':3128
'20#.#50.203.252':3128
'17#.#06.11.235':3128
'41.##1.122.28':3128
'62.##2.144.192':3128
'89.#1.224.4':3128
'18#.#23.176.4':3128
'21#.#32.22.156':3128
'20#.#.116.238':3128
'99.##7.130.17':3128
'72.##7.249.2':3128
'19#.#1.205.76':3128
'11#.#99.122.169':3128
'19#.#07.206.164':3128
'12#.#38.66.44':3128
'11#.#66.132.81':3128
'68.##.236.173':3128
'18#.#8.111.155':3128
'19#.#05.43.96':3128
'67.##1.137.134':3128
'19#.#8.194.45':3128
'12#.#36.250.118':3128
'21#.#20.2.13':3128
'22#.#46.195.26':3128
'99.##4.28.77':3128
'20#.#0.77.236':3128
'19#.#01.165.72':3128
'89.##8.255.102':3128
'19#.#20.124.26':3128
'20#.#07.180.72':3128
'84.##9.37.20':3128
'18#.#8.179.75':3128
'99.##3.90.67':3128
'85.##5.181.33':3128
'21#.#7.128.4':3128
'19#.#98.158.253':3128
'88.##8.33.218':3128
'20#.#.210.202':3128
'19#.#01.4.185':3128
'59.##.251.53':3128
'20#.#06.201.92':3128
'19#.#0.32.133':3128
'19#.#05.22.85':3128
'89.#6.10.82':3128
'77.##7.233.124':3128
'20#.#50.52.196':3128
'60.#2.20.24':3128
'77.##.14.144':3128
'81.##8.127.42':3128
'18#.#3.100.238':3128
'19#.#6.230.207':3128
'68.##.198.131':3128
'85.##.241.140':3128
'20#.#5.222.246':3128
'92.##0.118.228':3128
'24.#.12.235':3128
'18#.#9.78.238':3128
'78.##.178.109':3128
'19#.#7.202.106':3128
'18#.#1.168.74':3128
'59.#.212.38':3128
'81.##4.142.20':3128
'60.##.107.82':3128
'19#.#7.163.93':3128
'80.##3.159.169':3128
'75.##.146.10':3128
'19#.#64.85.74':3128
'17#.#06.124.64':3128
'62.##1.92.44':3128
'12#.#37.200.130':3128
'12#.#23.114.31':3128
'18#.#1.252.12':3128
'20#.#59.216.103':3128
'90.##1.58.61':3128
'11#.#4.134.175':3128
'20#.#18.199.93':3128
'20#.#12.100.168':3128
'18#.#8.26.250':3128
'68.##5.124.123':3128
'18#.#32.43.113':3128
'79.##4.27.60':3128
'95.##4.77.48':3128
'20#.#9.187.78':3128
'68.##.236.201':3128
'89.#5.40.17':3128
'80.##.124.135':3128
'22#.#12.187.144':3128
'71.##6.209.234':3128
'98.##0.218.227':3128
'19#.#09.102.106':3128
'88.##9.230.18':3128
'20#.#.139.228':3128
'24.##2.68.36':3128
'76.##9.59.198':3128
'22#.#21.137.112':3128
'12#.#36.234.111':3128
'12#.#38.42.53':3128
'89.##4.95.217':3128
'15#.#62.155.122':3128
'20#.#7.218.31':3128
'20#.#.136.206':3128
'19#.#3.100.171':3128
'19#.#64.87.136':3128
'72.##8.236.32':3128
'69.##1.89.102':3128
'18#.#11.120.51':3128
'12#.#25.249.105':3128
'18#.#8.190.15':3128
'75.##9.230.124':3128
'20#.#04.148.92':3128
'18#.#5.105.249':3128
'11#.#5.231.87':3128
'18#.#3.95.68':3128
'18#.#9.73.114':3128
'11#.#2.140.228':3128
'89.##.187.86':3128
'19#.#5.165.133':3128
'93.##7.173.138':3128
'18#.#3.205.122':3128
'12#.#64.236.190':3128
'22#.#5.139.158':3128
'18#.#1.95.116':3128
'12#.#4.43.235':3128
'11#.#3.184.175':3128
'58.##2.114.86':3128
'87.##9.87.37':3128
'93.##3.12.66':3128
'21#.#38.126.169':3128
'62.##.236.58':3128
'18#.#03.194.17':3128
'93.##2.151.244':3128
'60.##.188.190':3128
'69.##1.194.200':3128
'80.#8.18.95':3128
'20#.#3.251.151':3128
'12#.#3.47.240':3128
'69.##7.229.42':3128
'18#.#8.106.159':3128
'20#.#49.160.51':3128
'18#.#6.228.137':3128
'74.##5.21.43':3128
'70.##7.48.38':3128
'68.##.114.30':3128
'69.##3.237.95':3128
'12#.#46.82.52':3128
'22#.#46.251.32':3128
'87.##6.105.67':3128
'19#.#00.64.87':3128
'20#.#6.9.162':3128
'12#.#44.250.77':3128
'90.##1.52.170':3128
'18#.#.147.221':3128
'20#.#73.11.235':3128
'18#.#7.180.10':3128
'93.##6.100.39':3128
'19#.#39.181.173':3128
'86.##.71.105':3128
'74.##4.166.200':3128
'18#.#3.61.205':3128
'81.#4.28.13':3128
'<IP-адрес в локальной сети>':80
'78.##.210.31':3128
'20#.#03.129.104':3128
'77.##8.200.25':3128
'19#.#07.28.241':3128
'89.##.94.130':3128
'59.#2.1.208':3128
'19#.#4.167.175':3128
'12#.#38.135.216':3128
'98.##9.144.177':3128
'59.##.188.129':3128
'95.##0.23.170':3128
'99.##3.230.79':3128
'22#.#27.137.165':3128
'89.##6.120.47':3128
'12#.#21.34.184':3128
'82.##1.119.31':3128
'20#.#34.214.51':3128
'20#.#4.243.64':3128
'93.##3.11.83':3128
'20#.#72.110.233':3128
'20#.#0.90.48':3128
'19#.#98.159.68':3128
'83.#.54.190':3128
'82.##.113.145':3128
'20#.#0.221.80':3128
'69.##5.90.14':3128
'11#.#1.25.227':3128
'20#.#14.235.167':3128
'18#.#3.186.168':3128
'18#.#2.18.207':3128
'68.##.139.244':3128
'68.##.45.116':3128
'77.##0.209.142':3128
'20#.#36.37.98':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней