Trojan.DownLoader1.42884

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'20#.#38.207.169':3128
'78.##5.25.139':3128
'10#.#85.117.168':3128
'12#.#68.161.15':3128
'11#.#18.139.94':3128
'19#.#1.143.12':3128
'19#.#6.44.36':3128
'10#.#98.121.146':3128
'41.##1.17.216':3128
'11#.#97.101.16':3128
'62.##0.64.116':3128
'85.##8.160.68':3128
'62.##.104.121':3128
'24.##7.157.146':3128
'12#.#20.97.128':3128
'58.##.189.69':3128
'19#.#51.53.33':3128
'12#.#08.66.123':3128
'46.##.132.253':3128
'19#.#1.168.166':3128
'11#.#6.132.226':3128
'11#.#7.48.40':3128
'77.##6.49.132':3128
'11#.#7.115.118':3128
'59.##.188.170':3128
'10#.#7.83.168':3128
'78.##2.60.27':3128
'96.##.244.101':3128
'85.##.230.135':3128
'99.##4.213.62':3128
'59.##4.113.155':3128
'89.##7.75.85':3128
'11#.#40.81.187':3128
'99.##7.197.172':3128
'85.##7.247.18':3128
'18#.#01.31.127':3128
'18#.#9.152.87':3128
'83.##.91.175':3128
'19#.#06.151.246':3128
'77.##9.10.86':3128
'21#.#32.113.118':3128
'14#.#13.244.44':3128
'18#.#5.169.8':3128
'22#.#43.61.253':3128
'15#.#2.169.89':3128
'92.##.133.91':3128
'87.##5.198.218':3128
'58.##.138.136':3128
'11#.#1.191.227':3128
'12#.#21.71.228':3128
'11#.#42.103.165':3128
'11#.#97.218.182':3128
'19#.#13.166.205':3128
'12#.#70.29.233':3128
'12#.#20.8.157':3128
'18#.#21.226.35':3128
'20#.#1.160.62':3128
'12#.#58.94.2':3128
'19#.#17.50.8':3128
'59.##.168.185':3128
'19#.#6.44.75':3128
'46.##7.105.244':3128
'79.##0.238.183':3128
'20#.#2.92.109':3128
'19#.#01.129.159':3128
'20#.#6.142.147':3128
'12#.#66.238.78':3128
'24.#.229.177':3128
'11#.#3.120.158':3128
'81.##.171.13':3128
'85.##8.15.233':3128
'11#.#42.31.216':3128
'18#.#6.154.40':3128
'20#.8.29.35':3128
'95.##.153.127':3128
'59.##3.49.115':3128
'59.#13.55.4':3128
'59.##.186.51':3128
'11#.#99.118.66':3128
'11#.#7.80.58':3128
'88.##1.207.2':3128
'21#.#32.145.194':3128
'79.##5.202.24':3128
'85.##6.250.116':3128
'21#.#0.253.187':3128
'75.##3.44.131':3128
'11#.#40.3.171':3128
'59.##.181.39':3128
'21#.#86.183.4':3128
'19#.#16.29.54':3128
'11#.#04.72.214':3128
'22#.#31.127.13':3128
'17#.#5.130.127':3128
'21#.#1.189.136':3128
'95.##5.181.217':3128
'11#.#4.105.229':3128
'87.##0.212.102':3128
'89.##1.183.110':3128
'41.##1.34.160':3128
'81.##.240.197':3128
'89.##1.182.198':3128
'19#.#1.83.40':3128
'91.##6.191.99':3128
'87.##5.201.226':3128
'12#.#40.218.131':3128
'83.##.153.57':3128
'59.##.170.183':3128
'11#.#40.43.241':3128
'11#.#06.112.190':3128
'11#.#35.82.18':3128
'89.##1.182.34':3128
'18#.#2.145.89':3128
'79.##0.239.131':3128
'11#.#7.108.87':3128
'19#.#20.60.143':3128
'87.##5.86.122':3128
'21#.#08.216.5':3128
'12#.#68.4.96':3128
'11#.#40.8.145':3128
'11#.#4.56.143':3128
'59.##3.52.16':3128
'59.##.181.133':3128
'41.##3.57.72':3128
'19#.#1.190.12':3128
'80.##.231.40':3128
'21#.#01.133.103':3128
'61.##1.82.99':3128
'84.##8.28.40':3128
'89.#5.5.227':3128
'83.##8.139.248':3128
'22#.#20.38.68':3128
'85.##7.165.12':3128
'20#.#48.139.97':3128
'67.##.137.125':3128
'90.##0.157.63':3128
'19#.#6.39.193':3128
'77.##5.240.251':3128
'84.##.150.52':3128
'19#.#1.171.229':3128
'11#.#7.54.76':3128
'21#.#19.108.210':3128
'89.##1.181.167':3128
'95.##.215.253':3128
'79.##0.237.70':3128
'58.#.75.96':3128
'77.#31.34.6':3128
'19#.#1.171.67':3128
'11#.#02.79.61':3128
'85.##.114.130':3128
'11#.#42.20.173':3128
'11#.#42.5.40':3128
'10#.#82.92.91':3128
'19#.#10.234.58':3128
'89.##1.185.173':3128
'77.##.146.193':3128
'20#.#67.48.141':3128
'80.#20.10.2':3128
'21#.#38.78.146':3128
'19#.#9.109.128':3128
'18#.#20.227.88':3128
'88.##1.4.226':3128
'78.##.61.144':3128
'79.##4.192.229':3128
'66.##0.222.78':3128
'98.##.253.11':3128
'17#.#1.67.82':3128
'59.##3.52.197':3128
'58.##.87.120':3128
'20#.#34.68.250':3128
'11#.#33.202.202':3128
'19#.#13.136.69':3128
'59.##.161.93':3128
'95.##.62.191':3128
'17#.#8.244.216':3128
'12#.#30.4.183':3128
'18#.#01.28.166':3128
'20#.#10.30.35':3128
'58.##.88.134':3128
'96.##.174.191':3128
'77.##3.122.107':3128
'95.##4.108.194':3128
'21#.#07.211.28':3128
'77.#8.7.185':3128
'19#.#1.129.251':3128
'59.##3.53.158':3128
'19#.#1.167.132':3128
'82.##2.103.247':3128
'59.##8.36.157':3128
'94.##.150.54':3128
'19#.#9.98.70':3128
'21#.#4.81.66':3128
'82.##1.137.149':3128
'85.##8.131.153':3128
'19#.#01.135.118':3128
'88.##8.80.241':3128
'94.##5.115.68':3128
'11#.#33.76.148':3128
'11#.#7.54.58':3128
'18#.#8.63.12':3128
'11#.#40.82.164':3128
'20#.#44.143.172':3128
'19#.#16.232.31':3128
'95.##4.179.107':3128
'11#.#46.86.131':3128
'77.##7.90.141':3128
'11#.#35.79.82':3128
'19#.3.229.6':3128
'12#.#75.58.78':3128
'10#.#82.5.212':3128
'20#.#4.103.163':3128
'19#.#04.148.80':3128
'11#.#40.22.134':3128
'20#.#64.211.106':3128
'24.#4.6.90':3128
'91.##.125.35':3128
'85.##7.57.116':3128
'95.##8.182.158':3128
'89.##1.177.184':3128
'19#.#20.227.161':3128
'85.##6.196.130':3128
'17#.#23.177.173':3128
'84.#0.89.15':3128
'93.##3.135.32':3128
'19#.#1.189.199':3128
'89.##1.185.142':3128
'21#.#09.162.104':3128
'21#.#33.172.127':3128
'20#.#9.206.2':3128
'12#.#21.252.251':3128
'11#.#35.69.43':3128
'78.##.46.158':3128
'41.##3.57.76':3128
'21#.#2.72.73':3128
'11#.#41.40.117':3128
'83.##2.81.217':3128
'19#.#1.123.74':3128
'21#.#67.137.166':3128
'84.##.52.118':3128
'19#.#1.138.52':3128
'21#.#22.182.79':3128
'11#.#6.159.79':3128
'89.##1.177.175':3128
'19#.#6.38.227':3128
'77.##.79.191':3128
'11#.#40.75.183':3128
'18#.#27.42.6':3128
'59.##.162.206':3128
'20#.#59.217.142':3128
'20#.#2.243.1':3128
'22#.#42.6.110':3128
'19#.#6.37.249':3128
'72.##4.185.240':3128
'89.##1.177.42':3128
'59.##.188.201':3128
'21#.#2.242.130':3128
'88.##6.79.53':3128
'77.##3.126.146':3128
'10#.#0.143.16':3128
'15#.#3.131.184':3128
'12#.#22.170.2':3128
'19#.#.10.166':3128
'19#.#17.203.6':3128
'59.##8.36.78':3128
'11#.#24.231.22':3128
'41.##0.17.63':3128
'21#.#18.109.158':3128
'76.##9.47.171':3128
'93.##0.71.185':3128
'84.##0.94.194':3128
'12#.#26.26.19':3128
'79.#.74.206':3128
'74.##.209.166':3128
'20#.#8.248.135':3128
'21#.#8.204.190':3128
'10#.#82.106.134':3128
'41.##3.57.74':3128
'94.##1.23.71':3128
'79.##.176.231':3128
'85.#38.14.2':3128
'18#.#21.230.29':3128
'19#.#6.38.39':3128
'13#.#32.68.126':3128
'18#.#01.110.182':3128
'59.##3.52.107':3128
'10#.#82.80.194':3128
'11#.#52.104.173':3128
'19#.#1.184.104':3128
'19#.#1.185.26':3128
'11#.#6.156.182':3128
'11#.#33.78.8':3128
'21#.#98.142.157':3128
'19#.#1.169.44':3128
'19#.#49.50.68':3128
'19#.#2.203.114':3128
'10#.#22.73.66':3128
'88.##1.45.80':3128
'89.##2.83.131':3128
'12#.#21.44.181':3128
'79.##4.192.239':3128
'19#.#13.199.62':3128
'19#.#07.110.169':3128
'10#.#10.2.245':3128
'89.##3.253.161':3128
'46.##.200.147':3128
'87.##2.151.192':3128
'81.##0.205.158':3128
'79.##.177.209':3128
'11#.#64.132.173':3128
'20#.#7.122.251':3128
'59.##.167.130':3128
'19#.#00.146.247':3128
'19#.#1.188.101':3128
'11#.#84.198.108':3128
'74.#15.5.41':3128
'83.##3.182.140':3128
'89.##1.180.181':3128
'11#.#35.85.79':3128
'82.#5.76.46':3128
'89.##6.174.216':3128
'21#.#6.47.24':3128
'19#.#1.184.172':3128
'72.##8.40.67':3128
'61.##1.81.114':3128
'79.##.182.73':3128
'11#.#4.104.80':3128
'84.##4.251.251':3128
'18#.6.73.4':3128
'12#.#.41.218':3128
'89.##2.153.121':3128
'59.##.182.112':3128
'19#.#7.133.229':3128
'11#.#00.101.127':3128
'11#.#40.117.241':3128
'11#.#42.18.99':3128
'22#.#43.62.204':3128
'59.##.182.134':3128
'78.##8.25.72':3128
'22#.#43.176.42':3128
'11#.#52.8.250':3128
'12#.#6.129.71':3128
'12#.#75.56.143':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней