Trojan.Packed.23932

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'60.#1.38.92':3128
'17#.#8.145.104':3128
'91.##0.227.71':3128
'60.##8.17.165':3128
'11#.#11.210.61':3128
'19#.#52.0.33':3128
'60.##8.14.123':3128
'11#.#98.64.25':3128
'22#.#75.225.148':3128
'46.##8.183.88':3128
'11#.#11.210.239':3128
'18#.#29.199.210':3128
'60.##8.17.248':3128
'61.##7.7.170':3128
'61.##2.38.178':3128
'94.##9.60.116':3128
'19#.#5.194.235':3128
'12#.#30.230.164':3128
'11#.#11.213.77':3128
'61.##2.39.249':3128
'21#.#25.235.150':3128
'21#.#8.157.122':3128
'60.#1.39.17':3128
'12#.#30.230.43':3128
'60.##8.17.92':3128
'19#.#55.213.187':3128
'11#.#4.56.223':3128
'12#.#.19.103':3128
'11#.#39.101.247':3128
'11#.#0.215.200':3128
'11#.#39.98.177':3128
'88.##4.177.20':3128
'19#.#7.153.121':3128
'11#.#11.208.130':3128
'61.#17.7.91':3128
'12#.#15.180.46':3128
'80.##1.175.117':3128
'19#.#55.210.70':3128
'60.##8.13.245':3128
'18#.#8.18.199':3128
'91.#35.36.8':3128
'12#.#9.96.64':3128
'60.##8.15.68':3128
'12#.#07.191.115':3128
'12#.#5.200.215':3128
'12#.#99.60.64':3128
'11#.#39.98.81':3128
'12#.#96.21.216':3128
'11#.#42.35.25':3128
'11#.#09.95.133':3128
'12#.#30.231.42':3128
'12#.#7.195.90':3128
'12#.#92.107.29':3128
'12#.#93.35.237':3128
'41.##3.142.96':3128
'12#.#02.108.29':3128
'11#.#69.50.119':3128
'22#.#75.226.4':3128
'85.##.170.84':3128
'61.##8.215.228':3128
'12#.#33.80.78':3128
'71.##.109.26':3128
'49.##6.35.154':3128
'19#.#13.196.6':3128
'61.##2.14.192':3128
'19#.#50.172.187':3128
'11#.#56.76.191':3128
'12#.#96.20.47':3128
'60.#7.53.80':3128
'11#.#39.103.217':3128
'12#.#33.101.179':3128
'60.##8.15.186':3128
'46.##.153.111':3128
'61.##2.36.214':3128
'77.##4.136.79':3128
'89.##.50.182':3128
'5.#.230.89':3128
'21#.#44.88.254':3128
'12#.#96.22.32':3128
'12#.#07.170.211':3128
'19#.#86.89.198':3128
'18#.3.54.19':3128
'11#.#39.101.192':3128
'21#.#8.157.21':3128
'11#.#9.53.12':3128
'18#.#2.139.218':3128
'11#.#11.168.112':3128
'11#.#39.98.178':3128
'60.##8.17.187':3128
'60.##8.17.184':3128
'20#.#73.146.186':3128
'60.##8.11.20':3128
'92.##.33.234':3128
'59.##6.143.229':3128
'12#.#33.111.100':3128
'21#.#67.13.6':3128
'61.##2.38.195':3128
'78.##1.180.193':3128
'11#.#39.99.131':3128
'60.##8.11.221':3128
'22#.#02.210.162':3128
'61.##7.7.121':3128
'12#.#96.20.55':3128
'61.##2.38.252':3128
'11#.#9.19.14':3128
'22#.#75.225.125':3128
'61.##8.219.116':3128
'91.##5.29.82':3128
'11#.#42.15.81':3128
'21#.#30.151.169':3128
'59.##7.79.14':3128
'41.##0.141.185':3128
'20#.#2.151.141':3128
'16#.#67.58.98':3128
'22#.#75.232.20':3128
'61.##2.14.189':3128
'93.##.11.109':3128
'12#.#35.159.49':3128
'60.##8.12.169':3128
'22#.#75.226.127':3128
'11#.#39.99.10':3128
'60.##8.16.158':3128
'11#.#39.98.97':3128
'60.##8.17.113':3128
'12#.#99.61.40':3128
'11#.#56.57.156':3128
'12#.#35.153.102':3128
'12#.#30.169.203':3128
'21#.#1.66.228':3128
'11#.#4.72.45':3128
'22#.#.76.162':3128
'61.#17.7.81':3128
'11#.#11.213.166':3128
'12#.#99.63.236':3128
'12#.#35.90.137':3128
'22#.#75.225.13':3128
'61.##2.36.226':3128
'12#.#30.231.39':3128
'17#.#22.178.177':3128
'17#.#26.182.207':3128
'12#.#5.200.7':3128
'17#.#26.148.115':3128
'11#.#11.213.66':3128
'12#.#30.231.79':3128
'11#.#11.211.12':3128
'41.##0.192.61':3128
'12#.#97.253.97':3128
'19#.#02.56.50':3128
'12#.#99.60.20':3128
'16#.#94.154.112':3128
'12#.#6.116.29':3128
'19#.#8.162.213':3128
'11#.#45.181.33':3128
'21#.#22.11.223':3128
'86.##5.64.161':3128
'12#.#5.216.185':3128
'11#.#03.159.18':3128
'11#.#42.16.30':3128
'89.#9.18.1':3128
'12#.#96.23.175':3128
'11#.#39.103.171':3128
'12#.#92.107.175':3128
'22#.#.45.155':3128
'84.##8.83.67':3128
'11#.#39.102.110':3128
'12#.#5.14.166':3128
'11#.#42.14.30':3128
'60.##8.17.236':3128
'12#.#35.168.160':3128
'14#.#15.12.20':3128
'12#.#35.122.112':3128
'20#.#25.234.85':3128
'11#.#11.209.232':3128
'46.##.246.96':3128
'10#.#29.174.73':3128
'12#.#92.108.241':3128
'12#.#96.20.170':3128
'22#.#75.231.120':3128
'22#.#75.225.103':3128
'60.##8.16.40':3128
'12#.#35.154.140':3128
'61.##2.14.150':3128
'12#.#35.143.135':3128
'22#.#75.226.177':3128
'21#.#1.66.83':3128
'12#.#98.10.118':3128
'12#.#97.202.188':3128
'88.##4.155.118':3128
'12#.#92.108.246':3128
'60.##8.15.140':3128
'11#.#11.210.69':3128
'18#.#0.72.235':3128
'19#.#99.195.75':3128
'60.##8.16.186':3128
'46.##.235.34':3128
'61.##8.208.21':3128
'12#.#8.167.119':3128
'12#.#2.134.228':3128
'12#.#30.231.183':3128
'19#.#3.227.3':3128
'60.##8.17.12':3128
'88.##4.155.126':3128
'18#.#18.114.41':3128
'84.##0.252.136':3128
'98.##3.105.121':3128
'12#.#95.88.153':3128
'60.##8.17.109':3128
'11#.#39.101.114':3128
'60.##8.11.150':3128
'18#.#05.191.166':3128
'36.#.218.167':3128
'19#.#13.92.30':3128
'61.##8.211.170':3128
'12#.#97.202.216':3128
'21#.#99.109.248':3128
'12#.#24.244.45':3128
'11#.#11.210.85':3128
'18#.#8.160.98':3128
'11#.#69.67.120':3128
'58.##.238.170':3128
'12#.#96.23.152':3128
'11#.#39.98.200':3128
'22#.#75.225.111':3128
'93.##6.17.94':3128
'21#.#30.151.134':3128
'12#.#99.61.14':3128
'60.##8.15.131':3128
'11#.#87.25.112':3128
'12#.#6.147.103':3128
'22#.#75.250.227':3128
'22#.#75.226.33':3128
'41.##.201.146':3128
'19#.#4.167.76':3128
'61.##8.214.85':3128
'11#.#45.29.3':3128
'60.##8.15.246':3128
'60.#38.11.9':3128
'18#.#36.135.215':3128
'12#.#99.62.174':3128
'21#.#1.66.107':3128
'41.##7.149.129':3128
'12#.#35.167.250':3128
'19#.#0.172.142':3128
'12#.#9.196.220':3128
'11#.#4.76.69':3128
'60.##8.17.53':3128
'20#.#64.90.246':3128
'61.##2.39.164':3128
'60.##8.17.160':3128
'60.##8.10.198':3128
'18#.#12.149.101':3128
'12#.#35.120.252':3128
'12#.#35.85.101':3128
'22#.#75.226.179':3128
'11#.#39.101.132':3128
'78.##.81.163':3128
'17#.#06.61.146':3128
'77.##.129.75':3128
'12#.#92.108.132':3128
'12#.#98.25.223':3128
'60.##8.12.112':3128
'2.###.106.172':3128
'60.##9.251.132':3128
'21#.#1.66.87':3128
'92.#3.25.47':3128
'21#.#.15.152':3128
'18#.#70.190.194':3128
'14#.#27.181.250':3128
'11#.#9.19.244':3128
'20#.#4.115.121':3128
'12#.#24.237.250':3128
'41.##8.205.197':3128
'11#.#11.208.237':3128
'12#.#97.226.1':3128
'88.##.249.74':3128
'11#.#9.13.73':3128
'60.##8.17.240':3128
'49.##8.1.203':3128
'19#.#55.213.191':3128
'12#.#30.230.146':3128
'61.##2.14.183':3128
'21#.#30.100.12':3128
'12#.#35.174.6':3128
'21#.#8.157.65':3128
'94.##5.189.131':3128
'61.##8.218.162':3128
'11#.#0.215.44':3128
'12#.#96.23.142':3128
'22#.#02.205.4':3128
'19#.#5.229.50':3128
'21#.#8.157.119':3128
'60.##8.17.43':3128
'12#.#92.106.205':3128
'18#.#37.10.221':3128
'11#.#39.99.36':3128
'59.##7.134.155':3128
'11#.#39.98.77':3128
'42.##9.164.102':3128
'86.##1.11.91':3128
'12#.#30.230.60':3128
'93.##8.214.146':3128
'41.#3.1.2':3128
'31.#5.95.87':3128
'11#.#4.69.155':3128
'60.##8.17.209':3128
'19#.#7.239.45':3128
'12#.#99.62.76':3128
'12#.#96.22.208':3128
'60.##8.17.107':3128
'18#.#68.39.106':3128
'11#.#39.102.135':3128
'60.##.211.81':3128
'60.#38.15.7':3128
'17#.#8.194.83':3128
'18#.#8.164.171':3128
'22#.#75.2.200':3128
'19#.#55.210.74':3128
'11#.#50.50.5':3128
'11#.#11.208.127':3128
'12#.#35.159.75':3128
'12#.#96.22.49':3128
'11#.#56.74.103':3128
'11#.#42.25.46':3128
'11#.#9.18.126':3128
'11#.#11.32.244':3128
'85.##.164.245':3128
'21#.96.2.58':3128
'12#.#35.164.215':3128
'12#.#24.243.123':3128
'17#.#26.63.162':3128
'21#.#8.157.20':3128
'21#.#25.235.170':3128
'60.##6.93.152':3128
'19#.#55.210.89':3128
'71.##9.212.195':3128
'12#.#25.65.209':3128
'11#.#9.60.35':3128
'61.##8.220.116':3128
'11#.#39.103.130':3128
'22#.#75.226.209':3128
'21#.#20.216.45':3128
'11#.#09.76.12':3128
'11#.#11.210.63':3128
'12#.#96.23.154':3128
'31.##.35.207':3128
'11#.#11.210.35':3128
'11#.#9.58.243':3128
'61.##8.211.105':3128
'11#.#39.99.197':3128
'11#.#9.62.35':3128
'11#.#39.100.122':3128
'11#.#4.53.251':3128
'22#.#.40.220':3128
'11#.#39.101.144':3128
'12#.#4.58.149':3128
'22#.#75.225.207':3128
'84.##.230.244':3128
'12#.#98.11.47':3128
'11#.#39.98.171':3128
'22#.#75.226.65':3128
'11#.#11.213.49':3128
'11#.#11.210.139':3128
'12#.#98.15.5':3128
'61.##2.14.253':3128
'20#.#19.216.201':3128
'60.##8.15.123':3128
'12#.#92.107.55':3128
'60.##8.17.18':3128
'19#.#6.175.117':3128
'11#.#39.102.191':3128
'93.##6.43.30':3128
'82.##.182.121':3128
'11#.#49.157.50':3128
'21#.#1.94.131':3128
'60.##8.16.249':3128
'61.##2.14.203':3128
'74.#15.3.63':3128
'12#.#1.208.60':3128
'19#.#11.62.125':3128
'22#.#55.225.75':3128
'21#.#1.66.91':3128
'2.###.144.52':3128
'11#.#.201.48':3128
'60.##8.17.55':3128
'11#.#11.212.48':3128
'61.#02.39.8':3128
'19#.#49.16.182':3128
'19#.#.76.156':3128
'11#.#9.18.194':3128
'18#.#18.158.149':3128
'78.#3.47.42':3128
'19#.#55.210.72':3128
'12#.#35.166.164':3128
'22#.#75.2.157':3128
'11#.#69.66.189':3128
'61.##8.223.133':3128
'12#.#35.171.61':3128
'11#.#39.98.15':3128
'22#.#75.226.232':3128
'11#.#9.59.35':3128
'60.##8.17.194':3128
'11#.#11.213.168':3128
'21#.#3.68.126':3128
'12#.#98.28.151':3128
'11#.#.197.220':3128
'85.##5.72.178':3128
'21#.#25.235.179':3128
'12#.#99.60.31':3128
'20#.#1.175.2':3128
'61.##2.36.242':3128
'11#.#64.42.59':3128
'59.##6.143.196':3128
'12#.#30.230.112':3128
'60.##8.15.202':3128
'60.##8.85.43':3128
'18#.#70.190.39':3128
'19#.#55.210.80':3128
'12#.#99.61.113':3128
'89.##6.107.23':3128
'19#.#8.195.252':3128
'12#.#93.34.50':3128
'12#.#98.13.145':3128
'12#.#07.206.86':3128
'60.##8.12.79':3128
'18#.#47.166.12':3128
'11#.#39.103.232':3128
'12#.#30.156.106':3128
'12#.#33.108.6':3128
'10#.#29.170.139':3128
'20#.#25.40.143':3128
'89.#7.60.25':3128
'11#.#39.100.15':3128
'64.##0.44.19':3128
'94.##5.138.178':3128
'11#.#.156.30':3128
'60.##8.15.22':3128
'11#.#69.42.74':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней