Trojan.DownLoader8.20667

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'11#.#02.8.117':3128
'12#.#84.148.116':3128
'87.##1.19.76':3128
'11#.#9.17.54':3128
'15#.#81.169.134':3128
'19#.#9.50.25':3128
'19#.#9.10.131':3128
'14#.#27.181.250':3128
'19#.#04.211.195':3128
'18#.#2.158.175':3128
'11#.#00.165.193':3128
'20#.#09.193.1':3128
'41.##.177.28':3128
'87.##0.166.58':3128
'19#.#05.4.111':3128
'18#.#8.139.179':3128
'41.#2.4.199':3128
'95.##.99.123':3128
'31.##7.209.160':3128
'77.##.129.75':3128
'20#.#10.41.64':3128
'19#.#98.144.76':3128
'31.#4.132.3':3128
'46.##0.135.121':3128
'17#.#22.178.177':3128
'20#.#48.143.192':3128
'18#.#2.196.17':3128
'41.##.32.217':3128
'20#.#5.126.129':3128
'87.##.55.230':3128
'5.##.122.215':3128
'15#.#55.32.160':3128
'95.##.54.217':3128
'89.##.253.14':3128
'41.##.156.216':3128
'19#.#78.208.132':3128
'18#.#2.253.211':3128
'92.##.224.57':3128
'19#.#98.183.180':3128
'19#.#98.97.52':3128
'79.##7.165.253':3128
'12#.#20.158.225':3128
'20#.#64.90.246':3128
'19#.#06.114.164':3128
'18#.#4.120.194':3128
'18#.#0.187.54':3128
'17#.#16.6.42':3128
'78.#8.65.70':3128
'20#.#3.41.225':3128
'95.##.15.184':3128
'20#.#42.239.176':3128
'74.##5.0.132':3128
'11#.#9.16.54':3128
'91.##.237.148':3128
'19#.#6.175.117':3128
'85.##.173.183':3128
'11#.#04.168.6':3128
'19#.#5.33.84':3128
'19#.#8.166.91':3128
'18#.#2.139.218':3128
'19#.#7.192.152':3128
'20#.#43.139.120':3128
'19#.#03.85.159':3128
'91.##5.254.5':3128
'78.##.127.121':3128
'46.##1.231.162':3128
'21#.#36.101.35':3128
'18#.#40.36.171':3128
'61.##.27.167':3128
'19#.#55.213.191':3128
'20#.#4.72.173':3128
'85.##.183.12':3128
'84.##9.101.195':3128
'85.##.181.143':3128
'41.#2.21.15':3128
'41.##.51.170':3128
'27.##.62.249':3128
'20#.#10.41.221':3128
'12#.#5.216.185':3128
'49.##2.122.146':3128
'85.##.187.228':3128
'20#.#84.80.205':3128
'2.###.63.195':3128
'85.##.167.233':3128
'17#.#0.251.7':3128
'19#.#3.84.51':3128
'19#.#8.162.213':3128
'41.##.135.202':3128
'41.##.13.146':3128
'20#.#09.212.193':3128
'94.##0.15.124':3128
'72.##2.129.90':3128
'91.##.92.186':3128
'41.#2.4.77':3128
'92.##4.223.63':3128
'41.#2.34.86':3128
'41.#2.7.57':3128
'37.##.91.206':3128
'19#.#5.50.22':3128
'19#.#9.19.252':3128
'66.##8.149.209':3128
'20#.#46.109.92':3128
'18#.#21.51.118':3128
'5.##.38.146':3128
'20#.#11.111.182':3128
'95.#5.76.81':3128
'94.##.101.43':3128
'18#.#9.164.188':3128
'20#.#73.17.192':3128
'18#.#18.112.129':3128
'41.#2.1.96':3128
'20#.#3.5.163':3128
'20#.#48.209.90':3128
'46.##.100.205':3128
'91.##.187.17':3128
'95.##.107.34':3128
'19#.#06.73.222':3128
'41.#2.2.138':3128
'21#.#57.180.200':3128
'20#.#73.146.224':3128
'18#.#95.243.55':3128
'19#.#7.135.232':3128
'77.##6.152.250':3128
'18#.#3.184.16':3128
'95.##.183.169':3128
'41.#2.36.48':3128
'92.##3.77.189':3128
'11#.#68.33.207':3128
'12#.#4.58.141':3128
'19#.#55.213.187':3128
'19#.#55.210.70':3128
'17#.#8.194.83':3128
'18#.#5.26.241':3128
'20#.#43.233.210':3128
'17#.#1.21.49':3128
'19#.#4.167.39':3128
'46.##.246.96':3128
'5.##.58.244':3128
'17#.#22.142.199':3128
'94.##8.59.224':3128
'95.##.222.31':3128
'95.##.16.119':3128
'19#.#72.71.246':3128
'20#.#.111.88':3128
'5.##.3.199':3128
'19#.37.84.3':3128
'localhost':2418
'91.##5.49.188':3128
'49.##2.120.130':3128
'18#.#29.199.210':3128
'19#.#43.59.83':3128
'18#.#2.253.249':3128
'18#.#9.163.254':3128
'20#.#27.72.132':3128
'19#.#98.214.86':3128
'19#.#06.59.152':3128
'95.##.175.183':3128
'41.#2.35.10':3128
'20#.#64.112.204':3128
'88.##4.155.118':3128
'95.##.76.166':3128
'19#.#49.75.61':3128
'66.##.196.104':3128
'11#.#09.56.207':3128
'20#.#4.240.111':3128
'18#.#43.85.67':3128
'18#.#42.176.247':3128
'19#.#8.119.17':3128
'46.##0.135.171':3128
'19#.#55.210.74':3128
'80.##.248.92':3128
'95.##.83.158':3128
'19#.#07.222.12':3128
'95.#9.62.24':3128
'19#.#04.36.216':3128
'17#.#0.18.239':3128
'18#.#2.77.90':3128
'20#.#2.150.68':3128
'18#.#64.20.253':3128
'20#.#.46.120':3128
'19#.#.225.17':3128
'89.##.50.182':3128
'20#.#.95.251':3128
'17#.#8.65.94':3128
'18#.#9.146.75':3128
'19#.#78.206.22':3128
'19#.#78.238.100':3128
'85.##0.81.228':3128
'19#.#9.206.168':3128
'41.#2.12.43':3128
'72.##2.176.94':3128
'19#.#2.29.66':3128
'17#.#9.172.25':3128
'19#.#.232.77':3128
'46.##.178.142':3128
'19#.#52.75.149':3128
'11#.#3.232.116':3128
'92.##.23.218':3128
'85.##4.253.12':3128
'18#.#4.162.127':3128
'localhost':2448
'41.##.27.249':3128
'94.##4.76.238':3128
'11#.#09.28.170':3128
'78.##.38.151':3128
'94.##5.189.131':3128
'41.##.29.202':3128
'19#.#01.49.19':3128
'18#.#4.49.73':3128
'19#.#20.68.82':3128
'20#.#1.216.225':3128
'95.##.229.98':3128
'37.##.86.243':3128
'83.##3.88.62':3128
'18#.#9.178.190':3128
'93.##6.17.94':3128
'20#.#30.30.199':3128
'18#.#4.81.119':3128
'12#.#36.197.220':3128
'2.###.228.22':3128
'19#.#7.25.124':3128
'84.##0.194.4':3128
'10#.#29.170.139':3128
'91.##1.159.1':3128
'41.#2.9.133':3128
'5.##.123.8':3128
'58.#.146.184':3128
'19#.#05.78.90':3128
'95.##.169.252':3128
'78.##.126.232':3128
'19#.#54.243.15':3128
'95.##.240.186':3128
'17#.#22.182.202':3128
'20#.#12.245.57':3128
'74.#15.3.63':3128
'11#.81.33.8':3128
'19#.#8.124.112':3128
'95.##.40.144':3128
'19#.#13.196.7':3128
'5.##.1.136':3128
'18#.#1.45.184':3128
'19#.#55.210.71':3128
'87.##7.9.180':3128
'19#.#54.103.3':3128
'19#.#86.89.198':3128
'19#.#00.17.66':3128
'41.#2.5.64':3128
'5.#.230.89':3128
'11#.#69.144.253':3128
'19#.#13.196.4':3128
'20#.#1.162.44':3128
'95.#8.3.80':3128
'22#.#20.237.99':3128
'19#.#4.208.252':3128
'19#.#00.29.111':3128
'95.#8.20.35':3128
'19#.#06.182.204':3128
'20#.#43.226.59':3128
'95.#8.41.90':3128
'18#.#7.0.224':3128
'12#.#22.149.222':3128
'95.#6.16.32':3128
'95.##.181.248':3128
'86.##6.34.123':3128
'95.##2.152.17':3128
'18#.#14.113.167':3128
'18#.#15.141.79':3128
'41.##.26.159':3128
'72.##1.193.202':3128
'80.##1.175.117':3128
'20#.#62.22.71':3128
'46.##.212.135':3128
'20#.#73.146.186':3128
'17#.#22.164.71':3128
'91.##.143.226':3128
'17#.#0.106.211':3128
'1.###.127.47':3128
'77.##.122.100':3128
'17#.#22.170.237':3128
'95.#9.1.63':3128
'20#.#09.79.126':3128
'17#.#0.111.201':3128
'41.#2.5.55':3128
'5.##.122.81':3128
'11#.#9.16.181':3128
'19#.#7.41.94':3128
'95.##.106.202':3128
'95.##.210.207':3128
'21#.#6.19.68':3128
'41.##.25.169':3128
'17#.#3.160.126':3128
'5.###.219.34':3128
'19#.#3.157.116':3128
'74.#15.1.97':3128
'19#.#04.150.254':3128
'21#.#54.248.142':3128
'19#.#55.210.89':3128
'5.##.30.64':3128
'18#.#47.202.220':3128
'19#.#0.76.223':3128
'92.##.23.235':3128
'18#.#74.212.219':3128
'18#.#2.216.244':3128
'19#.#8.84.171':3128
'19#.#05.56.32':3128
'18#.#8.110.19':3128
'92.##.68.168':3128
'19#.#03.120.118':3128
'41.##.28.188':3128
'20#.#11.107.252':3128
'91.##5.50.65':3128
'18#.#99.16.105':3128
'92.##.22.164':3128
'41.##.28.116':3128
'17#.#32.118.231':3128
'85.##.178.14':3128
'41.##.13.192':3128
'18#.#12.155.12':3128
'18#.#0.179.33':3128
'41.##.13.224':3128
'95.##.164.55':3128
'92.##.228.113':3128
'41.#9.7.53':3128
'11#.#68.77.70':3128
'19#.#49.16.182':3128
'19#.#49.22.218':3128
'87.##7.166.151':3128
'18#.#9.72.166':3128
'89.##3.98.138':3128
'18#.#7.89.123':3128
'49.##4.156.53':3128
'41.#.75.92':3128
'41.##.31.217':3128
'18#.#37.11.16':3128
'18#.#97.114.195':3128
'77.##6.162.195':3128
'59.##.213.11':3128
'78.##.129.176':3128
'18#.#18.84.148':3128
'18#.111.6.9':3128
'15#.#00.37.50':3128
'95.##4.103.11':3128
'41.#2.47.34':3128
'20#.#49.71.118':3128
'20#.#64.109.172':3128
'20#.#4.68.75':3128
'19#.#13.196.6':3128
'18#.#2.71.14':3128
'12#.#25.185.20':3128
'95.##.122.62':3128
'92.#7.65.28':3128
'19#.#7.129.237':3128
'11#.#9.17.181':3128
'84.##8.183.198':3128
'19#.#02.221.242':3128
'41.##9.239.74':3128
'19#.#55.210.72':3128
'41.##.24.219':3128
'20#.#0.109.238':3128
'19#.#8.113.38':3128
'19#.#3.92.86':3128
'18#.#4.240.15':3128
'18#.#95.199.29':3128
'95.##.12.226':3128
'37.##.102.20':3128
'18#.#.194.77':3128
'87.##5.65.39':3128
'95.##2.109.119':3128
'2.###.161.34':3128
'12#.#63.87.92':3128
'88.##4.155.126':3128
'95.##.75.141':3128
'92.##5.16.228':3128
'18#.#6.6.228':3128
'74.##5.0.146':3128
'19#.#06.244.150':3128
'11#.#1.85.91':3128
'17#.#9.134.25':3128
'92.#7.16.67':3128
'18#.#9.80.25':3128
'18#.#3.134.204':3128
'85.#7.29.96':3128
'78.##.36.180':3128
'19#.#13.196.1':3128
'17#.#22.173.112':3128
'19#.#05.5.80':3128
'18#.#0.76.254':3128
'2.##4.3.240':3128
'19#.#3.253.27':3128
'84.##9.141.158':3128
'95.##.118.151':3128
'46.##6.31.129':3128
'95.##.49.250':3128
'12#.#4.58.135':3128
'5.##.2.189':3128
'11#.#47.114.243':3128
'20#.#0.111.118':3128
'95.##.186.44':3128
'2.##0.32.52':3128
'20#.#09.165.37':3128
'91.##0.227.105':3128
'64.##6.185.9':3128
'46.#2.26.41':3128
'41.##.15.113':3128
'19#.#13.196.3':3128
'21#.#8.208.210':3128
'1.###.124.125':3128
'11#.#47.100.242':3128
'88.##.175.200':3128
'18#.#2.229.60':3128
'19#.#98.4.181':3128
'64.##.73.202':3128
'5.##.107.1':3128
'41.#2.0.112':3128
'14#.#15.12.20':3128
'18#.#1.68.240':3128
'18#.#12.177.220':3128
'20#.#08.77.180':3128
'11#.#9.19.181':3128
'95.##.144.219':3128
'95.##.235.186':3128
'11#.#9.60.41':3128
'19#.#86.43.211':3128
'80.##1.174.200':3128
'18#.#54.105.155':3128
'88.##6.72.113':3128
'19#.#5.176.66':3128
'19#.#8.181.9':3128
'20#.#40.178.184':3128
'20#.#3.35.146':3128
'18#.#2.92.228':3128
'18#.#3.72.212':3128
'17#.#4.220.80':3128
'19#.#04.34.103':3128
'18#.#36.201.249':3128
'81.##9.91.68':3128
'10#.#4.122.185':3128
'18#.#82.118.143':3128
'20#.#3.94.212':3128
'95.##.141.218':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней