Trojan.DownLoader41.126

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftFixDrive' = '%LOCALAPPDATA%\Packages\Adobe.Photoshop_rEWN7XcIiDy6v\AppData\AdobeARM.exe'

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\packages\adobe.photoshop_rewn7xciidy6v\appdata\adobearm.exe
nul

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\packages\adobe.photoshop_rewn7xciidy6v\appdata\adobearm.exe

Сетевая активность

Подключается к

'11#.#0.148.28':443
'17#.#3.122.229':1071
'98.##8.172.10':4001
'17#.18.0.3':4001
'45.##.54.159':4001
'localhost':20701
'<LOCALNET>.0.250':20701
'99.##7.165.60':32460
'localhost':31831
'10.##4.6.179':31831
'15#.#5.71.229':31831
'54.##1.56.183':4001
'localhost':56738
'localhost':48362
'22#.#04.115.85':33481
'<LOCALNET>.86.37':48362
'21#.#7.179.219':48362
'14#.#1.77.186':4001
'17#.17.0.2':4001
'14#.#1.77.186':7284
'58.##.205.109':4001
'10#.#9.95.18':39124
'46.#7.96.99':30602
'46.#7.96.99':1180
'46.#7.96.99':24695
'15.##6.210.88':4001
'83.##6.70.215':56738
'localhost':59381
'localhost':33481
'localhost':33479
'5.##.193.62':33479
'16#.#6.111.231':4001
'16#.#7.174.60':4001
'localhost':32285
'10.##4.5.213':32285
'15#.#5.96.40':32285
'<LOCALNET>.1.100':4001
'17#.#41.32.31':4001
'localhost':37831
'19#.#.183.248':37831
'10.##4.1.188':30294
'17#.26.0.2':4001
'17#.#3.122.229':4001
'localhost':30257
'16#.#27.24.133':30257
'20.#0.10.88':4001
'3.##.240.251':4001
'<LOCALNET>.1.97':4001
'81.##1.245.211':13927
'localhost':4024
'13#.#4.165.176':4024
'<LOCALNET>.65.92':4001
'3.##.141.86':4001
'<LOCALNET>.32.150':4001
'46.#7.96.99':45463
'13#.#8.46.71':30294
'10#.#9.95.208':12196
'15.##6.210.88':29376
'localhost':46306
'<LOCALNET>.1.136':46306
'22#.#7.20.64':50945
'10#.#9.95.146':33348
'46.#7.96.99':11201
'10#.#9.95.86':38110
'10#.#9.95.208':23615
'10#.#9.95.125':15079
'10#.#9.95.146':62681
'10#.#9.95.146':35287
'localhost':50945
'78.##.253.237':20235
'<LOCALNET>.0.100':57400
'localhost':57400
'14#.#26.130.211':4001
'42.#.112.211':57599
'78.##.253.237':19620
'22#.#8.64.223':46351
'localhost':34563
'17#.30.1.9':34563
'11#.#4.118.192':54069
'localhost':34451
'17#.#50.178.111':34451
'18#.#73.177.34':45629
'<LOCALNET>.1.100':45629
'localhost':45629
'18#.#73.177.34':23091
'13#.#25.8.109':4001
'localhost':46351
'localhost':30294
'localhost':57599
'10.##4.7.119':32040
'15#.#5.96.114':32040
'11#.#9.150.30':46306
'localhost':32020
'10.##4.7.119':32020
'15#.#5.96.114':32020
'localhost':37006
'11#.#46.55.12':37006
'17#.19.0.2':4001
'17#.19.0.2':4002
'18#.#15.224.79':4001
'localhost':46289
'19#.#9.218.45':46289
'localhost':32040
'localhost':39163
'21#.#8.214.206':4001
'83.##1.146.96':59381
'localhost':59705
'<LOCALNET>.1.40':59705
'11#.#18.33.81':59705
'microsoft.com':80
'11#.#22.12.177':4001
'localhost':32052
'10.##4.7.119':32052
'15#.#5.96.114':32052
'localhost':30292
'16#.#27.24.133':30292
'14#.#4.5.226':39163
'localhost':49811
'localhost':41465
'21#.#8.100.104':4001
'10#.#73.160.150':4001
'20#.#90.113.53':36995
'17#.#65.30.217':58746
'13#.#8.46.71':30306
'59.##.225.166':37796
'14#.#6.200.188':4001
'27.##.237.13':41413
'17#.#1.43.206':4001
'localhost':31331
'10.##4.6.112':31331
'11#.#86.208.19':35584
'localhost':35584
'3.###.206.168':4001
'14.##.196.25':43144
'18#.#50.117.123':4001
'35.##7.36.33':30401
'13#.#25.0.57':4001
'15#.#5.110.234':31331
'34.##5.148.84':4001
'62.##0.93.220':3852
'10.#.21.33':4001
'82.##5.18.239':4001
'localhost':50263
'11#.#2.93.204':50263
'localhost':38404
'62.##0.93.220':4001
'22#.#75.80.34':56060
'16#.#72.106.224':4001
'42.#8.4.128':41465
'10#.#9.95.146':24603
'46.#7.96.99':58048
'14#.#5.195.153':4001
'17#.#32.7.102':443
'17#.#32.7.102':17388
'localhost':56748
'54.##3.241.235':4001
'17#.17.0.4':4001
'localhost':30056
'10.##4.0.226':30056
'<LOCALNET>.5.167':4001
'15#.#24.209.12':38404
'93.##7.209.127':35051
'localhost':35051
'localhost':58288
'<LOCALNET>.0.100':58288
'localhost':58746
'localhost':30306
'10.##4.1.188':30306
'localhost':37796
'16#.#19.209.190':4001
'<LOCALNET>.0.102':41413
'localhost':41413
'11#.#52.5.209':56748
'54.##3.241.235':7915
'localhost':43144
'16#.#9.160.76':30056
'localhost':32284
'10.##4.5.213':32284
'15#.#5.96.40':32284
'<LOCALNET>.0.104':59905
'18#.#55.43.101':54326
'localhost':47897
'91.##8.177.122':47897
'84.##7.15.150':4001
'localhost':32039
'10.##4.7.119':32039
'15#.#5.96.114':32039
'localhost':30750
'10.##4.1.114':30750
'13#.#97.207.75':30750
'58.##.205.96':4001
'localhost':56060
'localhost':54326
'localhost':59905
'11#.#19.177.119':63499
'16#.#8.97.137':4001
'localhost':35861
'12#.#68.202.36':35861
'localhost':36129
'21#.#50.15.240':36129
'17#.#04.151.131':4001
'17#.24.0.3':4001
'18.##0.65.11':4001
'<LOCALNET>.0.29':4001
'99.##.148.107':18204
'11#.#19.177.119':33662
'localhost':30048
'18#.#7.145.57':4001
'17#.20.0.2':4001
'13#.#20.36.121':4001
'localhost':35451
'19#.#41.54.77':35451
'localhost':30261
'16#.#27.24.133':30261
'19#.#27.172.169':4004
'localhost':45101
'11#.#07.189.29':45101
'localhost':32891
'37.##5.233.211':32891
'19#.#54.134.124':4001
'11#.#73.15.233':4001
'11#.#07.131.38':53218
'17#.#1.31.165':4001
'<LOCALNET>.0.103':54326
'20#.#18.184.168':49811
'localhost':30026
'10.##4.0.226':30026
'16#.#9.160.76':30026
'14#.#44.184.158':4001
'44.##6.43.236':7699
'localhost':35207
'18#.#1.129.194':35207
'10#.#55.93.134':17229
'46.#7.96.99':14597
'11#.#07.131.38':4001
'18.##7.42.82':4001
'<LOCALNET>.0.126':4001
'10.##4.0.226':30048
'localhost':50894
'localhost':32001
'10.##4.7.119':32001
'15#.#5.96.114':32001
'14#.#5.70.221':4001
'84.##6.231.34':4001
'<LOCALNET>.1.166':4001
'10#.#22.61.64':6745
'10#.#04.58.0':6745
'10#.#00.176.0':6745
'localhost':6745
'10#.#09.47.192':6745
'14#.#5.49.71':6745
'31.##8.149.237':56460
'17#.18.0.15':4001
'id##t.me':80
'<LOCALNET>.1.70':4001
'14#.#12.31.55':47549
'localhost':38559
'20#.#48.26.199':38559
'<LOCALNET>.67.155':4001
'10#.#00.58.0':4001
'10#.#13.113.128':4001
'52.#2.83.52':4001
'17#.#.72.248':4001
'17#.18.0.7':4001
'localhost':56460
'ch#####.amazonaws.com':80
'14#.#47.129.201':43181
'34.##1.148.59':4001
'11#.#11.0.65':4001
'lu##osi.de':4001
'lu##osi.de':4002
'18#.#3.108.254':4001
'16#.#72.254.24':4001
'10.#44.5.72':31504
'localhost':31504
'15#.#5.108.245':31504
'localhost':37782
'85.##6.47.180':37782
'17#.21.0.2':4001
'17#.#.72.248':41891
'95.##6.229.53':4001
'22#.#8.251.233':52280
'16#.#6.113.75':4001
'localhost':34329
'12#.#86.87.220':34329
'17#.18.0.2':4001
'47.##1.71.107':4001
'localhost':57317
'22#.#6.137.213':57317
'35.##5.132.165':4001
'localhost':34069
'<LOCALNET>.0.101':34069
'92.##.246.21':34069
'localhost':52280
'localhost':43181
'localhost':48042
'14.#7.82.82':48042
'18#.#21.214.88':4001
'13#.#25.163.198':4001
'10.##4.6.112':31321
'15#.#5.110.234':31321
'localhost':60593
'<LOCALNET>.68.102':60593
'22#.#8.165.217':60593
'14#.#26.130.212':4001
'<LOCALNET>.31.178':4001
'22#.#48.199.51':22882
'20#.#8.172.141':4001
'18.##7.131.175':4001
'18#.#2.78.71':4001
'10#.#12.159.190':35218
'1.###.203.53':33818
'14#.#98.147.29':41365
'localhost':4001
'10.##4.1.181':4001
'13#.#78.89.157':4001
'14#.#8.38.77':4001
'14#.#98.147.29':4001
'13#.#78.89.157':4002
'ew###.##otstrap.libp2p.io':4001
'am###.##otstrap.libp2p.io':4001
'nr###.##otstrap.libp2p.io':4001
'sj###.##otstrap.libp2p.io':4001
'10#.#31.131.82':4001
'11#.#22.12.182':4001
'34.##3.6.160':4001
'localhost':33818
'di#####tic.opendns.com':80
'sp###test.net':80
'54.##5.30.139':31781
'18#.#27.250.13':4001
'10#.#48.243.115':4001
'sp###test.net':443
'localhost':4019
'13#.#4.165.176':4019
'64.##7.19.223':4001
'16#.#79.91.8':4001
'11#.#7.119.24':4001
'10.#44.1.11':4001
'di#####tic.opendns.com':443
'10#.#36.0.134':4001
'19#.#11.115.239':4001
'localhost':31321
'10.#40.0.17':4001
'40.##7.236.116':4001
'16#.#43.174.46':4002
'16#.#43.174.46':4001
'localhost':4002
'16#.#32.172.23':4001
'ic###azip.com':443
'my####rnalip.com':443
'my##.#nsomatic.com':80
'wh#####yip.akamai.com':80
'19#.#27.172.244':443
'if##nfig.io':80
'18#.#19.32.250':1064
'17#.#1.6.218':4001
'localhost':46848
'58.##.205.103':4001
'10.##4.1.114':30827
'localhost':30827
'13#.#97.207.75':30827
'localhost':46330
'localhost':43075
'10.#.0.5':4001
'17#.#8.200.31':4001
'localhost':56811
'<LOCALNET>.86.29':56811
'localhost':30335
'10.##4.1.188':30335
'86.##0.26.25':53334
'21#.#7.110.170':49524
'86.##0.26.25':46879
'localhost':46879
'<LOCALNET>.1.32':46879
'18#.#9.165.254':46330
'91.##4.132.5':43075
'35.##1.247.125':1025
'51.##2.80.219':4001
'18#.#19.121.202':4001
'11#.#11.0.43':4001
'21#.#3.97.138':56811
'10#.#30.120.119':4001
'<LOCALNET>.0.12':4001
'localhost':35218
'15#.#1.32.143':4001
'18.##1.74.162':4001
'localhost':55844
'11#.#54.36.138':55844
'12#.#51.110.209':4001
'localhost':31840
'10.##4.6.179':31840
'15#.#5.71.229':31840
'localhost':31842
'10.##4.6.179':31842
'15#.#5.71.229':31842
'localhost':53496
'77.##.245.219':53496
'54.##2.175.171':4001
'localhost':49524
'<LOCALNET>.0.251':41625
'localhost':41625
'80.##1.138.77':16173
'localhost':55898
'61.##1.149.138':55898
'localhost':32023
'10.##4.7.119':32023
'15#.#5.96.114':32023
'20#.#45.59.32':4001
'14#.#26.130.195':4001
'12#.#58.42.52':4001
'<LOCALNET>.1.102':4001
'31.##8.101.118':50894
'58.#0.31.99':46286
'13#.#8.46.71':30335
'86.##.193.194':37181
'86.##0.26.25':22152
'10.##.223.251':4001
'localhost':30271
'16#.#27.24.133':30271
'localhost':44922
'58.##3.92.122':44922
'10.##4.7.119':32065
'localhost':32065
'15#.#5.96.114':32065
'11#.#14.190.194':28469
'<LOCALNET>.3.118':4001
'10#.#0.52.106':37521
'localhost':37521
'10#.#6.182.166':46848
'11#.#37.15.75':41387
'45.##4.109.7':13110
'localhost':32839
'<LOCALNET>.1.68':32839
'18#.#0.122.239':32839
'14#.#1.78.73':4001
'20#.#45.55.247':4001
'14#.#26.130.192':4001
'67.##5.159.18':4001
'49.##6.114.14':1744
'20#.#18.14.75':46594
'localhost':46594
'10#.#9.95.125':39386
'78.##.48.191':7179
'16#.#9.160.76':30048
'13#.#81.1.95':47794
'51.##.217.93':4001
'54.##1.231.184':4001
'localhost':39442
'21#.#30.145.236':39442
'17#.25.0.2':4001
'18#.#40.253.87':6981
'localhost':41224
'21#.#12.93.37':41224
'<LOCALNET>.1.8':4001
'17#.#0.53.67':4001
'localhost':55285
'42.#.101.98':55285
'localhost':38659
'77.##0.181.85':38953
'21#.6.41.30':38659
'16#.#38.215.63':4001
'95.##6.29.105':4001
'17#.#1.17.243':4001
'10.##.138.59':4001
'localhost':38953
'51.##.35.194':4001
'51.##.35.194':80
'51.##.35.194':4002
'13#.#81.1.95':4001
'localhost':41387
'<LOCALNET>.0.5':4001
'34.##4.152.33':4001
'10.#.0.9':4001
'rs##oly.org':443

TCP

Запросы HTTP GET

http://51.##.35.194:4002/ via 51.##.35.194
http://51.##.35.194:80/ via 51.##.35.194
http://sp###test.net/speedtest-config.php
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://ch#####.amazonaws.com/
http://di#####tic.opendns.com/myip
http://my##.#nsomatic.com/
http://wh#####yip.akamai.com/
http://if##nfig.io/ip
http://id##t.me/

Другие

'<DNS_SERVER>':53
'18#.#15.224.79':4001
'11#.#46.55.12':37006
'11#.#9.150.30':46306
'15.##6.210.88':4001
'58.##.205.109':4001
'14#.#1.77.186':4001
'21#.#7.179.219':48362
'83.##6.70.215':56738
'78.##.253.237':19620
'99.##7.165.60':32460
'17#.#3.122.229':4001
'10#.#9.95.208':12196
'22#.#04.115.85':33481
'3.##.141.86':4001
'13#.#4.165.176':4024
'81.##1.245.211':13927
'3.##.240.251':4001
'16#.#27.24.133':30257
'14#.#4.5.226':39163
'19#.#9.218.45':46289
'83.##1.146.96':59381
'11#.#18.33.81':59705
'16#.#27.24.133':30292
'20#.#45.59.32':4001
'61.##1.149.138':55898
'31.##8.101.118':50894
'77.##.245.219':53496
'11#.#54.36.138':55844
'13#.#25.8.109':4001
'17#.#50.178.111':34451
'11#.#4.118.192':54069
'19#.#.183.248':37831
'98.##8.172.10':4001
'22#.#7.20.64':50945
'10#.#9.95.125':15079
'10#.#9.95.86':38110
'10#.#9.95.146':62681
'10#.#9.95.208':23615
'10#.#9.95.146':35287
'22#.#8.64.223':46351
'21#.#8.214.206':4001
'42.#.112.211':57599
'14#.#26.130.195':4001
'10#.#9.95.146':33348
'17#.#41.32.31':4001
'86.##.193.194':37181
'16#.#7.174.60':4001
'15#.#24.209.12':38404
'11#.#2.93.204':50263
'13#.#25.0.57':4001
'62.##0.93.220':4001
'18#.#50.117.123':4001
'3.###.206.168':4001
'14#.#6.200.188':4001
'16#.#19.209.190':4001
'93.##7.209.127':35051
'17#.#65.30.217':58746
'12#.#58.42.52':4001
'10#.#73.160.150':4001
'27.##.237.13':41413
'11#.#52.5.209':56748
'20#.#90.113.53':36995
'54.##3.241.235':4001
'14.##.196.25':43144
'59.##.225.166':37796
'10#.#9.95.146':24603
'14#.#5.195.153':4001
'16#.#27.24.133':30261
'58.##.205.96':4001
'19#.#27.172.169':4004
'22#.#75.80.34':56060
'16#.#6.111.231':4001
'5.##.193.62':33479
'14#.#26.130.211':4001
'21#.#8.100.104':4001
'99.##.148.107':18204
'17#.#04.151.131':4001
'21#.#50.15.240':36129
'16#.#8.97.137':4001
'12#.#68.202.36':35861
'42.#8.4.128':41465
'37.##5.233.211':32891
'84.##7.15.150':4001
'91.##8.177.122':47897
'18#.#7.145.57':4001
'13#.#20.36.121':4001
'11#.#07.131.38':4001
'14#.#44.184.158':4001
'20#.#18.184.168':49811
'19#.#54.134.124':4001
'11#.#73.15.233':4001
'11#.#07.189.29':45101
'17#.#32.7.102':443
'58.#0.31.99':46286
'18#.#40.253.87':6981
'sp###test.net':443
'64.##7.19.223':4001
'16#.#32.172.23':4001
'10#.#48.243.115':4001
'13#.#4.165.176':4019
'18#.#27.250.13':4001
'16#.#79.91.8':4001
'11#.#7.119.24':4001
'18#.#2.78.71':4001
'54.##5.30.139':31781
'52.#2.83.52':4001
'18#.#21.214.88':4001
'14.#7.82.82':48042
'14#.#12.31.55':47549
'31.##8.149.237':56460
'84.##6.231.34':4001
'14#.#5.49.71':6745
'14#.#47.129.201':43181
'di#####tic.opendns.com':443
'19#.#11.115.239':4001
'16#.#43.174.46':4001
'40.##7.236.116':4001
'ic###azip.com':443
'am###.##otstrap.libp2p.io':4001
'ew###.##otstrap.libp2p.io':4001
'sj###.##otstrap.libp2p.io':4001
'nr###.##otstrap.libp2p.io':4001
'13#.#25.163.198':4001
'14#.#8.38.77':4001
'13#.#78.89.157':4001
'14#.#98.147.29':4001
'14#.#5.70.221':4001
'17#.#.72.248':4001
'11#.#22.12.182':4001
'20#.#8.172.141':4001
'14#.#26.130.212':4001
'22#.#48.199.51':22882
'22#.#8.165.217':60593
'1.###.203.53':33818
'my####rnalip.com':443
'19#.#27.172.244':443
'10#.#36.0.134':4001
'10#.#31.131.82':4001
'18.##7.131.175':4001
'92.##.246.21':34069
'16#.#6.113.75':4001
'35.##5.132.165':4001
'77.##0.181.85':38953
'34.##4.152.33':4001
'95.##6.29.105':4001
'54.##1.231.184':4001
'11#.#37.15.75':41387
'16#.#38.215.63':4001
'21#.6.41.30':38659
'42.#.101.98':55285
'21#.#12.93.37':41224
'91.##4.132.5':43075
'11#.#11.0.43':4001
'51.##2.80.219':4001
'54.##2.175.171':4001
'10#.#30.120.119':4001
'86.##0.26.25':22152
'21#.#3.97.138':56811
'18#.#19.121.202':4001
'21#.#30.145.236':39442
'58.##.205.103':4001
'21#.#7.110.170':49524
'13#.#81.1.95':4001
'67.##5.159.18':4001
'51.##.35.194':4001
'11#.#11.0.65':4001
'22#.#6.137.213':57317
'22#.#8.251.233':52280
'16#.#72.254.24':4001
'18#.#3.108.254':4001
'lu##osi.de':4001
'lu##osi.de':4002
'10#.#6.182.166':46848
'10#.#12.159.190':35218
'10#.#9.95.125':39386
'15#.#1.32.143':4001
'16#.#27.24.133':30271
'49.##6.114.14':1744
'14#.#26.130.192':4001
'14#.#1.78.73':4001
'20#.#45.55.247':4001
'78.##.48.191':7179
'18#.#0.122.239':32839
'11#.#14.190.194':28469
'20#.#18.14.75':46594
'58.##3.92.122':44922
'51.##.217.93':4001
'rs##oly.org':443

UDP

DNS ASK _d######.bootstrap.libp2p.io
DNS ASK lu##osi.de
DNS ASK if##nfig.io
DNS ASK id##t.me
DNS ASK ch#####.amazonaws.com
DNS ASK my####rnalip.com
DNS ASK ic###azip.com
DNS ASK my##.#nsomatic.com
DNS ASK wh#####yip.akamai.com
DNS ASK microsoft.com
DNS ASK sp###test.net
DNS ASK am###.##otstrap.libp2p.io
DNS ASK ew###.##otstrap.libp2p.io
DNS ASK nr###.##otstrap.libp2p.io
DNS ASK sj###.##otstrap.libp2p.io
DNS ASK _d######.#wr-1.bootstrap.libp2p.io
DNS ASK _d######.#ms-2.bootstrap.libp2p.io
DNS ASK _d######.#jc-1.bootstrap.libp2p.io
DNS ASK _d######.#rt-1.bootstrap.libp2p.io
DNS ASK di#####tic.opendns.com
DNS ASK rs##oly.org

Другое

Создает и запускает на исполнение

'%LOCALAPPDATA%\packages\adobe.photoshop_rewn7xciidy6v\appdata\adobearm.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoExit -Command -' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoExit -Command -

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней