Trojan.DownLoader9.40843

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd5ea.dir00\svchost.exe.mdmp 16325836412032484

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERd5ea.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'19#.#43.214.18':445
'19#.#43.163.62':445
'19#.#43.185.114':445
'19#.#43.5.56':445
'19#.#43.2.26':445
'19#.#43.67.117':445
'19#.#43.119.12':445
'19#.#43.117.250':445
'19#.#43.13.176':445
'19#.#43.46.250':445
'19#.#43.74.167':445
'19#.#43.157.63':445
'19#.#43.229.121':445
'19#.#43.20.64':445
'19#.#43.77.251':445
'19#.#43.67.229':445
'19#.#43.18.36':445
'19#.#43.3.36':445
'19#.#43.187.248':445
'19#.#43.8.151':445
'19#.#43.36.80':445
'19#.#43.38.137':445
'19#.#43.60.210':445
'19#.#43.249.2':445
'19#.#43.111.216':445
'19#.#43.223.19':445
'19#.#43.5.114':445
'19#.#43.170.23':445
'19#.#43.55.130':445
'19#.#43.176.251':445
'19#.#43.32.177':445
'19#.#43.15.87':445
'19#.#43.0.105':445
'19#.#43.63.176':445
'19#.#43.170.23':139
'19#.#43.55.130':139
'19#.#43.18.36':139
'19#.#43.223.19':139
'19#.#43.32.177':139
'19#.#43.8.151':139
'19#.#43.0.105':139
'19#.#43.176.251':139
'19#.#43.5.56':139
'19#.#43.117.250':139
'19#.#43.163.62':139
'19#.#43.214.18':139
'19#.#43.15.87':139
'19#.#43.5.114':139
'19#.#43.67.117':139
'19#.#43.2.26':139
'19#.#43.36.80':139
'19#.#43.152.119':139
'19#.#43.119.214':139
'19#.#43.186.20':139
'19#.#43.214.185':139
'19#.#43.88.228':139
'19#.#43.36.244':445
'19#.#43.167.142':139
'19#.#43.3.109':139
'19#.#43.187.248':139
'19#.#43.111.216':139
'19#.#43.3.36':139
'19#.#43.249.2':139
'19#.#43.38.137':139
'19#.#43.3.169':139
'19#.#43.60.210':139
'19#.#43.126.150':139
'19#.#43.230.200':139
'19#.#43.122.230':139
'19#.#43.147.7':139
'19#.#43.201.13':139
'19#.#43.19.70':139
'19#.#43.164.80':139
'19#.#43.63.192':139
'19#.#43.164.114':139
'19#.#43.47.38':139
'19#.#43.177.7':139
'19#.#43.212.152':139
'19#.#43.120.7':139
'19#.#43.191.234':139
'19#.#43.104.170':139
'19#.#43.0.177':139
'19#.#43.58.44':139
'19#.#43.102.94':139
'19#.#43.34.170':139
'19#.#43.139.162':139
'19#.#43.90.106':139
'19#.#43.169.162':139
'19#.#43.183.201':139
'19#.#43.170.134':139
'19#.#43.131.248':139
'19#.#43.7.183':139
'19#.#43.253.252':139
'19#.#43.209.184':139
'19#.#43.196.102':139
'19#.#43.218.251':139
'19#.#43.46.165':139
'19#.#43.183.235':139
'19#.#43.46.217':139
'19#.#43.135.102':139
'19#.#43.201.176':139
'19#.#43.226.83':139
'19#.#43.163.189':139
'19#.#43.3.25':139
'19#.#43.167.142':445
'19#.#43.67.185':139
'19#.#43.16.67':139
'19#.#43.119.157':139
'19#.#43.95.197':139
'19#.#43.186.20':445
'19#.#43.126.150':445
'19#.#43.3.169':445
'19#.#43.214.185':445
'19#.#43.3.109':445
'19#.#43.88.228':445
'19#.#43.152.119':445
'19#.#43.119.214':445
'19#.#43.3.25':445
'19#.#43.186.103':139
'19#.#43.207.116':139
'19#.#43.41.67':139
'19#.#43.228.165':139
'19#.#43.8.66':139
'19#.#43.201.49':139
'19#.#43.127.252':139
'19#.#43.101.79':139
'19#.#43.119.157':445
'19#.#43.95.197':445
'19#.#43.226.83':445
'19#.#43.163.189':445
'19#.#43.248.248':139
'19#.#43.66.161':139
'19#.#43.67.185':445
'19#.#43.16.67':445
'19#.#43.20.64':139
'19#.#43.125.236':139
'19#.#43.206.77':139
'19#.#43.236.106':139
'19#.#43.181.75':139
'19#.#43.52.108':139
'19#.#43.97.218':139
'19#.#43.11.163':139
'19#.#43.69.172':139
'19#.#43.60.1':139
'19#.#43.225.19':139
'19#.#43.221.128':139
'19#.#43.59.43':139
'19#.#43.123.210':139
'19#.#43.21.106':139
'19#.#43.207.86':139
'19#.#43.122.239':139
'19#.#43.134.186':139
'19#.#43.27.42':445
'19#.#43.164.127':445
'19#.#43.196.70':445
'19#.#43.198.92':445
'19#.#43.14.66':445
'19#.#43.140.221':445
'19#.#43.64.150':445
'19#.#43.47.139':445
'19#.#43.234.193':445
'19#.#43.118.190':445
'19#.#43.208.119':445
'19#.#43.190.111':445
'19#.#43.120.244':445
'19#.#43.150.234':445
'19#.#43.226.240':445
'19#.#43.59.3':445
'19#.#43.232.197':139
'19#.#43.27.42':139
'19#.#43.164.127':139
'19#.#43.118.190':139
'19#.#43.198.92':139
'19#.#43.140.221':139
'19#.#43.14.66':139
'19#.#43.64.150':139
'19#.#43.47.139':139
'19#.#43.59.3':139
'19#.#43.234.193':139
'19#.#43.190.111':139
'19#.#43.196.70':139
'19#.#43.226.240':139
'19#.#43.150.234':139
'19#.#43.120.244':139
'19#.#43.208.119':139
'19#.#43.48.14':139
'19#.#43.228.84':139
'19#.#43.39.151':139
'19#.#43.87.212':139
'19#.#43.225.223':139
'19#.#43.50.120':139
'19#.#43.52.46':139
'19#.#43.32.3':139
'19#.#43.149.74':139
'19#.#43.49.26':139
'19#.#43.37.189':139
'19#.#43.153.48':139
'19#.#43.171.72':139
'19#.#43.63.86':139
'19#.#43.184.154':139
'19#.#43.89.11':139
'19#.#43.64.65':139
'19#.#43.231.68':139
'19#.#43.38.161':139
'19#.#43.8.252':139
'19#.#43.54.88':139
'19#.#43.96.57':139
'19#.#43.8.252':445
'19#.#43.185.45':139
'19#.#43.52.70':139
'19#.#43.37.189':9988
'19#.#43.150.234':9988
'19#.#43.134.186':445
'19#.#43.89.11':9988
'19#.#43.14.66':9988
'19#.#43.171.72':9988
'19#.#43.184.154':9988
'19#.#43.190.111':9988
'19#.#43.96.57':445
'19#.#43.67.229':139
'19#.#43.229.121':139
'19#.#43.13.176':139
'19#.#43.157.63':139
'19#.#43.185.114':139
'19#.#43.119.12':139
'19#.#43.77.251':139
'19#.#43.46.250':139
'19#.#43.52.70':445
'19#.#43.38.161':445
'19#.#43.231.68':445
'19#.#43.185.45':445
'19#.#43.63.176':139
'19#.#43.74.167':139
'19#.#43.54.88':445
'19#.#43.36.244':139
'19#.#43.52.108':445
'19#.#43.225.223':445
'19#.#43.228.84':445
'19#.#43.87.212':445
'19#.#43.184.154':445
'19#.#43.149.74':445
'19#.#43.50.120':445
'19#.#43.39.151':445
'19#.#43.32.3':445
'19#.#43.171.72':445
'19#.#43.49.26':445
'19#.#43.48.14':445
'19#.#43.153.48':445
'19#.#43.89.11':445
'19#.#43.63.86':445
'19#.#43.37.189':445
'19#.#43.64.65':445
'19#.#43.52.46':445
'19#.#43.181.75':445
'19#.#43.236.106':445
'19#.#43.21.106':445
'19#.#43.125.236':445
'19#.#43.69.172':445
'19#.#43.97.218':445
'19#.#43.206.77':445
'19#.#43.11.163':445
'19#.#43.59.43':445
'19#.#43.60.1':445
'19#.#43.221.128':445
'19#.#43.232.197':445
'19#.#43.122.239':445
'19#.#43.123.210':445
'19#.#43.225.19':445
'19#.#43.207.86':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней