Trojan.DownLoader9.44372

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WERcafd.dir00\svchost.exe.mdmp 16325836412032264

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERcafd.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'19#.#60.110.56':445
'19#.#60.95.16':445
'19#.#60.64.72':445
'19#.#60.237.14':445
'19#.#60.103.60':445
'19#.#60.4.40':445
'19#.#60.175.200':445
'19#.#60.200.211':445
'19#.#60.221.126':445
'19#.#60.132.149':445
'19#.#60.61.195':445
'19#.#60.107.227':445
'19#.#60.155.93':445
'19#.#60.232.229':445
'19#.#60.19.204':445
'19#.#60.195.181':445
'19#.#60.207.167':445
'19#.#60.36.207':445
'19#.#60.154.17':445
'19#.#60.249.118':445
'19#.#60.16.131':445
'19#.#60.38.17':445
'19#.#60.156.45':445
'19#.#60.19.54':445
'19#.#60.55.228':445
'19#.#60.130.164':445
'19#.#60.15.51':445
'19#.#60.133.154':445
'19#.#60.45.193':445
'19#.#60.18.43':445
'19#.#60.245.88':445
'19#.#60.239.244':445
'19#.#60.165.217':445
'19#.#60.156.45':139
'19#.#60.19.54':139
'19#.#60.207.167':139
'19#.#60.36.207':139
'19#.#60.138.40':139
'19#.#60.30.65':139
'19#.#60.16.131':139
'19#.#60.38.17':139
'19#.#60.245.88':139
'19#.#60.239.244':139
'19#.#60.55.228':139
'19#.#60.130.164':139
'19#.#60.154.17':139
'19#.#60.249.118':139
'19#.#60.45.193':139
'19#.#60.18.43':139
'19#.#60.54.124':139
'19#.#60.131.186':139
'19#.#60.133.212':139
'19#.#60.39.190':139
'19#.#60.206.29':445
'19#.#60.94.124':445
'19#.#60.59.161':139
'19#.#60.30.119':445
'19#.#60.70.121':139
'19#.#60.118.83':139
'19#.#60.50.30':139
'19#.#60.139.99':139
'19#.#60.148.110':139
'19#.#60.122.77':139
'19#.#60.125.118':139
'19#.#60.216.124':139
'19#.#60.138.40':445
'19#.#60.75.249':139
'19#.#60.184.75':139
'19#.#60.125.59':139
'19#.#60.249.98':139
'19#.#60.106.59':139
'19#.#60.245.128':139
'19#.#60.120.53':139
'19#.#60.119.132':139
'19#.#60.177.167':139
'19#.#60.231.54':139
'19#.#60.126.18':139
'19#.#60.167.126':139
'19#.#60.224.24':139
'19#.#60.30.224':139
'19#.#60.188.117':139
'19#.#60.22.171':139
'19#.#60.131.67':139
'19#.#60.65.132':139
'19#.#60.98.131':139
'19#.#60.55.161':139
'19#.#60.86.41':139
'19#.#60.47.108':139
'19#.#60.45.78':139
'19#.#60.144.177':139
'19#.#60.227.59':139
'19#.#60.169.58':139
'19#.#60.12.191':139
'19#.#60.123.35':139
'19#.#60.14.3':139
'19#.#60.130.13':139
'19#.#60.33.48':139
'19#.#60.69.71':139
'19#.#60.17.236':139
'19#.#60.39.190':445
'19#.#60.54.124':445
'19#.#60.122.77':445
'19#.#60.133.212':445
'19#.#60.137.107':139
'19#.#60.120.85':139
'19#.#60.131.186':445
'19#.#60.59.161':445
'19#.#60.139.99':445
'19#.#60.70.121':445
'19#.#60.30.65':445
'19#.#60.50.30':445
'19#.#60.216.124':445
'19#.#60.148.110':445
'19#.#60.118.83':445
'19#.#60.125.118':445
'19#.#60.102.22':139
'19#.#60.44.75':139
'19#.#60.231.110':139
'19#.#60.176.30':139
'19#.#60.106.35':139
'19#.#60.235.203':139
'19#.#60.80.102':139
'19#.#60.144.80':139
'19#.#60.35.73':139
'19#.#60.14.55':139
'19#.#60.8.45':139
'19#.#60.218.18':139
'19#.#60.70.110':139
'19#.#60.36.20':139
'19#.#60.18.75':139
'19#.#60.106.62':139
'19#.#60.194.163':139
'19#.#60.24.164':139
'19#.#60.19.95':139
'19#.#60.163.221':139
'19#.#60.12.253':139
'19#.#60.21.1':139
'19#.#60.73.157':139
'19#.#60.209.171':139
'19#.#60.113.201':139
'19#.#60.221.15':139
'19#.#60.144.31':139
'19#.#60.13.70':139
'19#.#60.124.105':139
'19#.#60.91.205':139
'19#.#60.0.108':139
'19#.#60.105.0':139
'19#.#60.153.166':445
'19#.#60.69.196':445
'19#.#60.48.2':445
'19#.#60.79.64':445
'19#.#60.10.68':445
'19#.#60.204.111':445
'19#.#60.84.29':445
'19#.#60.20.209':445
'19#.#60.53.149':445
'19#.#60.106.172':445
'19#.#60.48.249':139
'19#.#60.119.68':139
'19#.#60.53.249':445
'19#.#60.234.197':445
'19#.#60.140.199':445
'19#.#60.197.169':445
'19#.#60.17.11':139
'19#.#60.153.166':139
'19#.#60.84.29':139
'19#.#60.106.172':139
'19#.#60.20.209':139
'19#.#60.234.197':139
'19#.#60.10.68':139
'19#.#60.53.249':139
'19#.#60.197.169':139
'19#.#60.226.107':139
'19#.#60.48.2':139
'19#.#60.69.196':139
'19#.#60.79.64':139
'19#.#60.53.149':139
'19#.#60.204.111':139
'19#.#60.224.63':139
'19#.#60.140.199':139
'19#.#60.28.155':139
'19#.#60.79.154':139
'19#.#60.132.121':139
'19#.#60.51.14':139
'19#.#60.24.249':139
'19#.#60.238.150':139
'19#.#60.241.78':139
'19#.#60.51.247':139
'19#.#60.18.154':139
'19#.#60.99.251':139
'19#.#60.112.235':139
'19#.#60.153.138':139
'19#.#60.15.192':139
'19#.#60.187.52':139
'19#.#60.10.62':139
'19#.#60.192.118':139
'19#.#60.112.235':445
'19#.#60.30.119':139
'19#.#60.206.29':139
'19#.#60.153.138':9988
'19#.#60.51.14':9988
'19#.#60.61.195':139
'19#.#60.107.227':139
'19#.#60.94.124':139
'19#.#60.165.217':139
'19#.#60.119.68':445
'19#.#60.79.64':9988
'19#.#60.48.249':445
'19#.#60.21.1':445
'19#.#60.187.52':9988
'19#.#60.106.172':9988
'19#.#60.48.2':9988
'19#.#60.197.169':9988
'19#.#60.175.200':139
'19#.#60.200.211':139
'19#.#60.110.56':139
'19#.#60.95.16':139
'19#.#60.15.51':139
'19#.#60.133.154':139
'19#.#60.103.60':139
'19#.#60.4.40':139
'19#.#60.19.204':139
'19#.#60.195.181':139
'19#.#60.221.126':139
'19#.#60.132.149':139
'19#.#60.64.72':139
'19#.#60.237.14':139
'19#.#60.155.93':139
'19#.#60.232.229':139
'19#.#60.209.171':445
'19#.#60.51.14':445
'19#.#60.79.154':445
'19#.#60.192.118':445
'19#.#60.132.121':445
'19#.#60.51.247':445
'19#.#60.24.249':445
'19#.#60.28.155':445
'19#.#60.241.78':445
'19#.#60.153.138':445
'19#.#60.18.154':445
'19#.#60.224.63':445
'19#.#60.226.107':445
'19#.#60.187.52':445
'19#.#60.15.192':445
'19#.#60.10.62':445
'19#.#60.99.251':445
'19#.#60.163.221':445
'19#.#60.194.163':445
'19#.#60.124.105':445
'19#.#60.91.205':445
'19#.#60.73.157':445
'19#.#60.12.253':445
'19#.#60.19.95':445
'19#.#60.24.164':445
'19#.#60.17.11':445
'19#.#60.13.70':445
'19#.#60.238.150':445
'19#.#60.144.31':445
'19#.#60.105.0':445
'19#.#60.0.108':445
'19#.#60.113.201':445
'19#.#60.221.15':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней