Trojan.DownLoader9.48966

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3325.dir00\svchost.exe.mdmp 16325836412032896

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER3325.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'65.##5.88.113':445
'65.##5.41.77':445
'65.##5.234.31':445
'65.##5.245.163':445
'65.##5.124.41':445
'65.##5.195.132':139
'65.##5.99.208':139
'65.##5.49.124':445
'65.##5.231.217':139
'65.##5.249.160':445
'65.##5.118.183':445
'65.##5.42.221':445
'65.#35.5.5':445
'65.##5.200.54':445
'65.##5.180.15':445
'65.##5.63.10':445
'65.##5.100.168':445
'65.##5.168.6':445
'65.##5.24.28':445
'65.##5.231.67':139
'65.##5.116.141':139
'65.##5.113.94':139
'65.##5.149.148':139
'65.##5.125.145':139
'65.##5.119.107':139
'65.##5.99.198':139
'65.##5.92.46':139
'65.##5.5.233':139
'65.##5.5.231':139
'65.##5.143.113':139
'65.##5.169.235':139
'65.##5.12.209':139
'65.##5.142.226':139
'65.##5.130.151':139
'65.##5.58.124':139
'65.##5.105.181':139
'65.##5.6.210':139
'65.##5.99.235':139
'65.##5.29.83':139
'65.##5.12.164':445
'65.##5.156.115':445
'65.##5.186.223':445
'65.##5.120.102':445
'65.##5.189.31':445
'65.##5.190.191':445
'65.##5.242.144':445
'65.##5.233.53':445
'65.#35.1.67':445
'65.##5.88.36':445
'65.##5.222.92':445
'65.##5.41.77':139
'65.##5.124.41':139
'65.##5.245.163':139
'65.##5.88.113':139
'65.##5.49.124':139
'65.##5.98.213':445
'65.##5.92.30':445
'65.##5.96.208':445
'65.##5.166.96':445
'65.##5.160.135':445
'65.##5.197.67':445
'65.##5.90.21':445
'65.##5.8.189':445
'65.##5.33.150':445
'65.##5.145.41':445
'65.##5.23.197':445
'65.##5.208.246':445
'65.##5.219.215':445
'65.##5.34.60':445
'65.##5.25.101':445
'65.##5.121.153':445
'65.##5.150.121':445
'65.##5.145.160':445
'65.##5.153.146':445
'65.##5.69.55':445
'65.##5.123.202':445
'65.##5.22.228':445
'65.##5.253.93':445
'65.##5.222.253':445
'65.##5.145.64':445
'65.##5.156.213':445
'65.##5.92.46':445
'65.##5.189.177':445
'65.##5.46.99':445
'65.##5.106.57':445
'65.##5.136.226':445
'65.##5.239.1':445
'65.##5.160.160':445
'65.##5.5.231':445
'65.##5.149.148':445
'65.##5.125.145':445
'65.##5.6.210':445
'65.##5.143.113':445
'65.##5.116.141':445
'65.##5.5.233':445
'65.##5.99.198':445
'65.##5.113.94':445
'65.##5.119.107':445
'65.##5.67.205':445
'65.##5.204.227':445
'65.##5.32.50':445
'65.##5.25.91':445
'65.##5.227.100':445
'65.##5.125.195':445
'65.#35.2.46':445
'65.##5.58.194':445
'65.##5.246.125':445
'65.##5.175.246':445
'65.##5.190.187':445
'65.##5.133.223':445
'65.#35.0.60':445
'65.##5.19.34':445
'65.##5.231.36':445
'65.##5.52.17':445
'65.##5.117.94':445
'65.##5.46.17':445
'65.##5.221.129':445
'65.##5.71.20':445
'65.##5.105.181':445
'65.#35.0.60':139
'65.##5.52.17':139
'65.##5.231.36':139
'65.##5.133.223':139
'65.##5.221.129':139
'65.##5.46.17':139
'65.##5.190.187':139
'65.##5.71.20':139
'65.##5.117.94':139
'65.##5.19.34':139
'65.##5.156.213':139
'65.##5.46.99':139
'65.##5.189.177':139
'65.##5.145.64':139
'65.##5.239.1':139
'65.##5.136.226':139
'65.##5.67.205':139
'65.##5.160.160':139
'65.##5.106.57':139
'65.##5.25.91':139
'65.##5.142.226':445
'65.##5.130.151':445
'65.##5.99.208':445
'65.##5.231.67':445
'65.##5.169.235':445
'65.##5.99.235':445
'65.##5.29.83':445
'65.##5.12.209':445
'65.##5.58.124':445
'65.##5.195.132':445
'65.##5.32.50':139
'65.##5.125.195':139
'65.##5.227.100':139
'65.##5.204.227':139
'65.##5.246.125':139
'65.##5.58.194':139
'65.##5.231.217':445
'65.##5.175.246':139
'65.#35.2.46':139
'65.##5.234.31':139
'65.##5.205.206':445
'65.##5.200.36':445
'65.##5.46.146':139
'65.#35.35.8':445
'65.##5.17.81':445
'65.##5.174.132':445
'65.##5.44.47':445
'65.##5.27.107':445
'65.##5.111.248':445
'65.##5.214.149':139
'65.##5.180.153':139
'65.##5.16.182':139
'65.##5.54.17':139
'65.##5.230.47':139
'65.##5.155.134':139
'65.##5.22.177':139
'65.##5.65.29':139
'65.#35.8.51':139
'65.##5.70.153':139
'65.##5.148.21':445
'65.##5.31.189':445
'65.##5.166.78':445
'65.##5.54.67':445
'65.##5.11.55':445
'65.##5.188.176':445
'65.##5.152.218':445
'65.##5.72.44':445
'65.##5.33.210':445
'65.##5.30.167':445
'65.#35.95.9':445
'65.##5.181.55':445
'65.##5.186.231':445
'65.##5.124.207':445
'65.##5.160.100':445
'65.##5.65.187':445
'65.##5.214.189':445
'65.##5.150.9':445
'65.##5.204.34':445
'65.##5.136.75':445
'65.##5.240.198':139
'65.##5.186.231':139
'65.##5.65.187':139
'65.##5.160.100':139
'65.##5.181.55':139
'65.##5.204.34':139
'65.##5.150.9':139
'65.#35.95.9':139
'65.##5.136.75':139
'65.##5.214.189':139
'65.##5.124.207':139
'65.##5.200.36':139
'65.#35.35.8':139
'65.##5.205.206':139
'65.##5.17.81':139
'65.##5.27.107':139
'65.##5.44.47':139
'65.##5.148.21':139
'65.##5.111.248':139
'65.##5.174.132':139
'65.##5.54.67':139
'65.##5.39.86':139
'65.#35.43.8':139
'65.##5.19.31':139
'65.##5.218.138':139
'65.##5.184.116':139
'65.##5.25.31':139
'65.##5.20.25':139
'65.##5.30.156':139
'65.##5.31.34':139
'65.##5.181.171':139
'65.##5.166.78':139
'65.##5.188.176':139
'65.##5.11.55':139
'65.##5.31.189':139
'65.##5.33.210':139
'65.##5.72.44':139
'65.##5.12.101':139
'65.##5.30.167':139
'65.##5.152.218':139
'65.##5.150.121':139
'65.##5.69.55':139
'65.##5.153.146':139
'65.##5.121.153':139
'65.##5.253.93':139
'65.##5.22.228':139
'65.##5.25.101':139
'65.##5.222.253':139
'65.##5.123.202':139
'65.##5.145.160':139
'65.##5.186.223':139
'65.##5.190.191':139
'65.##5.189.31':139
'65.##5.156.115':139
'65.#35.1.67':139
'65.##5.233.53':139
'65.##5.160.135':139
'65.##5.88.36':139
'65.##5.242.144':139
'65.##5.8.189':139
'65.##5.42.221':139
'65.##5.180.15':139
'65.##5.200.54':139
'65.##5.118.183':139
'65.##5.168.6':139
'65.##5.100.168':139
'65.##5.249.160':139
'65.##5.24.28':139
'65.##5.63.10':139
'65.#35.5.5':139
'65.##5.90.21':139
'65.##5.145.41':139
'65.##5.33.150':139
'65.##5.197.67':139
'65.##5.219.215':139
'65.##5.208.246':139
'65.##5.12.164':139
'65.##5.34.60':139
'65.##5.23.197':139
'65.##5.120.102':139
'65.##5.54.17':445
'65.##5.230.47':445
'65.##5.20.25':445
'65.##5.240.198':445
'65.##5.180.153':445
'65.#35.8.51':445
'65.##5.70.153':445
'65.##5.16.182':445
'65.##5.155.134':445
'65.##5.25.31':445
'65.##5.19.31':445
'65.##5.218.138':445
'65.##5.12.101':445
'65.##5.181.171':445
'65.##5.39.86':445
'65.##5.30.156':445
'65.##5.31.34':445
'65.#35.43.8':445
'65.##5.184.116':445
'65.##5.22.177':445
'65.#35.43.8':9988
'65.##5.240.198':9988
'65.##5.11.55':9988
'65.##5.181.171':9988
'65.##5.96.208':139
'65.##5.92.30':139
'65.##5.222.92':139
'65.##5.166.96':139
'65.##5.98.213':139
'65.##5.150.9':9988
'65.##5.46.146':445
'65.#35.95.9':9988
'65.##5.65.29':445
'65.##5.214.149':445
'65.##5.54.67':9988
'65.##5.214.189':9988
'65.##5.111.248':9988
'65.##5.200.36':9988
'65.##5.174.132':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней