Trojan.DownLoader9.48849

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER5389.dir00\svchost.exe.mdmp 16325836412032252

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER5389.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'68.##5.137.210':139
'68.##5.171.195':139
'68.##5.134.234':139
'68.##5.61.219':139
'68.##5.168.16':139
'68.##5.182.20':445
'68.##5.18.105':139
'68.##5.52.122':139
'68.##5.241.105':139
'68.##5.130.129':139
'68.##5.150.150':139
'68.##5.195.138':139
'68.#55.9.16':139
'68.##5.14.35':139
'68.##5.171.21':139
'68.##5.144.51':139
'68.##5.10.21':139
'68.##5.85.67':139
'68.##5.106.157':445
'68.##5.145.25':445
'68.##5.4.202':445
'68.##5.145.55':445
'68.##5.15.188':445
'68.##5.56.84':445
'68.##5.133.15':445
'68.##5.239.136':445
'68.##5.163.239':445
'68.##5.18.180':445
'68.##5.182.20':139
'68.##5.65.109':445
'68.##5.104.183':139
'68.##5.89.204':139
'68.##5.10.17':139
'68.##5.231.244':445
'68.##5.126.169':445
'68.##5.224.105':139
'68.##5.114.86':445
'68.#55.5.96':139
'68.##5.130.129':445
'68.##5.150.150':445
'68.#55.5.96':445
'68.##5.195.138':445
'68.##5.10.21':445
'68.##5.61.219':445
'68.##5.137.210':445
'68.##5.171.21':445
'68.##5.144.51':445
'68.##5.115.238':445
'68.##5.234.206':445
'68.##5.62.206':445
'68.##5.127.237':445
'68.##5.109.162':445
'68.##5.14.35':445
'68.##5.21.216':445
'68.##5.52.39':445
'68.##5.204.47':445
'68.##5.171.195':445
'68.##5.127.237':139
'68.##5.62.206':139
'68.##5.98.244':139
'68.##5.115.238':139
'68.##5.234.206':139
'68.##5.204.47':139
'68.##5.21.216':139
'68.##5.109.162':139
'68.##5.52.39':139
'68.##5.168.16':445
'68.##5.104.183':445
'68.##5.10.17':445
'68.##5.89.204':445
'68.##5.241.105':445
'68.##5.174.209':139
'68.##5.19.21':139
'68.##5.18.105':445
'68.##5.114.175':139
'68.##5.13.254':445
'68.##5.119.137':445
'68.##5.198.237':445
'68.##5.104.77':445
'68.##5.127.107':445
'68.##5.157.193':445
'68.##5.69.74':445
'68.##5.18.92':445
'68.##5.156.253':445
'68.##5.180.167':139
'68.##5.55.55':139
'68.##5.28.147':139
'68.#55.18.9':139
'68.##5.243.186':139
'68.##5.246.102':139
'68.##5.103.10':445
'68.##5.10.123':445
'68.##5.249.41':139
'68.##5.13.155':445
'68.##5.69.74':139
'68.##5.13.155':139
'68.##5.135.71':139
'68.##5.175.93':139
'68.##5.94.14':139
'68.##5.10.123':139
'68.##5.63.50':139
'68.##5.104.77':139
'68.##5.185.233':139
'68.##5.229.135':445
'68.##5.184.5':139
'68.##5.185.233':445
'68.##5.88.244':445
'68.##5.60.125':445
'68.##5.248.164':445
'68.##5.3.168':445
'68.##5.21.102':445
'68.#55.1.16':445
'68.##5.4.202':139
'68.##5.150.232':445
'68.##5.169.18':445
'68.##5.93.150':445
'68.##5.180.167':445
'68.##5.135.71':445
'68.##5.94.14':445
'68.##5.38.14':445
'68.##5.63.50':445
'68.##5.243.12':445
'68.##5.55.55':445
'68.#55.18.9':445
'68.##5.28.147':445
'68.##5.243.186':445
'68.##5.249.41':445
'68.##5.106.157':139
'68.##5.114.86':139
'68.##5.246.102':445
'68.##5.184.5':445
'68.##5.254.88':445
'68.##5.163.239':139
'68.##5.133.15':139
'68.##5.231.244':139
'68.##5.56.84':139
'68.##5.18.180':139
'68.##5.15.188':139
'68.##5.145.25':139
'68.##5.239.136':139
'68.##5.169.81':139
'68.##5.79.33':445
'68.##5.172.253':445
'68.##5.92.38':445
'68.##5.126.68':445
'68.##5.123.27':445
'68.##5.93.150':139
'68.##5.150.232':139
'68.##5.126.169':139
'68.##5.145.55':139
'68.##5.138.11':139
'68.##5.38.168':139
'68.##5.23.202':139
'68.##5.202.72':139
'68.#55.61.4':139
'68.##5.141.231':139
'68.##5.213.207':139
'68.##5.96.41':139
'68.##5.41.137':139
'68.##5.154.133':445
'68.##5.86.154':445
'68.##5.250.203':445
'68.##5.209.195':445
'68.##5.25.194':445
'68.##5.236.25':139
'68.##5.218.23':139
'68.##5.59.97':139
'68.##5.96.182':139
'68.##5.77.194':139
'68.##5.173.221':445
'68.##5.17.103':445
'68.##5.94.72':445
'68.##5.13.31':445
'68.##5.97.87':445
'68.##5.175.136':445
'68.##5.136.137':445
'68.##5.203.31':445
'68.#55.8.3':445
'68.##5.51.90':445
'68.##5.91.15':445
'68.##5.154.57':139
'68.##5.118.65':445
'68.##5.15.62':445
'68.##5.103.237':445
'68.##5.31.17':445
'68.##5.198.143':445
'68.##5.50.60':445
'68.##5.182.15':445
'68.##5.3.111':139
'68.##5.84.186':139
'68.##5.178.101':139
'68.##5.85.238':139
'68.##5.46.247':139
'68.##5.155.142':139
'68.##5.112.230':139
'68.#55.0.50':139
'68.##5.126.215':139
'68.##5.97.80':139
'68.##5.170.122':139
'68.##5.12.103':139
'68.##5.103.25':139
'68.##5.55.95':139
'68.##5.33.57':139
'68.##5.192.228':139
'68.##5.244.72':139
'68.##5.85.238':445
'68.##5.59.97':445
'68.##5.213.207':445
'68.##5.77.194':445
'68.##5.41.137':445
'68.##5.141.231':445
'68.##5.154.57':445
'68.##5.65.17':445
'68.##5.117.209':445
'68.##5.45.251':445
'68.##5.203.117':445
'68.##5.218.23':445
'68.##5.23.202':445
'68.##5.96.182':445
'68.##5.236.25':445
'68.##5.202.72':445
'68.#55.61.4':445
'68.##5.96.41':445
'68.##5.38.168':445
'68.##5.138.11':445
'68.##5.136.137':139
'68.##5.93.136':139
'68.##5.76.29':445
'68.##5.119.247':445
'68.##5.197.30':139
'68.##5.31.40':139
'68.##5.172.120':139
'68.##5.77.203':139
'68.##5.203.31':139
'68.##5.31.17':139
'68.##5.17.103':139
'68.##5.13.31':139
'68.##5.94.72':139
'68.##5.173.221':139
'68.##5.93.136':445
'68.##5.18.140':445
'68.##5.97.87':139
'68.##5.8.225':445
'68.##5.40.47':139
'68.##5.76.29':139
'68.##5.182.149':139
'68.##5.216.59':139
'68.##5.101.183':139
'68.##5.119.247':139
'68.##5.19.21':445
'68.##5.98.244':445
'68.##5.114.175':445
'68.##5.174.209':445
'68.##5.8.225':139
'68.##5.18.140':139
'68.##5.11.57':139
'68.##5.46.207':139
'68.##5.175.136':139
'68.#55.8.3':139
'68.##5.156.57':139
'68.##5.150.3':139
'68.##5.144.47':139
'68.##5.198.143':139
'68.##5.7.247':445
'68.##5.191.182':445
'68.##5.156.57':445
'68.##5.18.212':445
'68.##5.203.117':139
'68.##5.250.203':139
'68.##5.209.195':139
'68.##5.117.209':139
'68.##5.45.251':139
'68.##5.144.47':445
'68.##5.11.57':445
'68.##5.77.203':445
'68.##5.182.149':445
'68.##5.31.40':445
'68.##5.150.3':445
'68.##5.197.30':445
'68.##5.40.47':445
'68.##5.216.59':445
'68.##5.182.15':139
'68.##5.118.65':139
'68.##5.50.60':139
'68.##5.156.208':139
'68.##5.7.228':139
'68.##5.103.237':139
'68.##5.91.15':139
'68.##5.138.14':445
'68.##5.51.90':139
'68.##5.15.62':139
'68.##5.18.212':139
'68.#55.9.96':139
'68.##5.191.182':139
'68.##5.65.17':139
'68.##5.86.154':139
'68.##5.154.133':139
'68.##5.7.247':139
'68.##5.25.194':139
'68.##5.7.228':445
'68.##5.135.197':445
'68.##5.194.31':445
'68.##5.119.72':9988
'68.##5.179.19':445
'68.##5.204.236':445
'68.##5.99.251':445
'68.##5.72.221':445
'68.##5.43.24':445
'68.##5.119.72':445
'68.##5.105.28':9988
'68.##5.37.67':9988
'68.##5.233.104':9988
'68.##5.220.142':9988
'68.##5.53.20':9988
'68.##5.246.187':9988
'68.##5.202.209':9988
'68.##5.18.56':9988
'68.##5.173.31':9988
'68.##5.105.43':445
'68.##5.30.171':445
'68.##5.198.108':445
'68.##5.16.17':445
'68.##5.191.225':445
'68.##5.18.56':445
'68.##5.220.142':445
'68.##5.234.101':445
'68.##5.123.166':445
'68.##5.110.167':445
'68.##5.112.140':445
'68.##5.86.202':445
'68.##5.146.231':445
'68.##5.31.157':445
'68.##5.10.160':445
'68.##5.32.116':445
'68.##5.95.31':445
'68.##5.13.28':445
'68.##5.137.174':445
'68.##5.118.15':9988
'68.##5.82.144':9988
'68.##5.34.173':9988
'68.##5.163.124':9988
'68.##5.110.167':9988
'68.##5.131.100':9988
'68.##5.123.166':9988
'68.##5.31.157':9988
'68.##5.97.249':9988
'68.##5.25.186':9988
'68.##5.53.86':139
'68.##5.74.80':139
'68.##5.162.146':139
'68.##5.146.32':139
'68.##5.147.24':139
'68.##5.28.57':139
'68.##5.72.30':139
'68.##5.230.183':139
'68.##5.241.28':139
'68.##5.32.116':9988
'68.##5.16.17':9988
'68.##5.14.239':9988
'68.##5.198.108':9988
'68.##5.179.19':9988
'68.##5.79.240':9988
'68.##5.163.162':9988
'68.##5.11.91':9988
'68.##5.135.197':9988
'68.##5.30.171':9988
'68.##5.217.149':9988
'68.##5.112.88':9988
'68.##5.234.101':9988
'68.##5.86.202':9988
'68.##5.28.38':9988
'68.##5.152.241':9988
'68.##5.191.225':9988
'68.##5.91.201':9988
'68.##5.165.82':9988
'68.##5.97.249':139
'68.##5.234.101':139
'68.##5.123.166':139
'68.##5.110.167':139
'68.##5.220.142':139
'68.##5.217.149':139
'68.##5.37.67':139
'68.##5.131.100':139
'68.##5.14.239':139
'68.##5.32.116':139
'68.##5.95.31':139
'68.##5.137.174':139
'68.##5.13.28':139
'68.##5.191.225':139
'68.##5.18.56':139
'68.##5.198.108':139
'68.##5.16.17':139
'68.##5.30.171':139
'68.##5.25.186':139
'68.##5.152.241':139
'68.##5.246.187':139
'68.##5.202.209':139
'68.##5.82.144':139
'68.##5.118.15':139
'68.##5.79.240':139
'68.##5.163.124':139
'68.##5.28.38':139
'68.##5.34.173':139
'68.##5.91.201':139
'68.##5.105.28':139
'68.##5.173.31':139
'68.##5.112.88':139
'68.##5.163.162':139
'68.##5.11.91':139
'68.##5.53.20':139
'68.##5.233.104':139
'68.##5.165.82':139
'68.##5.10.160':139
'68.##5.11.91':445
'68.##5.112.88':445
'68.##5.91.201':445
'68.##5.163.162':445
'68.##5.173.31':445
'68.##5.53.20':445
'68.##5.246.187':445
'68.##5.152.241':445
'68.##5.82.144':445
'68.##5.14.239':445
'68.##5.217.149':445
'68.##5.97.249':445
'68.##5.131.100':445
'68.##5.37.67':445
'68.##5.233.104':445
'68.##5.165.82':445
'68.##5.25.186':445
'68.##5.105.28':445
'68.##5.118.15':445
'68.##5.99.251':139
'68.##5.72.221':139
'68.##5.204.236':139
'68.##5.119.72':139
'68.##5.105.43':139
'68.##5.86.202':139
'68.##5.31.157':139
'68.##5.146.231':139
'68.##5.112.140':139
'68.##5.163.124':445
'68.##5.202.209':445
'68.##5.34.173':445
'68.##5.79.240':445
'68.##5.28.38':445
'68.##5.194.31':139
'68.##5.43.24':139
'68.##5.135.197':139
'68.##5.179.19':139
'68.##5.240.37':139
'68.##5.206.178':139
'68.##5.143.145':139
'68.#55.1.16':139
'68.##5.243.225':139
'68.##5.83.24':139
'68.##5.24.53':139
'68.##5.3.168':139
'68.##5.47.111':139
'68.##5.60.125':139
'68.##5.110.83':139
'68.##5.2.148':139
'68.##5.34.201':139
'68.##5.230.68':139
'68.##5.38.148':139
'68.##5.66.159':139
'68.##5.248.164':139
'68.##5.164.38':139
'68.##5.52.222':139
'68.##5.6.179':445
'68.##5.68.68':445
'68.##5.206.66':445
'68.##5.72.23':445
'68.##5.235.207':445
'68.##5.147.125':445
'68.##5.42.60':445
'68.##5.127.184':445
'68.##5.221.219':445
'68.##5.227.173':445
'68.##5.12.94':445
'68.##5.0.221':445
'68.##5.245.201':445
'68.##5.99.126':445
'68.##5.202.169':445
'68.##5.197.205':445
'68.##5.53.172':445
'68.##5.70.222':445
'68.##5.102.56':139
'68.##5.126.68':139
'68.##5.88.244':139
'68.##5.38.14':139
'68.##5.254.88':139
'68.##5.34.201':445
'68.##5.103.10':139
'68.##5.123.27':139
'68.##5.172.253':139
'68.##5.94.214':445
'68.##5.79.33':139
'68.##5.157.193':139
'68.##5.127.107':139
'68.##5.156.253':139
'68.##5.13.254':139
'68.##5.169.18':139
'68.##5.92.38':139
'68.##5.243.12':139
'68.##5.18.92':139
'68.##5.198.237':139
'68.##5.240.37':445
'68.##5.47.111':445
'68.##5.143.145':445
'68.##5.243.225':445
'68.##5.83.24':445
'68.##5.94.214':139
'68.##5.21.102':139
'68.##5.24.53':445
'68.##5.52.222':445
'68.##5.2.148':445
'68.##5.164.38':445
'68.##5.119.137':139
'68.##5.229.135':139
'68.##5.66.159':445
'68.##5.38.148':445
'68.##5.102.56':445
'68.##5.230.68':445
'68.##5.110.83':445
'68.##5.201.204':139
'68.##5.72.23':139
'68.##5.70.222':139
'68.##5.94.223':139
'68.##5.235.207':139
'68.##5.68.68':139
'68.##5.127.184':139
'68.##5.197.205':139
'68.##5.168.227':139
'68.##5.42.60':139
'68.##5.245.201':139
'68.##5.147.125':139
'68.##5.21.117':139
'68.##5.24.201':139
'68.##5.246.112':139
'68.##5.53.172':139
'68.##5.99.126':139
'68.##5.12.94':139
'68.##5.1.248':139
'68.##5.57.253':139
'68.##5.65.142':139
'68.##5.7.233':139
'68.##5.103.196':139
'68.##5.20.127':139
'68.##5.253.44':139
'68.##5.242.226':139
'68.##5.197.167':139
'68.##5.3.239':139
'68.##5.11.219':139
'68.##5.131.78':139
'68.##5.202.169':139
'68.##5.6.179':139
'68.##5.206.66':139
'68.##5.202.69':139
'68.##5.184.234':139
'68.##5.202.147':139
'68.##5.148.2':139
'68.##5.158.127':139
'68.##5.7.233':445
'68.##5.74.80':445
'68.##5.1.248':445
'68.##5.131.78':445
'68.##5.103.196':445
'68.##5.3.239':445
'68.##5.202.69':445
'68.##5.53.86':445
'68.##5.162.146':445
'68.##5.24.201':445
'68.##5.21.117':445
'68.##5.246.112':445
'68.##5.158.127':445
'68.##5.21.247':445
'68.##5.168.227':445
'68.##5.11.219':445
'68.##5.94.223':445
'68.##5.201.204':445
'68.##5.146.32':445
'68.##5.72.30':445
'68.##5.241.28':445
'68.##5.242.226':445
'68.##5.253.44':445
'68.##5.28.57':445
'68.##5.221.219':139
'68.##5.227.173':139
'68.##5.0.221':139
'68.##5.21.247':139
'68.##5.202.147':445
'68.##5.197.167':445
'68.##5.147.24':445
'68.##5.57.253':445
'68.##5.230.183':445
'68.##5.20.127':445
'68.##5.65.142':445
'68.##5.148.2':445
'68.##5.184.234':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней