Trojan.DownLoader9.56823

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER31ee.dir00\svchost.exe.mdmp 16325836412030052

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER31ee.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'60.##.118.74':139
'60.##.193.41':139
'60.##.76.137':139
'60.##.167.197':139
'60.##.19.144':139
'60.##.208.201':139
'60.##.33.156':445
'60.##.247.224':139
'60.##.233.110':139
'60.##.64.233':139
'60.#0.11.5':139
'60.##.179.245':139
'60.#0.24.88':139
'60.#0.11.73':139
'60.##.62.224':139
'60.##.48.178':139
'60.##.65.101':139
'60.##.178.99':139
'60.##.113.78':139
'60.##.53.209':139
'60.#0.24.88':445
'60.#0.11.5':445
'60.##.62.224':445
'60.##.72.203':445
'60.#0.11.73':445
'60.##.178.99':445
'60.##.48.178':445
'60.##.53.209':445
'60.##.179.245':445
'60.##.113.78':445
'60.##.14.192':445
'60.##.46.106':445
'60.##.77.110':445
'60.##.65.239':445
'60.##.196.218':445
'60.#0.158.5':445
'60.##.55.132':445
'60.#0.5.80':445
'60.#0.3.161':445
'60.#0.80.46':445
'60.##.72.203':139
'60.#0.16.95':445
'60.#0.22.95':445
'60.##.95.151':445
'60.##.165.177':445
'60.##.98.206':445
'60.##.95.250':445
'60.#0.40.96':445
'60.##.148.137':445
'60.##.192.236':445
'60.##.206.67':445
'60.##.173.243':139
'60.#0.35.97':139
'60.##.243.102':139
'60.##.53.242':139
'60.##.150.29':139
'60.##.114.124':139
'60.##.93.138':445
'60.##.53.167':139
'60.##.44.156':139
'60.##.218.79':139
'60.##.14.192':139
'60.##.46.106':139
'60.##.77.110':139
'60.##.65.239':139
'60.##.196.218':139
'60.#0.158.5':139
'60.##.55.132':139
'60.#0.5.80':139
'60.#0.3.161':139
'60.#0.80.46':139
'60.##.173.243':445
'60.#0.35.97':445
'60.##.243.102':445
'60.##.53.242':445
'60.##.150.29':445
'60.##.114.124':445
'60.##.33.156':139
'60.##.53.167':445
'60.##.44.156':445
'60.##.218.79':445
'60.##.189.230':139
'60.##.153.27':139
'60.##.159.220':139
'60.##.57.239':139
'60.#0.32.45':139
'60.#0.77.31':139
'60.##.130.89':139
'60.##.209.157':139
'60.##.203.171':139
'60.#0.82.24':139
'60.#0.8.117':445
'60.##.16.116':445
'60.##.29.161':445
'60.##.254.135':445
'60.##.51.254':445
'60.##.236.86':445
'60.##.213.222':139
'60.##.13.148':445
'60.#0.66.79':445
'60.##.245.189':445
'60.##.189.188':139
'60.##.139.37':139
'60.##.201.96':139
'60.##.25.102':139
'60.#0.82.40':139
'60.#0.12.10':139
'60.##.123.191':139
'60.##.153.222':139
'60.##.59.254':139
'60.#0.41.83':139
'60.##.111.230':139
'60.##.152.21':139
'60.##.135.225':139
'60.##.62.245':139
'60.##.215.40':139
'60.##.149.247':139
'60.##.38.149':139
'60.##.244.202':139
'60.##.157.152':139
'60.##.116.157':139
'60.##.136.106':445
'60.#0.77.18':139
'60.#0.71.20':139
'60.##.103.239':139
'60.#0.187.1':139
'60.#0.66.32':139
'60.#0.74.33':139
'60.#0.9.192':139
'60.##.221.107':139
'60.##.167.71':139
'60.##.106.127':139
'60.##.76.137':445
'60.##.118.74':445
'60.##.19.144':445
'60.##.65.101':445
'60.##.167.197':445
'60.##.247.224':445
'60.##.208.201':445
'60.##.64.233':445
'60.##.193.41':445
'60.##.233.110':445
'60.#0.77.18':445
'60.#0.71.20':445
'60.##.103.239':445
'60.#0.187.1':445
'60.#0.66.32':445
'60.#0.74.33':445
'60.#0.9.192':445
'60.##.221.107':445
'60.##.167.71':445
'60.##.106.127':445
'60.##.29.161':139
'60.#0.8.117':139
'60.##.51.254':139
'60.##.136.106':139
'60.##.254.135':139
'60.##.13.148':139
'60.##.236.86':139
'60.##.245.189':139
'60.##.16.116':139
'60.#0.66.79':139
'60.#0.40.96':139
'60.##.236.120':445
'60.#0.73.57':445
'60.#0.23.44':445
'60.##.254.117':445
'60.##.128.185':445
'60.##.14.218':445
'60.##.170.63':445
'60.##.216.251':445
'60.#0.51.87':445
'60.##.132.142':445
'60.##.168.50':139
'60.##.178.50':139
'60.##.109.236':139
'60.##.11.168':139
'60.#0.72.48':139
'60.#0.58.35':139
'60.#0.54.17':139
'60.##.132.67':139
'60.##.128.186':139
'60.##.154.242':139
'60.#0.147.7':445
'60.##.194.47':445
'60.##.13.206':445
'60.##.177.95':445
'60.##.54.191':445
'60.#0.35.66':445
'60.##.217.35':445
'60.#0.94.68':445
'60.##.60.125':445
'60.##.120.151':445
'60.##.182.90':445
'60.##.90.238':445
'60.##.164.209':445
'60.#0.53.50':445
'60.##.248.52':445
'60.##.238.162':445
'60.##.47.197':445
'60.##.101.149':445
'60.#0.2.41':445
'60.#0.66.88':445
'60.##.213.152':139
'60.##.90.238':139
'60.##.182.90':139
'60.##.164.209':139
'60.##.248.52':139
'60.#0.53.50':139
'60.##.101.149':139
'60.##.54.191':139
'60.##.13.206':139
'60.#0.2.41':139
'60.#0.66.88':139
'60.##.216.251':139
'60.#0.51.87':139
'60.##.236.120':139
'60.##.254.117':139
'60.#0.23.44':139
'60.#0.73.57':139
'60.##.14.218':139
'60.##.128.185':139
'60.##.132.142':139
'60.##.170.63':139
'60.##.58.230':139
'60.##.59.133':139
'60.##.181.20':139
'60.##.133.29':139
'60.##.88.129':139
'60.##.119.252':139
'60.##.153.120':139
'60.##.216.17':139
'60.#0.77.71':139
'60.#0.15.78':139
'60.##.177.95':139
'60.##.47.197':139
'60.##.238.162':139
'60.#0.147.7':139
'60.##.60.125':139
'60.#0.35.66':139
'60.##.217.35':139
'60.#0.94.68':139
'60.##.194.47':139
'60.##.120.151':139
'60.#0.84.47':445
'60.#0.15.84':445
'60.#0.38.72':445
'60.##.15.201':445
'60.##.224.15':445
'60.##.208.24':445
'60.##.208.182':445
'60.##.144.45':445
'60.#0.23.15':445
'60.##.101.23':445
'60.##.121.183':139
'60.##.86.193':139
'60.##.125.89':139
'60.##.28.107':139
'60.##.158.173':139
'60.##.234.137':445
'60.##.16.231':445
'60.##.161.78':445
'60.##.118.110':139
'60.##.190.28':139
'60.##.95.151':139
'60.#0.16.95':139
'60.##.98.206':139
'60.##.93.138':139
'60.##.165.177':139
'60.##.148.137':139
'60.##.95.250':139
'60.##.206.67':139
'60.#0.22.95':139
'60.##.192.236':139
'60.##.28.107':445
'60.##.158.173':445
'60.#0.12.28':445
'60.##.225.207':445
'60.##.28.163':445
'60.##.118.110':445
'60.##.190.28':445
'60.##.86.193':445
'60.##.125.89':445
'60.##.121.183':445
'60.#0.12.28':139
'60.##.109.236':445
'60.##.168.50':445
'60.#0.72.48':445
'60.##.213.152':445
'60.##.11.168':445
'60.##.132.67':445
'60.#0.58.35':445
'60.##.154.242':445
'60.##.178.50':445
'60.##.128.186':445
'60.##.58.230':445
'60.##.59.133':445
'60.##.181.20':445
'60.##.133.29':445
'60.##.88.129':445
'60.##.119.252':445
'60.##.153.120':445
'60.##.216.17':445
'60.#0.77.71':445
'60.#0.15.78':445
'60.#0.23.15':139
'60.##.101.23':139
'60.#0.15.84':139
'60.#0.38.72':139
'60.#0.84.47':139
'60.##.225.207':139
'60.##.28.163':139
'60.##.208.182':139
'60.##.144.45':139
'60.##.208.24':139
'60.##.14.218':9988
'60.##.170.63':9988
'60.##.132.142':9988
'60.#0.54.17':445
'60.##.254.117':9988
'60.##.15.201':139
'60.##.224.15':139
'60.##.16.231':139
'60.##.161.78':139
'60.##.234.137':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней