Trojan.DownLoader9.56847

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER3847.dir00\svchost.exe.mdmp 16325836412032448

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER3847.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'64.##2.169.218':445
'64.##2.141.46':445
'64.#52.30.7':445
'64.##2.91.202':445
'64.##2.207.102':445
'64.##2.106.93':139
'64.##2.241.95':139
'64.##2.172.14':445
'64.##2.176.75':445
'64.##2.153.20':445
'64.##2.79.87':445
'64.##2.124.201':445
'64.##2.105.219':445
'64.##2.54.138':445
'64.##2.125.192':445
'64.##2.146.92':445
'64.##2.34.218':445
'64.##2.192.234':445
'64.##2.161.66':445
'64.##2.215.83':445
'64.##2.2.213':139
'64.#52.2.40':139
'64.##2.213.82':139
'64.#52.21.4':139
'64.##2.68.251':139
'64.##2.108.189':139
'64.##2.208.181':139
'64.#52.8.12':139
'64.##2.23.238':139
'64.##2.114.34':139
'64.##2.136.106':139
'64.##2.126.97':139
'64.##2.199.95':139
'64.##2.195.91':139
'64.##2.240.32':139
'64.##2.78.233':139
'64.##2.53.172':139
'64.##2.100.136':139
'64.##2.45.224':139
'64.##2.161.246':139
'64.##2.137.117':445
'64.##2.7.207':445
'64.##2.51.97':445
'64.##2.183.76':445
'64.##2.83.236':445
'64.##2.179.28':445
'64.##2.151.220':445
'64.##2.107.207':445
'64.##2.164.195':445
'64.##2.32.165':445
'64.##2.141.46':139
'64.##2.176.75':139
'64.##2.169.218':139
'64.##2.207.102':139
'64.#52.30.7':139
'64.##2.236.189':445
'64.##2.0.115':445
'64.##2.54.44':445
'64.##2.153.20':139
'64.##2.172.14':139
'64.##2.242.149':445
'64.##2.4.196':445
'64.##2.73.145':445
'64.##2.187.90':445
'64.##2.199.186':445
'64.#52.58.6':445
'64.##2.56.83':445
'64.##2.195.25':445
'64.##2.52.141':445
'64.##2.25.59':445
'64.##2.16.79':445
'64.##2.16.16':445
'64.##2.37.241':445
'64.##2.155.119':445
'64.##2.76.155':445
'64.##2.1.122':445
'64.##2.90.164':445
'64.##2.78.244':445
'64.##2.19.221':445
'64.##2.213.48':445
'64.##2.108.189':445
'64.##2.75.107':445
'64.##2.107.17':445
'64.##2.35.78':445
'64.##2.208.181':445
'64.##2.240.116':445
'64.##2.236.48':445
'64.##2.103.49':445
'64.##2.159.2':445
'64.##2.23.175':445
'64.##2.213.82':445
'64.##2.2.213':445
'64.##2.68.251':445
'64.##2.53.172':445
'64.#52.21.4':445
'64.#52.8.12':445
'64.##2.251.143':445
'64.##2.114.34':445
'64.#52.2.40':445
'64.##2.23.238':445
'64.##2.34.65':445
'64.##2.37.235':445
'64.##2.204.14':445
'64.##2.192.9':445
'64.##2.29.191':445
'64.##2.159.166':445
'64.#52.22.4':445
'64.##2.22.26':445
'64.##2.148.173':445
'64.##2.130.196':445
'64.##2.158.96':445
'64.##2.184.86':445
'64.##2.38.89':445
'64.##2.222.235':445
'64.##2.88.222':445
'64.##2.11.129':445
'64.##2.133.140':445
'64.##2.187.213':445
'64.##2.31.185':445
'64.##2.213.31':445
'64.##2.184.86':139
'64.##2.31.185':139
'64.##2.158.96':139
'64.##2.88.222':139
'64.##2.38.89':139
'64.##2.133.140':139
'64.##2.192.9':139
'64.##2.11.129':139
'64.##2.213.31':139
'64.##2.187.213':139
'64.##2.35.78':139
'64.##2.107.17':139
'64.##2.23.175':139
'64.##2.251.143':139
'64.##2.159.2':139
'64.##2.236.48':139
'64.##2.222.235':139
'64.##2.240.116':139
'64.##2.75.107':139
'64.##2.103.49':139
'64.##2.199.95':445
'64.##2.136.106':445
'64.##2.240.32':445
'64.##2.241.95':445
'64.##2.195.91':445
'64.##2.100.136':445
'64.##2.78.233':445
'64.##2.161.246':445
'64.##2.126.97':445
'64.##2.45.224':445
'64.##2.37.235':139
'64.##2.148.173':139
'64.##2.34.65':139
'64.##2.29.191':139
'64.##2.204.14':139
'64.#52.22.4':139
'64.##2.106.93':445
'64.##2.159.166':139
'64.##2.130.196':139
'64.##2.22.26':139
'64.##2.32.238':445
'64.##2.153.191':445
'64.##2.179.32':445
'64.##2.18.84':139
'64.##2.28.179':445
'64.#52.0.71':445
'64.##2.129.53':445
'64.##2.106.254':445
'64.##2.238.178':445
'64.##2.239.138':445
'64.##2.42.36':139
'64.##2.90.174':139
'64.##2.132.211':139
'64.##2.130.232':139
'64.##2.211.81':139
'64.##2.86.38':139
'64.##2.21.48':139
'64.##2.38.15':139
'64.##2.137.204':139
'64.##2.36.142':139
'64.##2.204.151':445
'64.##2.235.204':445
'64.##2.151.31':445
'64.##2.247.0':445
'64.##2.115.80':445
'64.##2.29.145':445
'64.##2.30.64':445
'64.##2.145.146':445
'64.##2.8.144':445
'64.##2.147.41':445
'64.##2.74.252':445
'64.##2.124.74':445
'64.##2.251.222':445
'64.##2.223.143':445
'64.##2.19.253':445
'64.##2.135.133':445
'64.##2.0.135':445
'64.##2.143.175':445
'64.##2.49.118':445
'64.##2.119.127':445
'64.##2.124.74':139
'64.##2.49.118':139
'64.##2.74.252':139
'64.##2.223.143':139
'64.##2.251.222':139
'64.##2.0.135':139
'64.##2.247.0':139
'64.##2.135.133':139
'64.##2.119.127':139
'64.##2.143.175':139
'64.##2.238.178':139
'64.##2.153.191':139
'64.##2.32.238':139
'64.##2.28.179':139
'64.##2.179.32':139
'64.##2.129.53':139
'64.##2.19.253':139
'64.#52.0.71':139
'64.##2.106.254':139
'64.##2.239.138':139
'64.##2.246.230':139
'64.##2.34.14':139
'64.##2.57.20':139
'64.##2.182.43':139
'64.##2.215.246':139
'64.##2.22.114':139
'64.##2.109.235':139
'64.##2.161.193':139
'64.##2.122.56':139
'64.##2.207.165':139
'64.##2.235.204':139
'64.##2.8.144':139
'64.##2.204.151':139
'64.##2.115.80':139
'64.##2.151.31':139
'64.##2.30.64':139
'64.##2.136.2':139
'64.##2.29.145':139
'64.##2.147.41':139
'64.##2.145.146':139
'64.##2.16.16':139
'64.##2.19.221':139
'64.##2.16.79':139
'64.##2.76.155':139
'64.##2.37.241':139
'64.##2.90.164':139
'64.##2.187.90':139
'64.##2.1.122':139
'64.##2.213.48':139
'64.##2.78.244':139
'64.##2.7.207':139
'64.##2.164.195':139
'64.##2.137.117':139
'64.##2.83.236':139
'64.##2.51.97':139
'64.##2.151.220':139
'64.##2.155.119':139
'64.##2.179.28':139
'64.##2.32.165':139
'64.##2.107.207':139
'64.##2.124.201':139
'64.##2.161.66':139
'64.##2.79.87':139
'64.##2.125.192':139
'64.##2.105.219':139
'64.##2.34.218':139
'64.##2.91.202':139
'64.##2.146.92':139
'64.##2.215.83':139
'64.##2.192.234':139
'64.##2.4.196':139
'64.##2.52.141':139
'64.##2.242.149':139
'64.##2.199.186':139
'64.##2.73.145':139
'64.##2.56.83':139
'64.##2.54.138':139
'64.#52.58.6':139
'64.##2.25.59':139
'64.##2.195.25':139
'64.##2.132.211':445
'64.##2.42.36':445
'64.##2.211.81':445
'64.##2.109.235':445
'64.##2.130.232':445
'64.##2.38.15':445
'64.##2.86.38':445
'64.##2.36.142':445
'64.##2.90.174':445
'64.##2.137.204':445
'64.##2.57.20':445
'64.##2.246.230':445
'64.##2.215.246':445
'64.##2.136.2':445
'64.##2.182.43':445
'64.##2.161.193':445
'64.##2.22.114':445
'64.##2.207.165':445
'64.##2.34.14':445
'64.##2.122.56':445
'64.##2.247.0':9988
'64.##2.30.64':9988
'64.##2.251.222':9988
'64.##2.19.253':9988
'64.##2.179.32':9988
'64.##2.0.115':139
'64.##2.183.76':139
'64.##2.236.189':139
'64.##2.246.230':9988
'64.##2.54.44':139
'64.##2.238.178':9988
'64.#52.0.71':9988
'64.##2.0.135':9988
'64.##2.21.48':445
'64.##2.18.84':445
'64.##2.49.118':9988
'64.##2.239.138':9988
'64.##2.153.191':9988
'64.##2.204.151':9988
'64.##2.28.179':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней