Trojan.DownLoader9.56852

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER4454.dir00\svchost.exe.mdmp 16325836412032864

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER4454.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'69.##5.28.71':445
'69.##5.133.17':445
'69.##5.151.127':445
'69.##5.233.223':445
'69.##5.107.60':445
'69.##5.189.176':445
'69.##5.77.224':445
'69.##5.170.212':445
'69.##5.86.36':445
'69.##5.190.215':445
'69.##5.175.190':445
'69.##5.139.197':445
'69.##5.119.5':445
'69.##5.223.170':445
'69.##5.216.56':445
'69.##5.228.32':445
'69.##5.165.73':445
'69.##5.164.51':445
'69.##5.160.173':445
'69.##5.202.33':445
'69.##5.255.201':445
'69.##5.212.64':445
'69.##5.153.122':445
'69.#25.22.5':445
'69.##5.82.166':445
'69.##5.33.186':445
'69.##5.135.111':445
'69.##5.210.200':445
'69.##5.114.193':445
'69.##5.97.232':445
'69.##5.39.115':445
'69.##5.186.166':445
'69.##5.26.41':445
'69.##5.45.202':445
'69.##5.164.51':139
'69.##5.160.173':139
'69.##5.202.33':139
'69.##5.255.201':139
'69.##5.212.64':139
'69.##5.153.122':139
'69.#25.22.5':139
'69.##5.82.166':139
'69.##5.33.186':139
'69.##5.135.111':139
'69.##5.210.200':139
'69.##5.114.193':139
'69.##5.97.232':139
'69.##5.39.115':139
'69.##5.186.166':139
'69.##5.26.41':139
'69.##5.45.202':139
'69.##5.147.10':139
'69.##5.221.194':445
'69.##5.229.1':139
'69.##5.122.89':139
'69.##5.158.61':445
'69.##5.168.25':445
'69.##5.157.45':445
'69.##5.32.157':445
'69.##5.6.243':139
'69.##5.149.88':139
'69.##5.34.31':139
'69.##5.26.104':139
'69.##5.211.26':139
'69.##5.79.55':139
'69.##5.72.210':139
'69.##5.0.240':139
'69.##5.72.63':139
'69.##5.153.68':139
'69.##5.36.251':139
'69.##5.74.56':139
'69.##5.65.222':139
'69.##5.135.36':139
'69.##5.11.203':139
'69.##5.18.134':139
'69.##5.133.94':139
'69.##5.177.31':139
'69.##5.167.95':139
'69.##5.42.109':139
'69.##5.45.252':139
'69.##5.65.158':139
'69.##5.233.149':139
'69.##5.158.251':139
'69.##5.48.43':139
'69.##5.150.47':139
'69.##5.40.240':139
'69.##5.37.147':445
'69.##5.97.54':139
'69.##5.239.78':139
'69.##5.77.19':445
'69.##5.241.72':445
'69.##5.52.104':445
'69.##5.53.79':445
'69.##5.105.142':139
'69.##5.42.146':139
'69.##5.61.108':139
'69.##5.99.116':139
'69.##5.220.11':139
'69.##5.116.20':139
'69.##5.104.227':139
'69.##5.236.74':139
'69.##5.91.26':139
'69.##5.147.10':445
'69.##5.37.147':139
'69.##5.229.1':445
'69.##5.122.89':445
'69.##5.77.19':139
'69.##5.241.72':139
'69.##5.52.104':139
'69.##5.53.79':139
'69.##5.6.243':445
'69.##5.149.88':445
'69.##5.34.31':445
'69.##5.26.104':445
'69.##5.211.26':445
'69.##5.79.55':445
'69.##5.72.210':445
'69.##5.0.240':445
'69.##5.72.63':445
'69.##5.1.212':139
'69.##5.218.1':139
'69.##5.235.101':139
'69.##5.42.164':139
'69.##5.149.250':139
'69.##5.98.102':139
'69.##5.157.217':139
'69.##5.29.158':139
'69.##5.136.15':139
'69.##5.157.253':139
'69.##5.243.157':139
'69.#25.1.62':139
'69.##5.254.44':139
'69.##5.217.79':139
'69.##5.15.217':139
'69.##5.163.243':139
'69.##5.46.77':139
'69.##5.189.176':139
'69.##5.134.64':139
'69.##5.228.76':139
'69.##5.2.110':139
'69.##5.170.22':139
'69.##5.20.173':139
'69.##5.160.147':139
'69.##5.85.209':139
'69.##5.94.90':139
'69.##5.160.225':139
'69.##5.69.108':139
'69.##5.142.34':139
'69.##5.22.216':139
'69.##5.3.213':139
'69.##5.215.46':139
'69.##5.226.58':139
'69.##5.202.82':139
'69.##5.246.139':139
'69.##5.30.120':445
'69.##5.29.122':445
'69.##5.152.24':445
'69.##5.222.175':445
'69.##5.181.224':445
'69.##5.10.138':445
'69.##5.130.145':445
'69.##5.84.206':445
'69.##5.231.59':445
'69.##5.43.225':445
'69.##5.61.247':445
'69.##5.227.112':445
'69.##5.96.94':445
'69.##5.19.66':445
'69.##5.41.211':445
'69.##5.6.161':445
'69.#25.66.6':445
'69.##5.30.120':139
'69.##5.29.122':139
'69.##5.152.24':139
'69.##5.222.175':139
'69.##5.181.224':139
'69.##5.10.138':139
'69.##5.130.145':139
'69.##5.84.206':139
'69.##5.231.59':139
'69.##5.96.94':139
'69.##5.61.247':139
'69.##5.227.112':139
'69.##5.43.225':139
'69.##5.19.66':139
'69.##5.41.211':139
'69.##5.6.161':139
'69.#25.66.6':139
'69.##5.44.35':139
'69.##5.126.44':139
'69.##5.125.106':139
'69.##5.11.107':139
'69.##5.127.43':139
'69.##5.82.136':139
'69.##5.67.222':139
'69.##5.132.237':139
'69.##5.160.148':139
'69.##5.96.226':139
'69.##5.167.124':139
'69.##5.215.167':139
'69.##5.23.207':139
'69.##5.252.138':139
'69.##5.69.245':139
'69.#25.2.30':139
'69.##5.162.62':139
'69.##5.29.122':9988
'69.##5.162.62':9988
'69.##5.152.24':9988
'69.##5.6.161':9988
'69.##5.32.157':139
'69.##5.158.61':139
'69.##5.221.194':139
'69.##5.157.45':139
'69.##5.252.138':9988
'69.#25.66.6':9988
'69.##5.130.145':9988
'69.##5.41.211':9988
'69.##5.69.245':9988
'69.##5.160.148':9988
'69.##5.30.120':9988
'69.#25.2.30':9988
'69.##5.222.175':9988
'69.##5.233.223':139
'69.##5.28.71':139
'69.##5.86.36':139
'69.##5.151.127':139
'69.##5.170.212':139
'69.##5.107.60':139
'69.##5.133.17':139
'69.##5.77.224':139
'69.##5.216.56':139
'69.##5.119.5':139
'69.##5.190.215':139
'69.##5.168.25':139
'69.##5.139.197':139
'69.##5.165.73':139
'69.##5.223.170':139
'69.##5.175.190':139
'69.##5.228.32':139
'69.##5.44.35':445
'69.##5.126.44':445
'69.##5.125.106':445
'69.##5.11.107':445
'69.##5.127.43':445
'69.##5.82.136':445
'69.##5.67.222':445
'69.##5.132.237':445
'69.##5.160.148':445
'69.##5.96.226':445
'69.##5.167.124':445
'69.##5.215.167':445
'69.##5.23.207':445
'69.##5.252.138':445
'69.##5.69.245':445
'69.#25.2.30':445
'69.##5.162.62':445
'69.##5.134.64':445
'69.##5.228.76':445
'69.##5.2.110':445
'69.##5.170.22':445
'69.##5.20.173':445
'69.##5.160.147':445
'69.##5.85.209':445
'69.##5.94.90':445
'69.##5.160.225':445
'69.##5.69.108':445
'69.##5.142.34':445
'69.##5.22.216':445
'69.##5.3.213':445
'69.##5.215.46':445
'69.##5.226.58':445
'69.##5.202.82':445
'69.##5.246.139':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней