Trojan.DownLoader9.56889

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER33e3.dir00\svchost.exe.mdmp 16325836412032524

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER33e3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'61.##.47.132':445
'61.#7.1.154':445
'61.##.139.69':445
'61.##.15.223':445
'61.##.118.37':445
'61.#7.2.184':139
'61.#7.25.45':139
'61.##.129.126':445
'61.##.197.19':139
'61.##.220.112':445
'61.#7.77.94':445
'61.##.162.72':445
'61.##.88.150':445
'61.##.132.33':445
'61.##.249.16':445
'61.##.41.254':445
'61.##.191.195':445
'61.##.168.13':445
'61.#7.6.230':445
'61.##.219.216':139
'61.##.233.127':139
'61.##.156.157':139
'61.##.102.143':139
'61.##.156.41':139
'61.##.190.37':139
'61.#7.28.43':139
'61.#7.2.130':139
'61.##.72.208':139
'61.#7.10.3':139
'61.##.252.249':139
'61.##.224.74':139
'61.##.228.14':139
'61.##.26.100':139
'61.##.77.168':139
'61.##.32.241':139
'61.##.134.109':139
'61.##.141.74':139
'61.##.110.21':139
'61.##.109.110':139
'61.##.29.133':445
'61.#7.8.192':445
'61.##.57.214':445
'61.##.169.147':445
'61.#7.23.8':445
'61.##.71.112':445
'61.##.165.170':445
'61.##.139.48':445
'61.#7.126.8':445
'61.##.155.109':445
'61.#7.26.80':445
'61.#7.1.154':139
'61.##.118.37':139
'61.##.15.223':139
'61.##.47.132':139
'61.##.129.126':139
'61.##.172.45':445
'61.#7.57.19':445
'61.##.112.11':445
'61.#7.8.105':445
'61.##.247.139':445
'61.##.128.60':445
'61.##.13.199':445
'61.##.185.75':445
'61.##.213.176':445
'61.##.128.149':445
'61.##.243.24':445
'61.#7.7.227':445
'61.#7.46.75':445
'61.##.129.71':445
'61.#7.3.59':445
'61.##.155.162':445
'61.##.174.64':445
'61.#7.63.90':445
'61.#7.27.5':445
'61.##.23.187':445
'61.##.241.205':445
'61.#7.68.4':445
'61.##.250.238':445
'61.##.225.146':445
'61.##.109.140':445
'61.##.246.178':445
'61.#7.2.130':445
'61.##.58.248':445
'61.##.180.123':445
'61.#7.32.21':445
'61.##.81.242':445
'61.#7.16.87':445
'61.#7.71.96':445
'61.#7.28.43':445
'61.##.102.143':445
'61.##.156.41':445
'61.##.141.74':445
'61.##.252.249':445
'61.##.233.127':445
'61.##.72.208':445
'61.#7.10.3':445
'61.##.156.157':445
'61.##.190.37':445
'61.#7.1.84':445
'61.##.111.97':445
'61.##.136.97':445
'61.##.57.166':445
'61.##.241.203':445
'61.#7.86.94':445
'61.##.195.244':445
'61.##.106.37':445
'61.##.245.231':445
'61.##.63.246':445
'61.##.137.213':445
'61.##.254.81':445
'61.##.59.166':445
'61.##.155.205':445
'61.##.254.154':445
'61.##.125.212':445
'61.#7.23.47':445
'61.##.114.152':445
'61.##.40.125':445
'61.##.63.161':445
'61.##.134.109':445
'61.##.59.166':139
'61.##.125.212':139
'61.##.254.154':139
'61.##.254.81':139
'61.##.40.125':139
'61.##.114.152':139
'61.##.137.213':139
'61.##.63.161':139
'61.#7.23.47':139
'61.##.155.205':139
'61.##.246.178':139
'61.##.180.123':139
'61.##.58.248':139
'61.##.109.140':139
'61.#7.16.87':139
'61.##.81.242':139
'61.#7.1.84':139
'61.#7.71.96':139
'61.#7.32.21':139
'61.##.57.166':139
'61.##.26.100':445
'61.##.77.168':445
'61.#7.25.45':445
'61.##.219.216':445
'61.##.224.74':445
'61.##.110.21':445
'61.##.109.110':445
'61.##.228.14':445
'61.##.32.241':445
'61.#7.2.184':445
'61.##.136.97':139
'61.#7.86.94':139
'61.##.241.203':139
'61.##.111.97':139
'61.##.245.231':139
'61.##.106.37':139
'61.##.197.19':445
'61.##.63.246':139
'61.##.195.244':139
'61.##.198.135':445
'61.##.138.247':445
'61.##.244.127':139
'61.##.208.114':445
'61.##.208.252':445
'61.##.200.251':445
'61.##.80.224':445
'61.#7.41.53':445
'61.##.161.63':445
'61.##.128.51':139
'61.##.35.173':139
'61.##.206.66':139
'61.##.183.122':139
'61.##.52.174':139
'61.##.195.47':139
'61.#7.1.60':139
'61.##.51.225':139
'61.##.175.153':139
'61.##.93.109':139
'61.##.220.47':445
'61.##.137.130':445
'61.##.150.144':445
'61.##.127.222':445
'61.##.116.248':445
'61.##.202.25':445
'61.##.152.29':445
'61.##.180.128':445
'61.#7.21.17':445
'61.##.34.130':445
'61.##.30.219':445
'61.##.30.182':445
'61.##.249.90':445
'61.##.155.201':445
'61.##.110.220':445
'61.##.171.248':445
'61.##.48.101':445
'61.##.221.124':445
'61.##.230.171':445
'61.#7.38.49':445
'61.##.37.144':139
'61.##.249.90':139
'61.##.171.248':139
'61.##.110.220':139
'61.##.30.182':139
'61.##.230.171':139
'61.##.221.124':139
'61.##.30.219':139
'61.#7.38.49':139
'61.##.48.101':139
'61.##.220.47':139
'61.#7.41.53':139
'61.##.208.114':139
'61.##.208.252':139
'61.##.198.135':139
'61.##.138.247':139
'61.##.155.201':139
'61.##.80.224':139
'61.##.161.63':139
'61.##.200.251':139
'61.##.127.222':139
'61.##.185.132':139
'61.##.25.219':139
'61.#7.5.91':139
'61.#7.251.5':139
'61.#7.29.84':139
'61.#7.6.113':139
'61.#7.82.9':139
'61.##.58.174':139
'61.##.113.58':139
'61.##.192.50':139
'61.##.150.144':139
'61.##.202.25':139
'61.##.116.248':139
'61.##.137.130':139
'61.#7.21.17':139
'61.##.180.128':139
'61.##.175.245':139
'61.##.34.130':139
'61.##.152.29':139
'61.##.23.187':139
'61.##.250.238':139
'61.##.155.162':139
'61.##.174.64':139
'61.##.225.146':139
'61.#7.3.59':139
'61.##.185.75':139
'61.##.241.205':139
'61.#7.68.4':139
'61.#7.27.5':139
'61.##.71.112':139
'61.#7.126.8':139
'61.#7.8.192':139
'61.##.57.214':139
'61.##.155.109':139
'61.##.247.139':139
'61.#7.63.90':139
'61.##.165.170':139
'61.##.139.48':139
'61.##.213.176':139
'61.##.249.16':139
'61.##.168.13':139
'61.#7.77.94':139
'61.##.162.72':139
'61.#7.6.230':139
'61.##.220.112':139
'61.##.139.69':139
'61.##.41.254':139
'61.##.191.195':139
'61.##.132.33':139
'61.##.128.149':139
'61.#7.46.75':139
'61.##.128.60':139
'61.##.13.199':139
'61.##.129.71':139
'61.##.29.133':139
'61.##.88.150':139
'61.##.243.24':139
'61.#7.7.227':139
'61.#7.23.8':139
'61.##.183.122':445
'61.##.52.174':445
'61.#7.82.9':445
'61.##.37.144':445
'61.##.35.173':445
'61.##.175.153':445
'61.##.93.109':445
'61.##.206.66':445
'61.##.195.47':445
'61.#7.6.113':445
'61.#7.5.91':445
'61.#7.251.5':445
'61.##.175.245':445
'61.##.192.50':445
'61.##.185.132':445
'61.##.58.174':445
'61.##.113.58':445
'61.##.25.219':445
'61.#7.29.84':445
'61.#7.1.60':445
'61.##.93.109':9988
'61.##.112.11':139
'61.##.192.50':9988
'61.#7.251.5':9988
'61.#7.8.105':139
'61.#7.26.80':139
'61.##.169.147':139
'61.##.172.45':139
'61.#7.57.19':139
'61.##.249.90':9988
'61.##.244.127':445
'61.##.155.201':9988
'61.##.51.225':445
'61.##.128.51':445
'61.##.161.63':9988
'61.#7.21.17':9988
'61.##.110.220':9988
'61.##.200.251':9988
'61.##.198.135':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней