Trojan.DownLoader9.57714

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERe59c.dir00\svchost.exe.mdmp 16325836412032504

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERe59c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#41.22.157':445
'21#.#41.209.221':445
'21#.#41.2.80':445
'21#.#41.207.202':445
'21#.#41.234.17':445
'21#.#41.182.207':445
'21#.#41.197.253':445
'21#.#41.205.71':445
'21#.#41.215.182':445
'21#.#41.149.61':445
'21#.#41.244.126':445
'21#.#41.22.57':445
'21#.#41.24.61':445
'21#.#41.38.116':445
'21#.#41.179.135':445
'21#.#41.252.31':445
'21#.#41.41.141':445
'21#.#41.207.115':445
'21#.#41.202.236':445
'21#.#41.25.194':445
'21#.#41.139.64':445
'21#.#41.195.121':445
'21#.#41.36.237':139
'21#.#41.49.88':139
'21#.#41.179.35':139
'21#.#41.137.213':139
'21#.#41.169.9':139
'21#.#41.2.211':139
'21#.#41.94.217':139
'21#.#41.201.94':139
'21#.#41.217.31':139
'21#.#41.223.2':139
'21#.#41.192.240':139
'21#.#41.102.244':445
'21#.#41.20.202':445
'21#.#41.18.11':445
'21#.#41.150.220':445
'21#.#41.19.58':445
'21#.#41.153.101':445
'21#.#41.155.40':445
'21#.#41.68.93':445
'21#.#41.68.93':139
'21#.#41.11.217':445
'21#.#41.155.40':139
'21#.#41.54.58':445
'21#.#41.25.194':139
'21#.#41.195.121':139
'21#.#41.139.64':139
'21#.#41.215.182':139
'21#.#41.41.141':139
'21#.#41.205.71':139
'21#.#41.102.244':139
'21#.#41.11.217':139
'21#.#41.20.202':139
'21#.#41.150.220':139
'21#.#41.19.58':139
'21#.#41.22.57':139
'21#.#41.207.115':139
'21#.#41.209.221':139
'21#.#41.179.135':139
'21#.#41.252.31':139
'21#.#41.197.253':139
'21#.#41.207.202':139
'21#.#41.182.207':139
'21#.#41.202.236':139
'21#.#41.234.17':139
'21#.#41.24.61':139
'21#.#41.112.34':445
'21#.#41.202.70':445
'21#.#41.147.141':445
'21#.#41.165.72':445
'21#.#41.19.165':445
'21#.#41.136.216':445
'21#.#41.104.185':445
'21#.#41.226.11':445
'21#.#41.97.96':445
'21#.#41.8.29':445
'21#.#41.120.236':445
'21#.#41.87.179':445
'21#.#41.11.109':445
'21#.#41.12.205':445
'21#.#41.153.101':139
'21#.#41.18.11':139
'21#.#41.31.88':445
'21#.#41.54.150':445
'21#.#41.101.78':445
'21#.#41.128.185':445
'21#.#41.10.15':445
'21#.#41.136.75':445
'21#.#41.117.139':139
'21#.#41.152.239':445
'21#.#41.232.152':445
'21#.#41.16.240':445
'21#.#41.71.160':445
'21#.#41.53.7':445
'21#.#41.59.181':445
'21#.#41.182.28':445
'21#.#41.216.217':445
'21#.#41.165.123':445
'21#.#41.148.216':445
'21#.#41.40.80':445
'21#.#41.117.139':445
'21#.#41.143.15':445
'21#.#41.201.94':445
'21#.#41.217.31':445
'21#.#41.94.217':445
'21#.#41.185.157':445
'21#.#41.119.132':445
'21#.#41.16.171':445
'21#.#41.164.186':445
'21#.#41.27.239':445
'21#.#41.41.253':445
'21#.#41.37.54':445
'21#.#41.189.128':445
'21#.#41.242.94':445
'21#.#41.244.25':445
'21#.#41.23.183':445
'21#.#41.218.198':445
'21#.#41.225.218':139
'21#.#41.54.198':139
'21#.#41.4.226':139
'21#.#41.198.165':445
'21#.#41.35.178':445
'21#.#41.58.34':445
'21#.#41.174.250':445
'21#.#41.16.9':445
'21#.#41.251.254':445
'21#.#41.12.85':445
'21#.#41.71.7':445
'21#.#41.88.23':445
'21#.#41.55.137':445
'21#.#41.66.1':445
'21#.#41.23.172':445
'21#.#41.125.251':445
'21#.#41.192.240':445
'21#.#41.40.80':139
'21#.#41.165.123':139
'21#.#41.148.216':139
'21#.#41.232.152':139
'21#.#41.59.181':139
'21#.#41.182.28':139
'21#.#41.251.254':139
'21#.#41.125.251':139
'21#.#41.58.34':139
'21#.#41.216.217':139
'21#.#41.12.85':139
'21#.#41.41.253':139
'21#.#41.164.186':139
'21#.#41.27.239':139
'21#.#41.143.15':139
'21#.#41.185.157':139
'21#.#41.119.132':139
'21#.#41.16.240':139
'21#.#41.152.239':139
'21#.#41.53.7':139
'21#.#41.16.171':139
'21#.#41.71.160':139
'21#.#41.218.198':139
'21#.#41.137.213':445
'21#.#41.198.165':139
'21#.#41.189.128':139
'21#.#41.35.178':139
'21#.#41.169.9':445
'21#.#41.2.211':445
'21#.#41.223.2':445
'21#.#41.49.88':445
'21#.#41.179.35':445
'21#.#41.36.237':445
'21#.#41.16.9':139
'21#.#41.23.172':139
'21#.#41.66.1':139
'21#.#41.174.250':139
'21#.#41.71.7':139
'21#.#41.88.23':139
'21#.#41.242.94':139
'21#.#41.37.54':139
'21#.#41.23.183':139
'21#.#41.244.25':139
'21#.#41.55.137':139
'21#.#41.7.11':445
'21#.#41.167.6':445
'21#.#41.5.72':445
'21#.#41.152.96':445
'21#.#41.158.219':445
'21#.#41.195.166':445
'21#.#41.215.39':445
'21#.#41.215.141':445
'21#.#41.17.54':445
'21#.#41.159.195':445
'21#.#41.78.160':445
'21#.#41.162.237':139
'21#.#41.29.160':139
'21#.#41.26.34':139
'21#.#41.133.148':139
'21#.#41.102.40':139
'21#.#41.36.29':139
'21#.#41.207.222':445
'21#.#41.119.226':445
'21#.141.7.0':445
'21#.#41.96.110':445
'21#.#41.28.39':445
'21#.#41.170.71':445
'21#.#41.171.117':445
'21#.#41.46.177':445
'21#.#41.91.89':445
'21#.#41.2.71':445
'21#.#41.70.248':445
'21#.#41.3.168':445
'21#.#41.152.224':445
'21#.#41.77.136':445
'21#.#41.70.238':445
'21#.#41.236.124':445
'21#.#41.12.229':445
'21#.#41.228.94':445
'21#.#41.246.11':445
'21#.#41.188.215':445
'21#.#41.203.100':445
'21#.#41.164.241':445
'21#.#41.4.45':445
'21#.#41.190.3':445
'21#.#41.127.73':445
'21#.#41.71.231':445
'21#.#41.95.89':445
'21#.#41.21.211':139
'21#.#41.215.39':139
'21#.#41.215.141':139
'21#.#41.17.54':139
'21#.#41.159.195':139
'21#.#41.78.160':139
'21#.#41.188.215':139
'21#.#41.95.89':139
'21#.#41.164.241':139
'21#.#41.228.94':139
'21#.#41.203.100':139
'21#.#41.12.229':139
'21#.#41.96.110':139
'21#.#41.152.96':139
'21#.#41.207.222':139
'21#.#41.28.39':139
'21#.141.7.0':139
'21#.#41.119.226':139
'21#.#41.167.6':139
'21#.#41.195.166':139
'21#.#41.7.11':139
'21#.#41.158.219':139
'21#.#41.5.72':139
'21#.#41.236.124':139
'21#.#41.3.168':139
'21#.#41.171.117':139
'21#.#41.70.248':139
'21#.#41.46.177':139
'21#.#41.152.224':139
'21#.#41.61.164':139
'21#.#41.72.104':139
'21#.#41.49.105':139
'21#.#41.55.24':139
'21#.#41.186.116':139
'21#.#41.71.231':139
'21#.#41.4.45':139
'21#.#41.255.241':139
'21#.#41.127.73':139
'21#.#41.246.11':139
'21#.#41.190.3':139
'21#.#41.2.71':139
'21#.#41.70.238':139
'21#.#41.170.71':139
'21#.#41.91.89':139
'21#.#41.77.136':139
'21#.#41.55.24':445
'21#.#41.91.89':9988
'21#.#41.46.177':9988
'21#.#41.2.71':9988
'21#.#41.95.89':9988
'21#.#41.49.105':9988
'21#.#41.3.168':9988
'21#.#41.31.88':139
'21#.#41.128.185':139
'21#.#41.87.179':139
'21#.#41.12.205':139
'21#.#41.11.109':139
'21#.#41.61.164':9988
'21#.#41.72.104':9988
'21#.#41.171.117':9988
'21#.#41.21.211':9988
'21#.#41.29.160':9988
'21#.#41.71.231':9988
'21#.#41.186.116':9988
'21#.#41.26.34':9988
'21#.#41.236.124':9988
'21#.#41.190.3':9988
'21#.#41.102.40':9988
'21#.#41.136.216':139
'21#.#41.244.126':139
'21#.#41.120.236':139
'21#.#41.226.11':139
'21#.#41.38.116':139
'21#.#41.2.80':139
'21#.#41.22.157':139
'21#.#41.177.240':139
'21#.#41.149.61':139
'21#.#41.97.96':139
'21#.#41.104.185':139
'21#.#41.19.165':139
'21#.#41.101.78':139
'21#.#41.54.150':139
'21#.#41.136.75':139
'21#.#41.10.15':139
'21#.#41.165.72':139
'21#.#41.147.141':139
'21#.#41.8.29':139
'21#.#41.202.70':139
'21#.#41.112.34':139
'21#.#41.54.58':139
'21#.#41.77.136':9988
'21#.#41.119.226':9988
'21#.#41.207.222':9988
'21#.#41.5.72':9988
'21#.#41.36.29':445
'21#.#41.28.39':9988
'21#.#41.159.195':9988
'21#.141.7.0':9988
'21#.#41.203.100':9988
'21#.#41.158.219':9988
'21#.#41.195.166':9988
'21#.#41.167.6':9988
'21#.#41.72.104':445
'21#.#41.21.211':445
'21#.#41.49.105':445
'21#.#41.255.241':445
'21#.#41.186.116':445
'21#.#41.61.164':445
'21#.#41.162.237':445
'21#.#41.29.160':445
'21#.#41.26.34':445
'21#.#41.133.148':445
'21#.#41.102.40':445
'21#.#41.255.241':9988
'21#.#41.215.39':9988
'21#.#41.188.215':9988
'21#.#41.96.110':9988
'21#.#41.7.11':9988
'21#.#41.246.11':9988
'21#.#41.70.238':9988
'21#.#41.55.24':9988
'21#.#41.4.45':9988
'21#.#41.133.148':9988
'21#.#41.164.241':9988
'21#.#41.12.229':9988
'21#.#41.127.73':9988
'21#.#41.170.71':9988
'21#.#41.152.96':9988
'21#.#41.70.248':9988
'21#.#41.152.224':9988
'21#.#41.215.141':9988
'21#.#41.78.160':9988
'21#.#41.162.237':9988
'21#.#41.36.29':9988
'21#.#41.17.54':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней