Trojan.DownLoader9.58327

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WERf2e4.dir00\svchost.exe.mdmp 16325836412032212

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf2e4.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#3.82.74':139
'21#.#3.74.38':139
'21#.#3.37.200':139
'21#.#3.40.135':139
'21#.#3.18.238':139
'21#.#3.233.82':139
'21#.#3.200.177':139
'21#.#3.103.180':139
'21#.#3.77.39':139
'21#.#3.221.161':139
'21#.#3.135.151':139
'21#.#3.26.200':139
'21#.#3.200.242':139
'21#.#3.109.135':139
'21#.#3.43.211':139
'21#.#3.206.7':139
'21#.#3.43.216':139
'21#.#3.178.201':139
'21#.#3.67.238':139
'21#.#3.158.24':139
'21#.#3.173.101':139
'21#.#3.215.170':139
'21#.#3.171.189':139
'21#.#3.140.131':139
'21#.#3.10.139':139
'21#.#3.100.133':139
'21#.#3.161.78':139
'21#.#3.34.239':9988
'21#.#3.148.61':9988
'21#.#3.234.235':9988
'21#.#3.185.101':139
'21#.#3.71.215':139
'21#.#3.4.169':9988
'21#.#3.231.178':9988
'21#.#3.2.163':9988
'21#.#3.9.252':9988
'21#.#3.0.159':9988
'21#.#3.147.23':9988
'21#.#3.190.234':9988
'21#.#3.208.70':9988
'21#.#3.65.77':139
'21#.#3.48.139':139
'21#.#3.28.235':139
'21#.#3.78.253':139
'21#.#3.94.13':139
'21#.#3.30.203':139
'21#.#3.69.187':139
'21#.#3.126.126':139
'21#.#3.102.192':139
'21#.#3.121.129':139
'21#.#3.228.106':139
'21#.#3.152.65':139
'21#.#3.237.126':139
'21#.#3.162.185':139
'21#.#3.100.133':445
'21#.#3.173.101':445
'21#.#3.215.170':445
'21#.#3.158.24':445
'21#.#3.140.131':445
'21#.#3.10.139':445
'21#.#3.171.189':445
'21#.#3.82.74':445
'21#.#3.74.38':445
'21#.#3.37.200':445
'21#.#3.40.135':445
'21#.#3.18.238':445
'21#.#3.233.82':445
'21#.#3.101.16':445
'21#.#3.221.156':445
'21#.#3.196.238':445
'21#.#3.106.112':139
'21#.#3.49.47':139
'21#.#3.125.100':445
'21#.#3.162.185':445
'21#.#3.109.135':445
'21#.#3.43.211':445
'21#.#3.206.7':445
'21#.#3.43.216':445
'21#.#3.178.201':445
'21#.#3.67.238':445
'21#.#3.200.177':445
'21#.#3.237.126':445
'21#.#3.126.126':445
'21#.#3.102.192':445
'21#.#3.69.187':445
'21#.#3.228.106':445
'21#.#3.152.65':445
'21#.#3.121.129':445
'21#.#3.101.16':139
'21#.#3.221.156':139
'21#.#3.196.238':139
'21#.#3.185.101':445
'21#.#3.71.215':445
'21#.#3.125.100':139
'21#.#3.103.180':445
'21#.#3.77.39':445
'21#.#3.221.161':445
'21#.#3.135.151':445
'21#.#3.26.200':445
'21#.#3.200.242':445
'21#.#3.161.78':445
'21#.#3.65.77':445
'21#.#3.48.139':445
'21#.#3.28.235':445
'21#.#3.78.253':445
'21#.#3.94.13':445
'21#.#3.30.203':445
'21#.#3.22.157':139
'21#.#3.85.173':139
'21#.#3.72.181':139
'21#.#3.136.75':139
'21#.#3.4.169':139
'21#.#3.227.13':139
'21#.#3.150.211':139
'21#.#3.57.183':139
'21#.#3.241.100':139
'21#.#3.29.153':139
'21#.#3.164.165':139
'21#.#3.207.185':139
'21#.#3.207.11':139
'21#.#3.138.58':139
'21#.#3.125.104':139
'21#.#3.147.23':139
'21#.#3.167.56':445
'21#.#3.224.248':445
'21#.#3.215.137':139
'21#.#3.100.122':139
'21#.#3.148.61':139
'21#.#3.135.134':139
'21#.#3.1.124':139
'21#.#3.58.92':139
'21#.#3.145.245':139
'21#.#3.13.182':139
'21#.#3.8.121':139
'21#.#3.2.163':139
'21#.#3.34.239':139
'21#.#3.190.234':139
'21#.#3.10.198':139
'21#.#3.198.91':139
'21#.#3.231.178':139
'21#.#3.234.235':139
'21#.#3.167.56':139
'21#.#3.224.248':139
'21#.#3.48.227':139
'21#.#3.236.207':139
'21#.#3.208.70':139
'21#.#3.70.140':139
'21#.#3.53.191':139
'21#.#3.0.159':139
'21#.#3.131.227':139
'21#.#3.200.8':139
'21#.#3.9.101':139
'21#.#3.9.252':139
'21#.#3.98.238':139
'21#.#3.79.216':139
'21#.#3.80.132':139
'21#.63.11.2':139
'21#.#3.203.8':139
'21#.63.9.19':139
'21#.#3.40.210':139
'21#.#3.48.227':445
'21#.#3.136.75':445
'21#.#3.4.169':445
'21#.#3.227.13':445
'21#.#3.148.61':445
'21#.#3.135.134':445
'21#.#3.1.124':445
'21#.#3.22.157':445
'21#.#3.164.165':445
'21#.#3.207.185':445
'21#.#3.207.11':445
'21#.#3.85.173':445
'21#.#3.72.181':445
'21#.#3.150.211':445
'21#.#3.1.124':9988
'21#.#3.224.248':9988
'21#.#3.215.137':445
'21#.#3.29.153':9988
'21#.#3.164.165':9988
'21#.#3.215.137':9988
'21#.#3.138.58':445
'21#.#3.58.92':445
'21#.#3.145.245':445
'21#.#3.13.182':445
'21#.#3.125.104':445
'21#.#3.147.23':445
'21#.#3.100.122':445
'21#.#3.57.183':445
'21#.63.11.2':445
'21#.#3.198.91':445
'21#.#3.231.178':445
'21#.#3.79.216':445
'21#.#3.80.132':445
'21#.#3.10.198':445
'21#.#3.2.163':445
'21#.#3.236.207':445
'21#.#3.208.70':445
'21#.#3.70.140':445
'21#.#3.34.239':445
'21#.#3.190.234':445
'21#.#3.234.235':445
'21#.#3.200.8':445
'21#.#3.9.101':445
'21#.#3.9.252':445
'21#.#3.241.100':445
'21#.#3.29.153':445
'21#.#3.8.121':445
'21#.#3.53.191':445
'21#.#3.98.238':445
'21#.63.9.19':445
'21#.#3.40.210':445
'21#.#3.0.159':445
'21#.#3.131.227':445
'21#.#3.203.8':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней