Trojan.DownLoader10.6961

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERe54d.dir00\svchost.exe.mdmp 16325836412029956

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERe54d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'20#.#30.113.110':139
'20#.#30.70.95':139
'20#.#30.60.219':139
'20#.#30.119.58':139
'20#.#30.220.56':139
'20#.#30.153.234':139
'20#.#30.52.33':139
'20#.#30.221.56':139
'20#.#30.63.239':139
'20#.#30.109.212':139
'20#.#30.20.56':139
'20#.#30.132.137':139
'20#.#30.113.82':139
'20#.#30.180.34':139
'20#.#30.173.164':139
'20#.#30.169.184':139
'20#.#30.43.232':139
'20#.#30.21.252':139
'20#.#30.91.84':139
'20#.#30.49.150':139
'20#.#30.138.41':139
'20#.#30.150.137':139
'20#.#30.212.220':139
'20#.#30.83.140':139
'20#.#30.255.190':139
'20#.#30.140.88':139
'20#.#30.219.169':139
'20#.#30.5.156':139
'20#.#30.83.46':139
'20#.#30.12.174':139
'20#.#30.25.130':139
'20#.#30.125.56':139
'20#.#30.87.140':139
'20#.#30.6.87':139
'20#.#30.148.201':139
'20#.#30.186.245':139
'20#.#30.56.176':139
'20#.#30.106.64':139
'20#.#30.122.134':139
'20#.#30.73.224':445
'20#.#30.56.121':139
'20#.#30.15.95':139
'20#.#30.21.238':139
'20#.#30.142.253':445
'20#.#30.173.164':445
'20#.#30.142.253':139
'20#.#30.181.60':9988
'20#.#30.97.45':9988
'20#.#30.107.209':9988
'20#.#30.145.19':9988
'20#.#30.19.155':9988
'20#.#30.98.109':9988
'20#.#30.0.100':9988
'20#.#30.112.149':9988
'20#.#30.58.61':9988
'20#.#30.1.149':9988
'20#.#30.123.179':9988
'20#.#30.233.167':9988
'20#.#30.177.196':9988
'20#.#30.59.111':9988
'20#.#30.190.82':9988
'20#.#30.238.75':9988
'20#.#30.138.202':9988
'20#.#30.109.225':9988
'20#.#30.102.103':9988
'20#.#30.198.163':9988
'20#.#30.115.178':9988
'20#.#30.167.159':9988
'20#.#30.51.83':9988
'20#.#30.213.240':139
'20#.#30.135.151':139
'20#.#30.2.165':139
'20#.#30.123.237':9988
'20#.#30.194.107':9988
'20#.#30.216.93':139
'20#.#30.135.151':445
'20#.#30.73.224':139
'20#.#30.216.93':445
'20#.#30.2.165':445
'20#.#30.213.240':445
'20#.#30.213.161':9988
'20#.#30.26.19':9988
'20#.#30.194.78':9988
'20#.#30.215.98':9988
'20#.#30.78.248':9988
'20#.#30.223.240':9988
'20#.#30.84.233':9988
'20#.#30.206.185':9988
'20#.#30.162.125':9988
'20#.#30.63.114':9988
'20#.#30.98.116':9988
'20#.#30.76.17':139
'20#.#30.229.157':139
'20#.#30.204.104':139
'20#.#30.94.63':139
'20#.#30.236.71':139
'20#.#30.101.14':139
'20#.#30.14.236':139
'20#.#30.75.10':139
'20#.#30.15.82':139
'20#.#30.16.189':139
'20#.#30.119.34':139
'20#.#30.34.58':139
'20#.#30.233.234':139
'20#.#30.6.87':445
'20#.#30.24.219':139
'20#.#30.153.50':139
'20#.#30.40.53':139
'20#.#30.76.17':445
'20#.#30.86.224':139
'20#.#30.193.231':139
'20#.#30.26.173':139
'20#.#30.214.51':445
'20#.#30.243.6':139
'20#.#30.222.207':139
'20#.#30.20.52':139
'20#.#30.0.65':139
'20#.#30.105.150':139
'20#.#30.69.61':139
'20#.#30.149.245':139
'20#.#30.101.91':139
'20#.#30.85.79':139
'20#.#30.74.208':139
'20#.#30.175.125':139
'20#.#30.73.163':139
'20#.#30.125.94':139
'20#.#30.255.169':139
'20#.#30.76.193':139
'20#.#30.194.50':139
'20#.#30.167.152':139
'20#.#30.195.209':139
'20#.#30.186.44':139
'20#.#30.86.90':139
'20#.#30.250.11':139
'20#.#30.158.92':139
'20#.#30.35.37':139
'20#.#30.235.24':139
'20#.#30.193.173':139
'20#.#30.52.33':445
'20#.#30.221.56':445
'20#.#30.63.239':445
'20#.#30.153.234':445
'20#.#30.60.219':445
'20#.#30.106.64':445
'20#.#30.20.56':445
'20#.#30.132.137':445
'20#.#30.212.220':445
'20#.#30.220.56':445
'20#.#30.70.95':445
'20#.#30.180.34':445
'20#.#30.113.82':445
'20#.#30.169.184':445
'20#.#30.94.238':139
'20#.#30.214.51':139
'20#.#30.43.232':445
'20#.#30.21.252':445
'20#.#30.119.58':445
'20#.#30.138.41':445
'20#.#30.150.137':445
'20#.#30.91.84':445
'20#.#30.49.150':445
'20#.#30.83.46':445
'20#.#30.87.140':445
'20#.#30.255.190':445
'20#.#30.140.88':445
'20#.#30.83.140':445
'20#.#30.12.174':445
'20#.#30.221.183':139
'20#.#30.31.105':139
'20#.#30.25.130':445
'20#.#30.125.56':445
'20#.#30.94.238':445
'20#.#30.56.176':445
'20#.#30.148.201':445
'20#.#30.122.134':445
'20#.#30.113.110':445
'20#.#30.109.212':445
'20#.#30.186.245':445
'20#.#30.219.169':445
'20#.#30.5.156':445
'20#.#30.15.95':445
'20#.#30.56.121':445
'20#.#30.21.238':445
'20#.#30.34.66':9988
'20#.#30.58.61':139
'20#.#30.190.82':139
'20#.#30.233.58':139
'20#.#30.63.114':139
'20#.#30.223.240':139
'20#.#30.206.185':139
'20#.#30.164.139':139
'20#.#30.11.241':139
'20#.#30.198.163':139
'20#.#30.202.244':139
'20#.#30.116.183':139
'20#.#30.145.19':139
'20#.#30.6.126':139
'20#.#30.59.111':139
'20#.#30.97.45':139
'20#.#30.0.100':139
'20#.#30.130.181':139
'20#.#30.138.202':139
'20#.#30.84.233':139
'20#.#30.107.209':139
'20#.#30.11.192':139
'20#.#30.115.178':139
'20#.#30.233.167':139
'20#.#30.6.173':445
'20#.#30.156.101':445
'20#.#30.121.246':445
'20#.#30.196.138':139
'20#.#30.208.193':445
'20#.#30.163.240':445
'20#.#30.215.98':445
'20#.#30.118.188':445
'20#.#30.128.3':445
'20#.#30.238.197':445
'20#.#30.11.192':445
'20#.#30.107.237':139
'20#.#30.239.172':139
'20#.#30.167.159':139
'20#.#30.60.177':139
'20#.#30.162.125':139
'20#.#30.112.149':139
'20#.#30.109.234':139
'20#.#30.19.155':139
'20#.#30.238.75':139
'20#.#30.103.80':139
'20#.#30.82.52':139
'20#.#30.220.171':139
'20#.#30.213.161':139
'20#.#30.82.144':139
'20#.#30.3.164':139
'20#.#30.208.193':139
'20#.#30.238.197':139
'20#.#30.30.103':139
'20#.#30.237.155':139
'20#.#30.166.196':139
'20#.#30.160.9':139
'20#.#30.194.78':139
'20#.#30.102.84':139
'20#.#30.118.188':139
'20#.#30.194.107':139
'20#.#30.121.246':139
'20#.#30.6.173':139
'20#.#30.102.103':139
'20#.#30.98.109':139
'20#.#30.51.83':139
'20#.#30.172.196':139
'20#.#30.71.213':139
'20#.#30.163.240':139
'20#.#30.156.101':139
'20#.#30.52.105':139
'20#.#30.43.134':139
'20#.#30.62.17':139
'20#.#30.123.237':139
'20#.#30.181.60':139
'20#.#30.52.162':139
'20#.#30.81.122':139
'20#.#30.78.248':139
'20#.#30.226.101':139
'20#.#30.34.66':139
'20#.#30.237.190':139
'20#.#30.98.116':139
'20#.#30.177.196':139
'20#.#30.215.98':139
'20#.#30.191.78':139
'20#.#30.200.127':139
'20#.#30.8.191':139
'20#.#30.123.179':139
'20#.#30.1.149':139
'20#.#30.26.19':139
'20#.#30.182.179':139
'20#.#30.128.3':139
'20#.#30.109.225':139
'20#.#30.82.144':445
'20#.#30.223.240':445
'20#.#30.239.172':445
'20#.#30.112.149':445
'20#.#30.60.177':445
'20#.#30.63.114':445
'20#.#30.107.237':445
'20#.#30.58.61':445
'20#.#30.19.155':445
'20#.#30.238.75':445
'20#.#30.82.52':445
'20#.#30.162.125':445
'20#.#30.116.183':445
'20#.#30.198.163':445
'20#.#30.202.244':445
'20#.#30.103.80':445
'20#.#30.190.82':445
'20#.#30.233.167':445
'20#.#30.138.202':445
'20#.#30.164.139':445
'20#.#30.84.233':445
'20#.#30.107.209':445
'20#.#30.11.241':445
'20#.#30.109.234':445
'20#.#30.160.9':9988
'20#.#30.102.84':9988
'20#.#30.81.122':9988
'20#.#30.3.164':9988
'20#.#30.237.190':9988
'20#.#30.196.138':9988
'20#.#30.200.127':9988
'20#.#30.8.191':9988
'20#.#30.172.196':9988
'20#.#30.233.58':9988
'20#.#30.30.103':9988
'20#.#30.128.3':9988
'20#.#30.156.101':9988
'20#.#30.11.192':9988
'20#.#30.82.144':9988
'20#.#30.118.188':9988
'20#.#30.6.173':9988
'20#.#30.238.197':9988
'20#.#30.163.240':9988
'20#.#30.208.193':9988
'20#.#30.121.246':9988
'20#.#30.166.196':9988
'20#.#30.167.159':445
'20#.#30.237.155':445
'20#.#30.102.84':445
'20#.#30.194.78':445
'20#.#30.62.17':445
'20#.#30.30.103':445
'20#.#30.160.9':445
'20#.#30.81.122':445
'20#.#30.237.190':445
'20#.#30.191.78':445
'20#.#30.200.127':445
'20#.#30.8.191':445
'20#.#30.51.83':445
'20#.#30.194.107':445
'20#.#30.172.196':445
'20#.#30.3.164':445
'20#.#30.166.196':445
'20#.#30.98.109':445
'20#.#30.123.237':445
'20#.#30.43.134':445
'20#.#30.52.162':445
'20#.#30.71.213':445
'20#.#30.109.225':445
'20#.#30.98.116':445
'20#.#30.196.138':445
'20#.#30.130.181':445
'20#.#30.6.126':445
'20#.#30.182.179':445
'20#.#30.1.149':445
'20#.#30.26.19':445
'20#.#30.181.60':445
'20#.#30.123.179':445
'20#.#30.213.161':445
'20#.#30.233.58':445
'20#.#30.206.185':445
'20#.#30.220.171':445
'20#.#30.115.178':445
'20#.#30.226.101':445
'20#.#30.34.66':445
'20#.#30.78.248':445
'20#.#30.102.103':445
'20#.#30.145.19':445
'20#.#30.59.111':445
'20#.#30.0.100':445
'20#.#30.97.45':445
'20#.#30.177.196':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней