Trojan.DownLoader12.28939

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER539e.dir00\svchost.exe.mdmp 16325836412032356

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER539e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'67.##.244.122':139
'67.##.109.175':445
'67.##.23.104':139
'67.##.123.107':139
'67.##.197.233':445
'67.##.59.251':445
'67.##.23.104':445
'67.#1.8.92':445
'67.##.253.127':445
'67.##.59.251':139
'67.#1.59.39':445
'67.##.70.193':445
'67.##.38.138':445
'67.#1.82.71':445
'67.##.188.184':445
'67.#1.8.92':139
'67.##.253.127':139
'67.##.109.175':139
'67.##.197.233':139
'67.##.16.247':139
'67.##.73.180':139
'67.##.81.167':139
'67.##.247.81':139
'67.##.182.248':139
'67.##.200.247':139
'67.#1.16.12':139
'67.##.250.182':139
'67.##.109.109':139
'67.##.194.190':139
'67.##.190.244':139
'67.##.151.155':139
'67.##.123.107':445
'67.##.244.122':445
'67.##.126.251':139
'67.##.204.163':139
'67.##.126.204':139
'67.##.137.42':139
'67.##.143.138':139
'67.##.34.230':445
'67.##.120.203':445
'67.#1.0.80':445
'67.##.24.165':445
'67.##.191.145':445
'67.##.54.200':445
'67.#1.15.18':445
'67.##.21.144':445
'67.##.215.78':445
'67.##.47.246':445
'67.#1.46.17':445
'67.##.105.217':445
'67.##.48.199':445
'67.##.188.184':139
'67.#1.5.25':445
'67.##.188.247':445
'67.##.131.111':445
'67.##.140.84':445
'67.#1.15.30':445
'67.##.143.191':445
'67.##.132.102':445
'67.#1.11.11':445
'67.#1.63.56':445
'67.##.129.201':445
'67.##.170.130':445
'67.##.134.62':445
'67.##.213.21':445
'67.#1.15.12':445
'67.##.206.217':445
'67.##.247.252':445
'67.##.148.86':445
'67.##.85.214':445
'67.##.10.238':445
'67.##.101.142':445
'67.##.227.120':445
'67.##.188.20':445
'67.##.98.216':445
'67.##.198.215':445
'67.##.39.199':445
'67.#1.94.93':445
'67.##.163.94':445
'67.#1.204.3':445
'67.##.93.203':445
'67.#1.72.4':445
'67.##.98.211':445
'67.#1.2.202':445
'67.#1.8.162':445
'67.#1.12.9':445
'67.##.125.231':445
'67.##.200.247':445
'67.#1.16.12':445
'67.##.250.182':445
'67.##.109.109':445
'67.#1.4.0':445
'67.##.47.242':445
'67.#1.32.90':445
'67.##.127.22':445
'67.##.91.206':445
'67.##.210.135':139
'67.##.72.210':139
'67.##.217.135':445
'67.##.30.205':139
'67.#1.2.125':139
'67.##.179.140':139
'67.##.189.181':139
'67.##.228.132':139
'67.##.188.200':139
'67.##.97.191':445
'67.##.58.202':445
'67.##.206.58':445
'67.#1.10.2':445
'67.##.201.167':445
'67.##.74.206':445
'67.##.228.35':445
'67.#1.10.85':445
'67.##.140.74':445
'67.##.150.139':445
'67.##.182.248':445
'67.#1.12.9':139
'67.##.98.211':139
'67.#1.72.4':139
'67.#1.8.162':139
'67.#1.2.202':139
'67.##.58.202':139
'67.##.206.58':139
'67.#1.10.2':139
'67.##.201.167':139
'67.##.163.94':139
'67.##.91.206':139
'67.##.47.242':139
'67.#1.4.0':139
'67.##.127.22':139
'67.#1.32.90':139
'67.##.93.203':139
'67.#1.94.93':139
'67.##.125.231':139
'67.#1.204.3':139
'67.##.204.163':445
'67.##.126.204':445
'67.##.137.42':445
'67.##.143.138':445
'67.##.194.190':445
'67.##.16.247':445
'67.##.73.180':445
'67.##.81.167':445
'67.##.247.81':445
'67.##.126.251':445
'67.##.150.139':139
'67.##.228.35':139
'67.##.74.206':139
'67.##.140.74':139
'67.#1.10.85':139
'67.##.190.244':445
'67.##.151.155':445
'67.##.97.191':139
'67.##.217.135':139
'67.##.37.115':445
'67.##.57.179':445
'67.##.36.102':139
'67.#1.13.68':139
'67.##.152.58':445
'67.#1.61.78':445
'67.#1.85.15':445
'67.##.122.154':445
'67.##.35.160':445
'67.#1.89.37':139
'67.##.217.192':139
'67.##.243.87':139
'67.##.205.38':139
'67.#1.25.85':139
'67.##.188.178':139
'67.##.61.106':139
'67.##.141.214':139
'67.#1.74.58':139
'67.##.253.108':139
'67.##.243.246':445
'67.#1.112.0':445
'67.##.60.137':445
'67.##.247.60':445
'67.#1.12.62':445
'67.##.116.111':445
'67.#1.7.170':445
'67.##.103.198':445
'67.#1.36.19':445
'67.##.80.152':445
'67.##.216.193':445
'67.##.165.10':445
'67.##.194.112':445
'67.#1.85.79':445
'67.#1.17.6':445
'67.##.163.175':445
'67.##.188.217':445
'67.##.14.189':445
'67.#1.78.75':445
'67.##.73.234':139
'67.##.14.189':139
'67.#1.78.75':139
'67.##.165.10':139
'67.#1.17.6':139
'67.##.163.175':139
'67.##.60.137':139
'67.##.247.60':139
'67.##.188.217':139
'67.##.80.152':139
'67.##.216.193':139
'67.##.57.179':139
'67.##.122.154':139
'67.##.152.58':139
'67.##.37.115':139
'67.##.35.160':139
'67.#1.85.79':139
'67.##.194.112':139
'67.#1.61.78':139
'67.#1.85.15':139
'67.##.65.111':139
'67.##.211.63':139
'67.##.201.65':139
'67.##.120.178':139
'67.#1.17.12':139
'67.#1.135.7':139
'67.##.19.135':139
'67.##.134.42':139
'67.##.136.181':139
'67.#1.20.0':139
'67.#1.12.62':139
'67.##.103.198':139
'67.##.243.246':139
'67.#1.112.0':139
'67.#1.36.19':139
'67.##.33.220':139
'67.##.121.46':139
'67.##.116.111':139
'67.#1.7.170':139
'67.#1.15.18':139
'67.##.21.144':139
'67.##.215.78':139
'67.##.47.246':139
'67.##.10.238':139
'67.##.85.214':139
'67.##.227.120':139
'67.##.101.142':139
'67.##.148.86':139
'67.##.54.200':139
'67.##.131.111':139
'67.##.140.84':139
'67.#1.15.30':139
'67.##.143.191':139
'67.#1.46.17':139
'67.##.120.203':139
'67.#1.0.80':139
'67.##.24.165':139
'67.##.191.145':139
'67.##.134.62':139
'67.##.213.21':139
'67.#1.15.12':139
'67.##.206.217':139
'67.##.34.230':139
'67.#1.59.39':139
'67.##.70.193':139
'67.##.38.138':139
'67.#1.82.71':139
'67.##.170.130':139
'67.##.188.20':139
'67.##.98.216':139
'67.##.198.215':139
'67.##.39.199':139
'67.##.247.252':139
'67.##.132.102':139
'67.#1.11.11':139
'67.#1.63.56':139
'67.##.129.201':139
'67.##.188.247':139
'67.##.73.234':445
'67.##.205.38':445
'67.#1.135.7':445
'67.##.19.135':445
'67.#1.25.85':445
'67.##.188.178':445
'67.#1.74.58':445
'67.##.217.192':445
'67.##.243.87':445
'67.##.136.181':445
'67.#1.20.0':445
'67.##.201.65':445
'67.##.33.220':445
'67.##.121.46':445
'67.##.120.178':445
'67.#1.17.12':445
'67.##.134.42':445
'67.##.211.63':445
'67.##.65.111':445
'67.##.121.46':9988
'67.##.65.111':9988
'67.##.116.111':9988
'67.##.33.220':9988
'67.##.253.108':9988
'67.##.105.217':139
'67.##.48.199':139
'67.##.141.214':9988
'67.#1.5.25':139
'67.##.60.137':9988
'67.##.141.214':445
'67.#1.89.37':445
'67.##.253.108':445
'67.##.61.106':445
'67.##.36.102':445
'67.#1.85.79':9988
'67.##.80.152':9988
'67.#1.13.68':445
'67.##.37.115':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней