Trojan.DownLoader12.29005

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER447c.dir00\svchost.exe.mdmp 16325836412032268

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER447c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'89.##1.93.212':445
'89.##1.76.94':445
'89.##1.46.77':445
'89.##1.169.125':445
'89.##1.29.88':445
'89.##1.143.108':445
'89.##1.23.158':445
'89.##1.60.176':445
'89.##1.80.127':445
'89.##1.67.187':445
'89.#51.57.9':445
'89.##1.123.238':445
'89.##1.63.135':445
'89.##1.129.211':445
'89.##1.91.44':445
'89.##1.55.173':445
'89.##1.187.55':445
'89.##1.3.126':445
'89.##1.172.152':445
'89.##1.5.127':445
'89.##1.39.22':445
'89.##1.120.235':445
'89.##1.45.187':445
'89.##1.139.157':445
'89.##1.84.249':139
'89.##1.181.183':139
'89.##1.64.197':445
'89.##1.53.81':445
'89.##1.238.184':445
'89.##1.132.5':445
'89.##1.87.64':445
'89.##1.145.250':445
'89.##1.179.106':445
'89.##1.228.23':445
'89.##1.34.176':445
'89.##1.184.226':445
'89.##1.61.251':445
'89.##1.171.212':445
'89.##1.39.226':445
'89.##1.61.251':139
'89.##1.171.212':139
'89.##1.87.64':139
'89.##1.228.23':139
'89.##1.34.176':139
'89.##1.120.235':139
'89.##1.45.187':139
'89.##1.184.226':139
'89.##1.238.184':139
'89.##1.132.5':139
'89.##1.29.88':139
'89.##1.60.176':139
'89.##1.93.212':139
'89.##1.76.94':139
'89.##1.80.127':139
'89.##1.145.250':139
'89.##1.179.106':139
'89.##1.143.108':139
'89.##1.23.158':139
'89.##1.153.101':445
'89.##1.242.89':445
'89.##1.132.242':445
'89.##1.247.109':445
'89.##1.125.238':445
'89.##1.156.204':445
'89.##1.177.242':445
'89.##1.197.126':445
'89.##1.189.197':445
'89.##1.143.97':445
'89.##1.139.157':139
'89.##1.64.197':139
'89.##1.5.127':139
'89.##1.39.22':139
'89.##1.53.81':139
'89.##1.64.55':445
'89.##1.167.100':445
'89.##1.171.31':445
'89.##1.171.133':445
'89.##1.80.181':445
'89.##1.128.171':445
'89.##1.84.249':445
'89.##1.181.183':445
'89.##1.161.163':445
'89.##1.240.97':445
'89.##1.14.245':445
'89.##1.2.151':445
'89.##1.96.98':445
'89.##1.167.27':139
'89.##1.162.228':139
'89.##1.182.217':139
'89.##1.233.108':139
'89.##1.234.247':139
'89.##1.1.183':139
'89.##1.212.38':139
'89.##1.243.36':139
'89.##1.23.97':139
'89.##1.142.34':139
'89.##1.49.241':445
'89.##1.50.175':445
'89.##1.108.198':445
'89.##1.104.57':445
'89.##1.49.35':445
'89.##1.187.115':445
'89.##1.52.188':445
'89.##1.25.223':445
'89.##1.116.2':445
'89.##1.47.215':445
'89.##1.36.96':445
'89.##1.158.182':445
'89.##1.27.60':445
'89.##1.148.103':445
'89.##1.91.147':445
'89.##1.20.11':445
'89.##1.220.151':445
'89.##1.107.229':445
'89.##1.248.166':445
'89.##1.108.224':139
'89.##1.107.229':139
'89.##1.248.166':139
'89.##1.158.182':139
'89.##1.91.147':139
'89.##1.20.11':139
'89.##1.108.198':139
'89.##1.104.57':139
'89.##1.220.151':139
'89.##1.47.215':139
'89.##1.36.96':139
'89.##1.161.163':139
'89.##1.2.151':139
'89.##1.80.181':139
'89.##1.128.171':139
'89.##1.96.98':139
'89.##1.27.60':139
'89.##1.148.103':139
'89.##1.240.97':139
'89.##1.14.245':139
'89.##1.92.106':139
'89.##1.26.83':139
'89.##1.14.55':139
'89.##1.106.14':139
'89.##1.219.12':139
'89.##1.141.133':139
'89.##1.224.119':139
'89.##1.36.210':139
'89.##1.212.223':139
'89.##1.55.200':139
'89.##1.49.35':139
'89.##1.25.223':139
'89.##1.49.241':139
'89.##1.50.175':139
'89.##1.116.2':139
'89.#51.4.53':139
'89.##1.200.3':139
'89.##1.187.115':139
'89.##1.52.188':139
'89.##1.169.125':139
'89.##1.165.128':445
'89.##1.231.211':445
'89.##1.66.92':139
'89.##1.166.100':139
'89.##1.59.228':445
'89.##1.138.103':445
'89.##1.151.247':445
'89.##1.23.107':445
'89.##1.128.12':445
'89.##1.217.96':139
'89.##1.60.237':139
'89.##1.154.127':139
'89.##1.132.180':139
'89.##1.99.132':139
'89.##1.48.154':139
'89.##1.182.130':139
'89.##1.37.182':139
'89.##1.93.48':139
'89.##1.173.51':139
'89.##1.41.225':445
'89.##1.43.42':445
'89.##1.29.176':445
'89.##1.182.247':445
'89.##1.40.93':445
'89.#51.61.2':445
'89.##1.202.60':445
'89.##1.183.50':445
'89.##1.16.120':445
'89.##1.149.51':445
'89.##1.164.160':445
'89.##1.38.40':445
'89.##1.111.175':445
'89.##1.59.51':445
'89.##1.127.199':445
'89.##1.234.8':445
'89.##1.51.36':445
'89.##1.149.175':445
'89.##1.237.143':445
'89.##1.164.33':139
'89.##1.149.175':139
'89.##1.237.143':139
'89.##1.38.40':139
'89.##1.127.199':139
'89.##1.234.8':139
'89.##1.29.176':139
'89.##1.182.247':139
'89.##1.51.36':139
'89.##1.149.51':139
'89.##1.164.160':139
'89.##1.59.228':139
'89.##1.23.107':139
'89.##1.165.128':139
'89.##1.231.211':139
'89.##1.128.12':139
'89.##1.111.175':139
'89.##1.59.51':139
'89.##1.138.103':139
'89.##1.151.247':139
'89.##1.86.19':139
'89.##1.100.215':139
'89.##1.127.244':139
'89.##1.20.47':139
'89.##1.85.235':139
'89.##1.90.195':139
'89.##1.167.170':139
'89.##1.205.144':139
'89.##1.196.221':139
'89.##1.188.248':139
'89.##1.40.93':139
'89.##1.183.50':139
'89.##1.41.225':139
'89.##1.43.42':139
'89.##1.16.120':139
'89.##1.241.203':139
'89.##1.248.72':139
'89.#51.61.2':139
'89.##1.202.60':139
'89.##1.171.31':139
'89.##1.171.133':139
'89.##1.60.237':9988
'89.##1.154.127':9988
'89.##1.64.55':139
'89.##1.132.242':139
'89.##1.247.109':139
'89.##1.167.100':139
'89.##1.143.97':139
'89.##1.164.33':9988
'89.##1.43.42':9988
'89.##1.16.120':9988
'89.##1.182.247':9988
'89.##1.41.225':9988
'89.#51.61.2':9988
'89.##1.127.244':9988
'89.##1.205.144':9988
'89.##1.248.72':9988
'89.##1.188.248':9988
'89.##1.91.44':139
'89.##1.3.126':139
'89.#51.57.9':139
'89.##1.123.238':139
'89.##1.172.152':139
'89.##1.67.187':139
'89.##1.46.77':139
'89.##1.55.173':139
'89.##1.187.55':139
'89.##1.129.211':139
'89.##1.125.238':139
'89.##1.197.126':139
'89.##1.153.101':139
'89.##1.242.89':139
'89.##1.189.197':139
'89.##1.39.226':139
'89.##1.63.135':139
'89.##1.156.204':139
'89.##1.177.242':139
'89.##1.149.51':9988
'89.##1.164.33':445
'89.##1.132.180':445
'89.##1.90.195':445
'89.##1.167.170':445
'89.##1.99.132':445
'89.##1.48.154':445
'89.##1.93.48':445
'89.##1.60.237':445
'89.##1.154.127':445
'89.##1.196.221':445
'89.##1.188.248':445
'89.##1.127.244':445
'89.##1.241.203':445
'89.##1.248.72':445
'89.##1.20.47':445
'89.##1.85.235':445
'89.##1.205.144':445
'89.##1.86.19':445
'89.##1.100.215':445
'89.##1.111.175':9988
'89.##1.59.51':9988
'89.##1.138.103':9988
'89.##1.151.247':9988
'89.##1.164.160':9988
'89.##1.149.175':9988
'89.##1.234.8':9988
'89.##1.38.40':9988
'89.##1.127.199':9988
'89.##1.128.12':9988
'89.##1.37.182':445
'89.##1.217.96':445
'89.##1.173.51':445
'89.##1.182.130':445
'89.##1.66.92':445
'89.##1.23.107':9988
'89.##1.165.128':9988
'89.##1.166.100':445
'89.##1.231.211':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней