Trojan.DownLoader12.29072

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'64.##.216.105':139
'64.#6.91.52':139
'64.#6.14.15':139
'64.##.65.157':139
'64.##.134.31':139
'64.##.96.177':139
'64.#6.95.57':139
'64.#6.76.95':139
'64.#6.57.44':139
'64.##.66.119':139
'64.##.181.194':139
'64.##.154.155':139
'64.##.27.101':139
'64.#6.49.81':139
'64.#6.16.8':139
'64.##.30.153':139
'64.##.240.118':139
'64.##.34.137':139
'64.##.97.200':139
'64.##.17.217':139
'64.##.56.239':139
'64.##.162.34':139
'64.#6.29.54':139
'64.##.133.104':445
'64.#6.57.30':445
'64.##.113.17':445
'64.##.71.245':139
'64.##.52.184':139
'64.##.247.169':445
'64.##.38.106':445
'64.##.208.245':445
'64.##.218.161':445
'64.##.141.182':445
'64.#6.35.29':445
'64.##.129.62':139
'64.##.35.182':139
'64.##.185.139':139
'64.##.30.166':139
'64.#6.9.79':139
'64.##.214.87':139
'64.##.221.185':139
'64.##.247.161':139
'64.##.214.142':139
'64.#6.95.61':139
'64.##.228.165':139
'64.##.61.151':139
'64.#6.84.16':139
'64.##.154.186':445
'64.##.252.147':445
'64.##.186.223':445
'64.##.72.248':445
'64.##.164.147':445
'64.##.98.192':445
'64.##.29.117':445
'64.##.116.19':445
'64.##.175.70':445
'64.#6.69.65':445
'64.##.69.252':445
'64.##.44.215':445
'64.##.229.113':445
'64.##.103.22':445
'64.##.225.97':445
'64.##.54.172':445
'64.##.97.151':445
'64.##.27.103':445
'64.##.92.106':445
'64.#6.96.73':445
'64.##.50.204':445
'64.#6.65.31':445
'64.##.204.159':445
'64.#6.35.29':139
'64.##.218.161':139
'64.##.141.182':139
'64.#6.57.30':139
'64.##.247.169':139
'64.##.38.106':139
'64.##.105.93':139
'64.##.194.183':139
'64.#6.60.3':139
'64.##.208.245':139
'64.##.11.218':139
'64.##.133.104':139
'64.#6.21.19':445
'64.##.129.48':445
'64.##.36.134':445
'64.##.52.193':445
'64.##.90.101':445
'64.##.163.194':445
'64.#6.69.83':445
'64.##.113.17':139
'64.##.140.47':445
'64.##.223.106':445
'64.##.165.58':445
'64.#6.34.49':139
'64.#6.85.96':139
'64.#6.29.20':139
'64.##.158.17':139
'64.##.83.218':139
'64.##.140.171':139
'64.#6.94.49':139
'64.##.121.93':139
'64.##.238.90':139
'64.##.142.92':139
'64.##.66.142':139
'64.##.62.101':139
'64.##.171.122':139
'64.##.126.63':139
'64.#6.3.228':139
'64.##.173.97':139
'64.##.246.124':139
'64.#6.76.93':139
'64.##.17.164':139
'64.##.221.106':139
'64.##.164.171':139
'64.#6.8.178':139
'64.##.159.91':139
'64.##.76.253':139
'64.##.182.156':139
'64.##.163.180':139
'64.#6.238.9':139
'64.##.73.254':139
'64.##.46.125':139
'64.##.90.133':139
'64.##.169.79':139
'64.##.198.214':139
'64.##.120.124':139
'64.##.215.99':139
'64.##.103.161':139
'64.##.108.78':139
'64.#6.58.32':139
'64.##.96.253':139
'64.##.168.121':139
'64.#6.49.69':139
'64.#6.2.138':139
'64.##.51.194':139
'64.##.207.41':139
'64.#6.24.46':139
'64.#6.63.92':139
'64.##.121.151':139
'64.##.98.139':139
'64.##.17.217':445
'64.##.154.155':445
'64.##.97.200':445
'64.#6.29.54':445
'64.##.56.239':445
'64.##.65.157':445
'64.#6.91.52':445
'64.##.96.177':445
'64.##.216.105':445
'64.##.134.31':445
'64.#6.14.15':445
'64.##.162.34':445
'64.##.194.183':445
'64.#6.84.16':445
'64.##.105.93':445
'64.##.11.218':445
'64.#6.60.3':445
'64.##.30.153':445
'64.#6.49.81':445
'64.##.34.137':445
'64.##.27.101':445
'64.##.240.118':445
'64.#6.16.8':445
'64.##.214.142':445
'64.##.129.62':445
'64.##.247.161':445
'64.##.61.151':445
'64.#6.95.61':445
'64.##.71.245':445
'64.##.68.149':139
'64.##.36.117':139
'64.##.243.59':139
'64.##.52.184':445
'64.##.134.229':139
'64.##.228.165':445
'64.#6.95.57':445
'64.#6.76.95':445
'64.#6.57.44':445
'64.##.66.119':445
'64.##.181.194':445
'64.#6.9.79':445
'64.##.185.139':445
'64.##.221.185':445
'64.##.35.182':445
'64.##.214.87':445
'64.##.30.166':445
'64.##.235.118':445
'64.##.45.233':445
'64.##.110.251':445
'64.##.74.213':445
'64.#6.8.215':445
'64.##.139.126':445
'64.##.179.145':445
'64.#6.21.24':445
'64.##.207.65':445
'64.##.134.139':445
'64.##.200.134':445
'64.#6.2.71':445
'64.##.132.209':139
'64.##.136.198':445
'64.##.158.162':139
'64.##.81.197':139
'64.##.103.126':139
'64.##.73.143':445
'64.##.180.188':445
'64.##.16.138':445
'64.##.198.171':445
'64.##.57.135':445
'64.##.245.211':445
'64.##.75.204':445
'64.##.209.89':445
'64.##.227.71':445
'64.#6.66.63':445
'64.##.144.109':445
'64.##.128.53':445
'64.#6.6.79':445
'64.#6.7.225':445
'64.##.151.27':445
'64.#6.72.52':445
'64.#6.35.89':445
'64.##.161.194':445
'64.##.160.193':445
'64.##.146.200':445
'64.#6.62.27':445
'64.##.126.119':445
'64.##.26.153':445
'64.##.86.251':445
'64.##.143.126':445
'64.##.173.92':445
'64.##.170.143':445
'64.#6.46.12':445
'64.##.127.46':445
'64.#6.21.37':139
'64.##.200.134':139
'64.##.207.65':139
'64.##.134.139':139
'64.##.45.233':139
'64.##.139.126':139
'64.##.179.145':139
'64.#6.62.27':139
'64.##.160.193':139
'64.##.26.153':139
'64.#6.21.24':139
'64.##.126.119':139
'64.##.235.118':139
'64.##.73.143':139
'64.##.57.135':139
'64.##.245.211':139
'64.##.136.198':139
'64.##.198.171':139
'64.##.180.188':139
'64.#6.8.215':139
'64.##.110.251':139
'64.##.74.213':139
'64.##.16.138':139
'64.#6.2.71':139
'64.#6.35.89':139
'64.##.151.27':139
'64.#6.72.52':139
'64.##.209.89':139
'64.##.128.53':139
'64.#6.6.79':139
'64.#6.36.83':139
'64.##.111.145':139
'64.#6.57.66':139
'64.#6.7.225':139
'64.##.39.168':139
'64.##.75.204':139
'64.##.127.46':139
'64.##.143.126':139
'64.#6.46.12':139
'64.##.146.200':139
'64.##.86.251':139
'64.##.170.143':139
'64.##.144.109':139
'64.##.227.71':139
'64.#6.66.63':139
'64.##.173.92':139
'64.##.161.194':139
'64.##.175.70':139
'64.##.29.117':139
'64.##.69.252':139
'64.##.98.192':139
'64.#6.69.65':139
'64.##.116.19':139
'64.#6.21.19':139
'64.##.129.48':139
'64.##.36.134':139
'64.##.52.193':139
'64.##.90.101':139
'64.##.252.147':139
'64.##.50.204':139
'64.##.92.106':139
'64.##.204.159':139
'64.##.27.103':139
'64.#6.65.31':139
'64.#6.96.73':139
'64.##.186.223':139
'64.##.154.186':139
'64.##.164.147':139
'64.##.44.215':139
'64.##.72.248':139
'64.##.81.149':445
'64.#6.3.109':445
'64.##.179.124':445
'64.#6.1.76':445
'64.##.217.55':445
'64.#6.178.2':445
'64.##.36.237':445
'64.##.252.24':445
'64.##.28.221':445
'64.##.121.240':445
'64.##.68.140':445
'64.##.243.66':445
'64.##.140.47':139
'64.#6.69.83':139
'64.##.165.58':139
'64.##.163.194':139
'64.##.223.106':139
'64.#6.44.6':445
'64.##.188.17':445
'64.##.66.104':445
'64.##.67.101':445
'64.##.238.185':445
'64.##.101.238':445
'64.##.103.22':139
'64.##.146.200':9988
'64.##.143.126':9988
'64.##.26.153':9988
'64.##.45.233':9988
'64.##.134.139':9988
'64.#6.35.89':9988
'64.##.103.126':9988
'64.##.158.162':9988
'64.#6.21.37':9988
'64.#6.6.79':9988
'64.##.39.168':9988
'64.##.180.188':9988
'64.##.111.145':445
'64.#6.21.37':445
'64.#6.36.83':445
'64.##.39.168':445
'64.#6.57.66':445
'64.##.81.197':445
'64.##.136.198':9988
'64.##.245.211':9988
'64.##.132.209':445
'64.##.103.126':445
'64.##.158.162':445
'64.##.68.140':139
'64.##.28.221':139
'64.##.121.240':139
'64.#6.3.109':139
'64.#6.178.2':139
'64.##.36.237':139
'64.##.225.97':139
'64.##.229.113':139
'64.##.97.151':139
'64.##.252.24':139
'64.##.54.172':139
'64.##.81.149':139
'64.##.101.238':139
'64.##.67.101':139
'64.##.238.185':139
'64.##.132.209':9988
'64.#6.44.6':139
'64.##.188.17':139
'64.##.217.55':139
'64.##.179.124':139
'64.#6.1.76':139
'64.##.66.104':139
'64.##.243.66':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней