Trojan.DownLoader12.29118

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER3f16.dir00\svchost.exe.mdmp 16325836412032100

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER3f16.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'21#.#18.86.47':139
'21#.#18.85.28':139
'21#.#18.75.167':139
'21#.#18.16.163':139
'21#.#18.90.243':139
'21#.#18.243.85':139
'21#.#18.222.55':139
'21#.#18.67.17':139
'21#.#18.138.246':139
'21#.#18.91.15':139
'21#.#18.55.237':139
'21#.#18.80.113':139
'21#.#18.16.181':139
'21#.#18.97.157':139
'21#.#18.230.174':139
'21#.#18.81.248':139
'21#.#18.72.240':139
'21#.#18.235.92':139
'21#.#18.18.98':139
'21#.#18.127.218':139
'21#.#18.80.164':139
'21#.#18.9.249':139
'21#.#18.128.35':139
'21#.#18.218.114':139
'21#.#18.115.1':139
'21#.#18.81.229':139
'21#.#18.7.34':139
'21#.#18.107.92':139
'21#.#18.197.102':139
'21#.#18.203.91':139
'21#.#18.146.245':139
'21#.#18.149.28':139
'21#.#18.154.225':139
'21#.#18.121.0':9988
'21#.#18.32.186':9988
'21#.#18.128.155':9988
'21#.#18.85.226':139
'21#.#18.214.147':139
'21#.#18.83.7':139
'21#.#18.176.200':139
'21#.#18.246.145':139
'21#.#18.67.63':139
'21#.#18.15.216':139
'21#.#18.1.207':139
'21#.#18.39.143':139
'21#.#18.13.6':139
'21#.#18.93.4':139
'21#.#18.156.164':139
'21#.#18.117.143':139
'21#.#18.127.176':139
'21#.#18.19.37':139
'21#.#18.185.117':139
'21#.#18.83.46':139
'21#.#18.90.243':445
'21#.#18.243.85':445
'21#.#18.86.47':445
'21#.#18.9.249':445
'21#.#18.128.35':445
'21#.#18.16.163':445
'21#.#18.85.28':445
'21#.#18.80.113':445
'21#.#18.16.181':445
'21#.#18.67.17':445
'21#.#18.75.167':445
'21#.#18.222.55':445
'21#.#18.55.237':445
'21#.#18.235.92':445
'21#.#18.18.98':445
'21#.#18.97.157':445
'21#.#18.92.146':445
'21#.#18.83.46':445
'21#.#18.72.240':445
'21#.#18.230.174':445
'21#.#18.115.1':445
'21#.#18.81.229':445
'21#.#18.80.164':445
'21#.#18.81.248':445
'21#.#18.127.218':445
'21#.#18.218.114':445
'21#.#18.146.245':445
'21#.#18.149.28':445
'21#.#18.7.34':445
'21#.#18.156.164':445
'21#.#18.117.143':445
'21#.#18.203.91':445
'21#.#18.107.92':445
'21#.#18.214.147':445
'21#.#18.83.7':445
'21#.#18.92.146':139
'21#.#18.197.102':445
'21#.#18.154.225':445
'21#.#18.85.226':445
'21#.#18.1.207':445
'21#.#18.39.143':445
'21#.#18.176.200':445
'21#.#18.138.246':445
'21#.#18.91.15':445
'21#.#18.15.216':445
'21#.#18.246.145':445
'21#.#18.19.37':445
'21#.#18.185.117':445
'21#.#18.93.4':445
'21#.#18.67.63':445
'21#.#18.13.6':445
'21#.#18.127.176':445
'21#.#18.126.32':139
'21#.#18.13.43':139
'21#.#18.45.144':139
'21#.#18.35.173':139
'21#.#18.36.14':139
'21#.#18.209.124':139
'21#.#18.30.122':139
'21#.#18.184.11':139
'21#.#18.15.99':139
'21#.#18.124.170':139
'21#.#18.238.4':139
'21#.#18.65.37':139
'21#.#18.12.158':139
'21#.#18.121.0':139
'21#.#18.166.199':139
'21#.#18.103.30':139
'21#.#18.178.205':445
'21#.#18.144.30':139
'21#.#18.72.3':139
'21#.#18.107.20':139
'21#.#18.98.25':139
'21#.#18.180.107':139
'21#.#18.193.191':139
'21#.#18.186.94':139
'21#.#18.123.67':139
'21#.#18.178.140':139
'21#.#18.182.135':139
'21#.#18.195.94':139
'21#.#18.152.185':139
'21#.#18.142.160':139
'21#.#18.59.198':139
'21#.#18.53.162':139
'21#.#18.32.186':139
'21#.#18.128.155':139
'21#.#18.41.142':139
'21#.#18.192.206':139
'21#.#18.205.237':139
'21#.#18.178.205':139
'21#.#18.53.163':139
'21#.#18.97.175':139
'21#.#18.0.248':139
'21#.#18.248.56':139
'21#.#18.167.125':139
'21#.#18.171.219':139
'21#.#18.191.239':139
'21#.#18.60.68':139
'21#.#18.60.52':139
'21#.#18.187.129':139
'21#.#18.173.62':139
'21#.#18.89.22':139
'21#.#18.185.59':139
'21#.#18.59.60':139
'21#.#18.192.206':445
'21#.#18.209.124':445
'21#.#18.36.14':445
'21#.#18.126.32':445
'21#.#18.180.107':445
'21#.#18.35.173':445
'21#.#18.193.191':445
'21#.#18.13.43':445
'21#.#18.65.37':445
'21#.#18.12.158':445
'21#.#18.184.11':445
'21#.#18.45.144':445
'21#.#18.30.122':445
'21#.#18.238.4':445
'21#.#18.144.30':445
'21#.#18.121.0':445
'21#.#18.72.3':445
'21#.#18.59.60':9988
'21#.#18.0.248':9988
'21#.#18.53.163':9988
'21#.#18.166.199':445
'21#.#18.123.67':445
'21#.#18.178.140':445
'21#.#18.98.25':445
'21#.#18.103.30':445
'21#.#18.186.94':445
'21#.#18.107.20':445
'21#.#18.59.198':445
'21#.#18.53.162':445
'21#.#18.182.135':445
'21#.#18.187.129':445
'21#.#18.173.62':445
'21#.#18.142.160':445
'21#.#18.195.94':445
'21#.#18.128.155':445
'21#.#18.205.237':445
'21#.#18.53.163':445
'21#.#18.152.185':445
'21#.#18.41.142':445
'21#.#18.32.186':445
'21#.#18.171.219':445
'21#.#18.191.239':445
'21#.#18.97.175':445
'21#.#18.15.99':445
'21#.#18.124.170':445
'21#.#18.167.125':445
'21#.#18.0.248':445
'21#.#18.185.59':445
'21#.#18.59.60':445
'21#.#18.60.52':445
'21#.#18.248.56':445
'21#.#18.60.68':445
'21#.#18.89.22':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней