Trojan.DownLoader12.29233

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERc711.dir00\svchost.exe.mdmp 16325836412028944

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'69.##.25.226':445
'69.##.209.15':445
'69.##.103.199':445
'69.##.190.111':445
'69.##.240.41':445
'69.##.178.74':445
'69.#0.98.37':445
'69.##.81.239':445
'69.##.136.81':445
'69.##.80.162':445
'69.##.79.240':445
'69.##.54.145':445
'69.##.54.189':445
'69.#0.6.55':445
'69.##.122.117':445
'69.##.142.38':445
'69.##.202.59':445
'69.##.86.122':445
'69.##.98.121':445
'69.##.224.189':139
'69.##.69.218':139
'69.#0.4.192':139
'69.#0.47.32':139
'69.##.234.254':139
'69.#0.89.89':139
'69.##.194.162':139
'69.#0.17.8':139
'69.##.168.138':139
'69.##.182.193':445
'69.##.235.209':445
'69.##.125.149':445
'69.#0.48.16':445
'69.##.211.110':445
'69.##.154.99':445
'69.##.108.196':445
'69.##.192.112':445
'69.##.243.57':445
'69.##.77.103':445
'69.##.77.103':139
'69.##.108.196':139
'69.##.125.149':139
'69.##.154.99':139
'69.##.182.193':139
'69.##.17.244':445
'69.##.211.135':445
'69.##.192.112':139
'69.##.244.128':445
'69.##.243.57':139
'69.##.81.239':139
'69.##.136.81':139
'69.##.209.15':139
'69.##.240.41':139
'69.##.178.74':139
'69.##.211.110':139
'69.##.235.209':139
'69.#0.98.37':139
'69.#0.48.16':139
'69.#0.0.186':445
'69.##.142.221':445
'69.#0.54.1':445
'69.##.17.240':445
'69.##.210.131':445
'69.##.47.191':445
'69.##.222.65':445
'69.##.18.211':445
'69.#0.82.70':445
'69.##.253.84':445
'69.##.58.209':445
'69.##.175.222':445
'69.##.215.70':445
'69.##.197.84':445
'69.##.85.251':445
'69.#0.18.12':445
'69.#0.85.18':445
'69.##.202.241':445
'69.##.23.230':445
'69.##.194.162':445
'69.##.12.109':445
'69.##.168.138':445
'69.#0.89.89':445
'69.##.234.31':445
'69.##.47.137':445
'69.##.133.23':445
'69.##.220.233':445
'69.##.69.221':445
'69.#0.17.8':445
'69.##.252.23':139
'69.##.180.236':139
'69.##.200.246':139
'69.#0.34.66':139
'69.#0.4.192':445
'69.##.69.218':445
'69.##.234.254':445
'69.#0.47.32':445
'69.##.224.189':445
'69.#0.11.81':445
'69.##.25.177':445
'69.##.27.158':445
'69.##.133.47':445
'69.#0.89.8':445
'69.#0.61.11':445
'69.##.162.160':445
'69.##.121.59':445
'69.#0.30.59':445
'69.##.158.163':445
'69.##.144.253':445
'69.##.18.145':445
'69.##.147.223':445
'69.##.207.145':445
'69.#0.28.48':445
'69.##.64.183':445
'69.#0.32.44':445
'69.##.130.60':445
'69.#0.96.28':445
'69.#0.96.28':139
'69.##.64.183':139
'69.#0.28.48':139
'69.##.130.60':139
'69.#0.32.44':139
'69.##.133.47':139
'69.#0.11.81':139
'69.##.158.163':139
'69.##.27.158':139
'69.##.18.145':139
'69.##.220.233':139
'69.##.69.221':139
'69.##.12.109':139
'69.##.234.31':139
'69.##.47.137':139
'69.##.207.145':139
'69.##.144.253':139
'69.##.133.23':139
'69.##.147.223':139
'69.#0.75.99':139
'69.#0.33.38':139
'69.##.12.146':139
'69.##.234.176':139
'69.##.153.29':139
'69.#0.112.4':139
'69.#0.21.93':139
'69.##.208.250':139
'69.##.18.154':139
'69.##.175.33':139
'69.#0.89.8':139
'69.#0.30.59':139
'69.##.25.177':139
'69.##.121.59':139
'69.#0.61.11':139
'69.#0.9.48':139
'69.##.109.250':139
'69.##.162.160':139
'69.##.101.139':139
'69.##.129.12':139
'69.##.176.173':445
'69.#0.40.67':139
'69.##.104.210':139
'69.##.124.145':445
'69.##.95.245':445
'69.#0.251.5':445
'69.#0.42.84':445
'69.##.155.250':445
'69.##.225.167':139
'69.#0.45.40':139
'69.##.123.111':139
'69.##.114.223':139
'69.##.187.114':139
'69.#0.40.80':139
'69.##.215.236':139
'69.##.131.32':139
'69.#0.8.207':139
'69.#0.129.2':139
'69.##.136.156':445
'69.##.53.110':445
'69.##.116.20':445
'69.##.71.200':445
'69.#0.97.84':445
'69.#0.1.27':445
'69.##.96.164':445
'69.##.175.172':445
'69.#0.74.71':445
'69.##.204.216':445
'69.##.225.234':445
'69.##.214.53':445
'69.#0.3.158':445
'69.#0.2.207':445
'69.##.49.137':445
'69.##.50.133':445
'69.#0.16.50':445
'69.##.115.231':445
'69.##.131.70':445
'69.##.131.70':139
'69.##.50.133':139
'69.##.49.137':139
'69.##.115.231':139
'69.#0.16.50':139
'69.##.71.200':139
'69.##.136.156':139
'69.##.204.216':139
'69.##.116.20':139
'69.##.214.53':139
'69.##.124.145':139
'69.#0.251.5':139
'69.##.155.250':139
'69.##.95.245':139
'69.#0.42.84':139
'69.#0.2.207':139
'69.##.225.234':139
'69.#0.3.158':139
'69.##.176.173':139
'69.##.216.161':139
'69.##.216.116':139
'69.##.13.190':139
'69.##.126.137':139
'69.#0.96.62':139
'69.#0.29.96':139
'69.##.223.85':139
'69.##.11.245':139
'69.##.155.139':139
'69.#0.36.61':139
'69.##.175.172':139
'69.#0.74.71':139
'69.##.53.110':139
'69.#0.97.84':139
'69.#0.1.27':139
'69.#0.83.41':139
'69.#0.253.3':139
'69.##.96.164':139
'69.#0.6.251':139
'69.##.202.241':139
'69.#0.18.12':139
'69.##.85.251':139
'69.##.23.230':139
'69.#0.85.18':139
'69.##.17.240':139
'69.#0.0.186':139
'69.##.253.84':139
'69.#0.54.1':139
'69.##.175.222':139
'69.##.129.12':9988
'69.##.244.128':139
'69.##.225.167':9988
'69.##.104.210':9988
'69.##.17.244':139
'69.##.197.84':139
'69.##.58.209':139
'69.##.211.135':139
'69.##.215.70':139
'69.##.98.121':139
'69.##.142.38':139
'69.##.122.117':139
'69.##.86.122':139
'69.##.202.59':139
'69.##.190.111':139
'69.##.25.226':139
'69.##.80.162':139
'69.##.103.199':139
'69.##.54.145':139
'69.##.47.191':139
'69.##.210.131':139
'69.#0.82.70':139
'69.##.142.221':139
'69.##.18.211':139
'69.#0.6.55':139
'69.##.79.240':139
'69.##.222.65':139
'69.##.54.189':139
'69.##.223.85':445
'69.##.114.223':445
'69.##.155.139':445
'69.#0.29.96':445
'69.##.187.114':445
'69.#0.40.80':445
'69.#0.8.207':445
'69.#0.45.40':445
'69.##.123.111':445
'69.##.11.245':445
'69.#0.253.3':445
'69.#0.36.61':445
'69.#0.6.251':445
'69.#0.83.41':445
'69.##.13.190':445
'69.##.216.116':445
'69.#0.96.62':445
'69.##.126.137':445
'69.##.216.161':445
'69.##.204.216':9988
'69.#0.42.84':9988
'69.##.116.20':9988
'69.#0.96.62':9988
'69.##.13.190':9988
'69.#0.40.80':9988
'69.##.131.32':9988
'69.#0.16.50':9988
'69.##.96.164':9988
'69.#0.1.27':9988
'69.##.131.32':445
'69.##.225.167':445
'69.#0.129.2':445
'69.##.215.236':445
'69.#0.40.67':445
'69.##.216.161':9988
'69.##.131.70':9988
'69.##.104.210':445
'69.##.129.12':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней