Trojan.DownLoader12.29243

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'61.##.189.28':445
'61.##.245.49':445
'61.##.58.219':445
'61.##.131.173':445
'61.##.197.83':445
'61.##.156.250':445
'61.##.229.212':445
'61.##.38.174':445
'61.##.157.40':445
'61.##.239.17':139
'61.##.116.152':139
'61.#8.56.82':139
'61.##.124.169':139
'61.##.217.13':139
'61.#8.3.242':139
'61.##.218.248':445
'61.##.147.175':139
'61.##.12.157':139
'61.##.231.33':445
'61.##.169.175':445
'61.##.126.114':445
'61.##.89.127':445
'61.#8.42.77':445
'61.##.112.194':445
'61.#8.42.45':445
'61.##.71.251':445
'61.##.53.206':445
'61.##.88.122':445
'61.#8.46.71':445
'61.##.241.161':445
'61.##.72.154':445
'61.##.54.214':445
'61.##.98.161':445
'61.##.113.209':445
'61.##.128.10':445
'61.##.204.199':445
'61.##.159.123':139
'61.##.72.154':139
'61.##.88.122':139
'61.##.229.212':139
'61.##.241.161':139
'61.#8.46.71':139
'61.##.204.199':139
'61.##.98.161':139
'61.##.54.214':139
'61.##.128.10':139
'61.##.131.173':139
'61.##.189.28':139
'61.##.218.248':139
'61.##.58.219':139
'61.##.245.49':139
'61.##.157.40':139
'61.##.156.250':139
'61.##.197.83':139
'61.##.38.174':139
'61.##.162.152':139
'61.##.235.19':139
'61.#8.42.45':139
'61.##.58.250':139
'61.#8.4.234':139
'61.##.81.161':139
'61.##.29.124':139
'61.##.152.92':139
'61.##.140.152':139
'61.##.89.127':139
'61.##.231.33':139
'61.##.113.209':139
'61.##.126.114':139
'61.##.169.175':139
'61.##.53.206':139
'61.##.112.194':139
'61.#8.42.77':139
'61.##.71.251':139
'61.##.58.250':445
'61.##.91.248':139
'61.##.218.78':139
'61.##.54.245':139
'61.#8.77.47':139
'61.##.97.241':139
'61.##.71.196':139
'61.##.193.196':139
'61.#8.81.55':139
'61.#8.38.9':139
'61.##.223.120':139
'61.##.242.168':139
'61.##.148.58':139
'61.#8.1.70':139
'61.##.102.163':139
'61.##.152.79':139
'61.##.24.152':139
'61.##.164.76':139
'61.#8.16.53':139
'61.##.190.198':139
'61.##.246.217':139
'61.##.44.240':139
'61.##.248.235':139
'61.#8.67.38':139
'61.#8.3.21':139
'61.#8.36.2':139
'61.##.179.47':139
'61.##.21.179':139
'61.##.54.174':139
'61.#8.69.63':139
'61.##.208.237':139
'61.##.174.102':139
'61.#8.31.19':139
'61.#8.4.121':139
'61.##.72.117':139
'61.##.156.106':139
'61.##.107.209':139
'61.##.58.203':139
'61.##.116.152':445
'61.##.217.13':445
'61.##.124.169':445
'61.##.239.17':445
'61.##.147.175':445
'61.##.243.57':139
'61.##.185.243':139
'61.##.12.157':445
'61.#8.3.242':445
'61.#8.4.234':445
'61.##.152.92':445
'61.##.162.152':445
'61.##.235.19':445
'61.##.140.152':445
'61.##.159.123':445
'61.#8.56.82':445
'61.##.81.161':445
'61.##.29.124':445
'61.##.196.254':139
'61.##.142.145':139
'61.##.111.33':445
'61.#8.179.6':139
'61.##.187.224':139
'61.#8.42.49':139
'61.#8.5.217':139
'61.##.151.207':139
'61.#8.27.11':139
'61.##.130.70':139
'61.##.111.33':139
'61.##.89.186':139
'61.##.41.138':139
'61.##.243.57':445
'61.##.41.138':445
'61.##.130.70':445
'61.##.185.243':445
'61.##.89.186':445
'61.##.21.129':139
'61.##.203.127':139
'61.##.34.215':139
'61.##.181.186':139
'61.##.60.227':139
'61.##.95.129':445
'61.##.22.161':445
'61.#8.97.39':445
'61.##.127.16':445
'61.#8.1.172':139
'61.##.227.155':139
'61.##.246.139':139
'61.##.17.247':139
'61.#8.9.42':139
'61.##.37.243':139
'61.##.99.145':139
'61.#8.24.58':139
'61.##.198.152':139
'61.#8.26.61':445
'61.##.149.249':445
'61.##.145.54':445
'61.#8.49.2':445
'61.#8.79.4':445
'61.##.250.98':445
'61.##.80.103':445
'61.##.229.44':445
'61.#8.95.10':445
'61.##.19.180':445
'61.##.55.254':445
'61.#8.53.45':445
'61.##.32.229':445
'61.#8.32.56':445
'61.#8.5.249':445
'61.##.54.119':445
'61.##.160.17':445
'61.##.24.100':445
'61.##.62.142':139
'61.#8.5.249':139
'61.##.54.119':139
'61.##.160.17':139
'61.##.24.100':139
'61.##.145.54':139
'61.##.149.249':139
'61.#8.79.4':139
'61.#8.49.2':139
'61.#8.26.61':139
'61.##.95.129':139
'61.##.22.161':139
'61.#8.97.39':139
'61.##.127.16':139
'61.#8.53.45':139
'61.##.55.254':139
'61.#8.32.56':139
'61.##.32.229':139
'61.##.19.180':139
'61.##.19.162':139
'61.#8.32.86':139
'61.##.127.102':139
'61.##.211.126':139
'61.##.128.38':139
'61.##.25.190':139
'61.##.209.161':139
'61.#8.12.12':139
'61.##.101.70':139
'61.##.250.98':139
'61.##.80.103':139
'61.##.229.44':139
'61.#8.95.10':139
'61.##.137.106':139
'61.##.83.150':139
'61.##.102.83':139
'61.##.34.111':139
'61.##.150.84':139
'61.##.137.106':445
'61.##.142.93':139
'61.##.115.236':139
'61.#8.79.4':9988
'61.##.121.49':139
'61.##.154.115':139
'61.##.214.140':139
'61.##.121.49':445
'61.#8.8.118':139
'61.##.158.136':139
'61.##.34.111':9988
'61.##.250.98':9988
'61.##.22.161':9988
'61.#8.49.2':9988
'61.#8.26.61':9988
'61.##.83.150':9988
'61.#8.95.10':9988
'61.#8.32.56':9988
'61.##.127.16':9988
'61.##.249.77':139
'61.##.99.214':445
'61.##.140.26':139
'61.##.78.124':139
'61.#8.2.164':445
'61.##.78.124':445
'61.##.249.77':445
'61.##.26.251':445
'61.##.140.26':445
'61.##.115.236':445
'61.#8.8.118':445
'61.##.142.93':445
'61.##.154.115':445
'61.##.158.136':445
'61.#8.2.164':139
'61.##.26.251':139
'61.##.214.140':445
'61.##.99.214':139
'61.##.150.84':9988
'61.##.25.190':445
'61.##.209.161':445
'61.#8.12.12':445
'61.##.101.70':445
'61.##.62.142':445
'61.#8.1.172':445
'61.##.227.155':445
'61.##.246.139':445
'61.##.17.247':445
'61.##.83.150':445
'61.##.102.83':445
'61.##.34.111':445
'61.##.150.84':445
'61.##.127.102':445
'61.#8.32.86':445
'61.##.128.38':445
'61.##.211.126':445
'61.##.19.162':445
'61.##.32.229':9988
'61.#8.5.249':9988
'61.##.60.227':445
'61.##.160.17':9988
'61.##.95.129':9988
'61.##.145.54':9988
'61.##.24.100':9988
'61.#8.97.39':9988
'61.##.102.83':9988
'61.##.198.152':445
'61.##.37.243':445
'61.#8.9.42':445
'61.#8.24.58':445
'61.##.99.145':445
'61.##.21.129':445
'61.##.203.127':445
'61.##.34.215':445
'61.##.181.186':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней