Trojan.DownLoader12.29246

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERb14d.dir00\svchost.exe.mdmp 16325836412030016

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WERb14d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'22#.#33.22.240':9988
'22#.#33.131.123':9988
'22#.#33.5.89':9988
'22#.#33.109.83':9988
'22#.#33.12.131':9988
'22#.#33.111.19':9988
'22#.#33.46.229':9988
'22#.#33.21.22':9988
'22#.#33.3.162':9988
'22#.#33.133.82':9988
'22#.#33.221.176':9988
'22#.#33.41.241':9988
'22#.#33.76.120':9988
'22#.#33.151.86':9988
'22#.#33.6.207':9988
'22#.#33.58.38':9988
'22#.#33.190.121':9988
'22#.#33.59.35':9988
'22#.#33.16.156':9988
'22#.#33.209.162':9988
'22#.#33.221.28':9988
'22#.#33.22.243':9988
'22#.#33.245.157':9988
'22#.#33.28.238':9988
'22#.#33.130.150':9988
'22#.#33.109.83':445
'22#.#33.57.170':9988
'22#.#33.221.22':9988
'22#.#33.82.54':9988
'22#.#33.190.121':445
'22#.#33.6.207':445
'22#.#33.246.135':445
'22#.#33.79.148':445
'22#.#33.76.120':445
'22#.#33.151.86':445
'22#.#33.121.248':9988
'22#.#33.179.102':9988
'22#.#33.202.223':9988
'22#.#33.177.53':9988
'22#.#33.71.226':9988
'22#.#33.113.65':9988
'22#.#33.92.151':9988
'22#.#33.73.109':9988
'22#.#33.151.209':9988
'22#.#33.79.170':9988
'22#.#33.249.39':9988
'22#.#33.94.145':9988
'22#.#33.128.144':139
'22#.#33.231.112':139
'22#.#33.35.216':139
'22#.#33.28.167':139
'22#.#33.60.219':139
'22#.#33.247.196':139
'22#.#33.29.172':139
'22#.#33.115.150':139
'22#.#33.169.134':139
'22#.#33.152.239':139
'22#.#33.126.53':139
'22#.#33.58.152':139
'22#.#33.197.121':139
'22#.#33.24.118':139
'22#.#33.20.231':139
'22#.#33.1.10':139
'22#.#33.91.5':139
'22#.#33.23.158':139
'22#.#33.253.178':139
'22#.#33.188.157':139
'22#.#33.191.76':139
'22#.#33.30.77':139
'22#.#33.30.43':139
'22#.#33.19.28':139
'22#.#33.41.14':9988
'22#.#33.140.28':9988
'22#.#33.105.114':9988
'22#.#33.229.129':9988
'22#.#33.86.110':9988
'22#.#33.216.178':9988
'22#.#33.79.148':9988
'22#.#33.86.168':9988
'22#.#33.246.135':9988
'22#.#33.225.228':9988
'22#.#33.74.41':9988
'22#.#33.230.120':139
'22#.#33.177.29':139
'22#.#33.110.111':139
'22#.#33.126.41':139
'22#.#33.65.149':139
'22#.#33.135.173':139
'22#.#33.19.85':139
'22#.#33.28.140':139
'22#.#33.183.11':139
'22#.#33.186.27':139
'22#.#33.19.52':139
'22#.#33.86.186':139
'22#.#33.12.131':445
'22#.#33.229.129':139
'22#.#33.130.150':139
'22#.#33.46.229':139
'22#.#33.111.19':139
'22#.#33.131.123':139
'22#.#33.5.89':139
'22#.#33.59.35':139
'22#.#33.16.156':139
'22#.#33.94.145':139
'22#.#33.86.110':139
'22#.#33.71.226':139
'22#.#33.22.243':139
'22#.#33.12.131':139
'22#.#33.221.28':139
'22#.#33.246.135':139
'22#.#33.79.148':139
'22#.#33.6.207':139
'22#.#33.58.38':139
'22#.#33.105.114':139
'22#.#33.221.176':139
'22#.#33.22.240':139
'22#.#33.41.241':139
'22#.#33.3.162':139
'22#.#33.140.28':139
'22#.#33.82.54':139
'22#.#33.225.228':139
'22#.#33.41.14':139
'22#.#33.79.170':139
'22#.#33.73.109':139
'22#.#33.121.248':139
'22#.#33.57.170':139
'22#.#33.177.53':139
'22#.#33.249.39':139
'22#.#33.202.223':139
'22#.#33.216.178':139
'22#.#33.86.168':139
'22#.#33.245.157':139
'22#.#33.113.65':139
'22#.#33.74.41':139
'22#.#33.179.102':139
'22#.#33.21.22':139
'22#.#33.92.151':139
'22#.#33.133.82':139
'22#.#33.28.238':139
'22#.#33.221.22':139
'22#.#33.151.209':139
'22#.#33.209.162':139
'22#.#33.71.226':445
'22#.#33.94.145':445
'22#.#33.5.89':445
'22#.#33.130.150':445
'22#.#33.86.110':445
'22#.#33.59.35':445
'22#.#33.21.22':445
'22#.#33.74.41':445
'22#.#33.179.102':445
'22#.#33.16.156':445
'22#.#33.140.28':445
'22#.#33.229.129':445
'22#.#33.3.162':445
'22#.#33.22.240':445
'22#.#33.41.241':445
'22#.#33.221.28':445
'22#.#33.58.38':445
'22#.#33.105.114':445
'22#.#33.131.123':445
'22#.#33.46.229':445
'22#.#33.111.19':445
'22#.#33.221.176':445
'22#.#33.22.243':445
'22#.#33.245.157':445
'22#.#33.82.54':445
'22#.#33.225.228':445
'22#.#33.202.223':445
'22#.#33.249.39':445
'22#.#33.121.248':445
'22#.#33.177.53':445
'22#.#33.76.120':139
'22#.#33.151.86':139
'22#.#33.190.121':139
'22#.#33.216.178':445
'22#.#33.109.83':139
'22#.#33.57.170':445
'22#.#33.209.162':445
'22#.#33.221.22':445
'22#.#33.151.209':445
'22#.#33.113.65':445
'22#.#33.92.151':445
'22#.#33.133.82':445
'22#.#33.73.109':445
'22#.#33.41.14':445
'22#.#33.79.170':445
'22#.#33.28.238':445
'22#.#33.86.168':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней