Trojan.DownLoader10.3411

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf80f.dir00\svchost.exe.mdmp 16325836412032548

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf80f.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'13#.#06.239.29':445
'13#.#06.207.184':445
'13#.#06.162.214':445
'13#.#06.80.169':445
'13#.#06.96.68':445
'13#.#06.1.194':445
'13#.#06.18.109':445
'13#.#06.212.178':445
'13#.#06.157.45':445
'13#.#06.232.125':445
'13#.#06.234.31':445
'13#.#06.0.132':445
'13#.#06.8.236':445
'13#.#06.9.205':445
'13#.#06.221.70':445
'13#.#06.177.69':445
'13#.#06.233.201':445
'13#.#06.229.52':445
'13#.#06.160.229':445
'13#.#06.20.239':445
'13#.#06.49.15':445
'13#.#06.128.186':445
'13#.#06.243.199':445
'13#.#06.8.177':445
'13#.#06.110.3':445
'13#.#06.42.136':445
'13#.#06.59.216':445
'13#.#06.218.59':445
'13#.#06.3.41':445
'13#.#06.53.227':445
'13#.#06.86.187':445
'13#.#06.5.59':445
'13#.#06.218.218':445
'13#.#06.10.216':445
'13#.#06.72.86':445
'13#.#06.49.15':139
'13#.#06.229.52':139
'13#.#06.42.136':139
'13#.#06.20.239':139
'13#.#06.110.3':139
'13#.#06.128.186':139
'13#.#06.160.229':139
'13#.#06.8.177':139
'13#.#06.5.59':139
'13#.#06.53.227':139
'13#.#06.59.216':139
'13#.#06.1.194':139
'13#.#06.3.41':139
'13#.#06.10.216':139
'13#.#06.86.187':139
'13#.#06.218.59':139
'13#.#06.218.218':139
'13#.#06.246.47':445
'13#.#06.26.182':445
'13#.#06.245.126':445
'13#.#06.154.245':445
'13#.#06.126.135':445
'13#.#06.195.202':445
'13#.#06.39.66':445
'13#.#06.92.86':445
'13#.#06.8.151':139
'13#.#06.112.233':139
'13#.#06.171.128':139
'13#.#06.243.199':139
'13#.#06.233.161':139
'13#.#06.163.8':139
'13#.#06.117.162':139
'13#.#06.153.68':139
'13#.#06.30.5':139
'13#.#06.55.176':139
'13#.#06.179.36':139
'13#.#06.49.185':139
'13#.#06.46.175':139
'13#.#06.227.84':139
'13#.#06.219.162':139
'13#.#06.250.178':139
'13#.#06.38.127':139
'13#.#06.155.176':139
'13#.#06.30.233':139
'13#.#06.69.211':139
'13#.#06.126.54':139
'13#.#06.134.126':139
'13#.#06.252.202':139
'13#.#06.35.139':139
'13#.#06.71.69':139
'13#.#06.25.169':139
'13#.#06.65.124':445
'13#.#06.106.224':445
'13#.#06.11.68':445
'13#.#06.142.10':445
'13#.#06.35.105':445
'13#.#06.0.31':445
'13#.#06.54.197':445
'13#.#06.142.82':445
'13#.#06.67.193':445
'13#.#06.48.59':139
'13#.#06.37.145':139
'13#.#06.159.62':139
'13#.#06.111.253':139
'13#.#06.27.100':139
'13#.#06.100.125':445
'13#.#06.102.10':139
'13#.#06.171.73':139
'13#.#06.137.70':139
'13#.#06.142.10':139
'13#.#06.65.124':139
'13#.#06.67.193':139
'13#.#06.11.68':139
'13#.#06.142.82':139
'13#.#06.35.105':139
'13#.#06.106.224':139
'13#.#06.54.197':139
'13#.#06.100.125':139
'13#.#06.171.128':445
'13#.#06.153.68':445
'13#.#06.233.161':445
'13#.#06.112.233':445
'13#.#06.117.162':445
'13#.#06.8.151':445
'13#.#06.30.5':445
'13#.#06.163.8':445
'13#.#06.123.115':139
'13#.#06.117.26':139
'13#.#06.36.57':139
'13#.#06.238.163':139
'13#.#06.207.153':139
'13#.#06.16.104':139
'13#.#06.108.231':139
'13#.#06.86.12':139
'13#.#06.242.246':139
'13#.#06.253.161':139
'13#.#06.112.63':139
'13#.#06.0.31':139
'13#.#06.8.52':139
'13#.#06.231.53':139
'13#.#06.94.231':139
'13#.#06.246.222':139
'13#.#06.54.74':139
'13#.#06.115.230':139
'13#.#06.159.26':139
'13#.#06.105.252':139
'13#.#06.73.27':139
'13#.#06.76.114':139
'13#.#06.237.168':445
'13#.#06.43.30':139
'13#.#06.34.58':139
'13#.#06.182.77':139
'13#.#06.113.225':139
'13#.#06.48.114':139
'13#.#06.40.108':139
'13#.#06.225.212':139
'13#.#06.193.181':139
'13#.#06.111.220':139
'13#.#06.141.249':139
'13#.#06.87.208':139
'13#.#06.29.110':445
'13#.#06.253.93':445
'13#.#06.109.223':445
'13#.#06.94.29':445
'13#.#06.251.84':445
'13#.#06.156.22':445
'13#.#06.105.50':445
'13#.#06.190.75':445
'13#.#06.223.74':445
'13#.#06.20.112':445
'13#.#06.129.107':445
'13#.#06.97.73':445
'13#.#06.7.184':445
'13#.#06.33.124':445
'13#.#06.14.33':445
'13#.#06.49.97':445
'13#.#06.89.165':445
'13#.#06.48.62':139
'13#.#06.29.110':139
'13#.#06.94.29':139
'13#.#06.223.74':139
'13#.#06.109.223':139
'13#.#06.190.75':139
'13#.#06.251.84':139
'13#.#06.253.93':139
'13#.#06.105.50':139
'13#.#06.14.33':139
'13#.#06.237.168':139
'13#.#06.97.73':139
'13#.#06.7.184':139
'13#.#06.49.97':139
'13#.#06.89.165':139
'13#.#06.33.124':139
'13#.#06.20.112':139
'13#.#06.129.107':139
'13#.#06.96.97':139
'13#.#06.152.188':139
'13#.#06.114.70':139
'13#.#06.120.33':139
'13#.#06.39.117':139
'13#.#06.129.184':139
'13#.#06.39.158':139
'13#.#06.69.189':139
'13#.#06.186.175':139
'13#.#06.106.17':139
'13#.#06.227.229':139
'13#.#06.156.22':139
'13#.#06.16.220':139
'13#.#06.16.169':139
'13#.#06.152.16':139
'13#.#06.12.108':139
'13#.#06.169.60':139
'13#.#06.246.47':139
'13#.#06.26.182':139
'13#.#06.245.126':139
'13#.#06.154.245':139
'13#.#06.126.135':139
'13#.#06.195.202':139
'13#.#06.39.66':139
'13#.#06.92.86':139
'13#.#06.115.230':9988
'13#.#06.69.189':9988
'13#.#06.16.220':9988
'13#.#06.97.73':9988
'13#.#06.152.188':9988
'13#.#06.94.29':9988
'13#.#06.129.107':9988
'13#.#06.114.70':9988
'13#.#06.237.168':9988
'13#.#06.80.169':139
'13#.#06.239.29':139
'13#.#06.157.45':139
'13#.#06.162.214':139
'13#.#06.212.178':139
'13#.#06.96.68':139
'13#.#06.207.184':139
'13#.#06.18.109':139
'13#.#06.221.70':139
'13#.#06.8.236':139
'13#.#06.232.125':139
'13#.#06.72.86':139
'13#.#06.0.132':139
'13#.#06.233.201':139
'13#.#06.9.205':139
'13#.#06.234.31':139
'13#.#06.177.69':139
'13#.#06.120.33':9988
'13#.#06.152.188':445
'13#.#06.39.158':445
'13#.#06.120.33':445
'13#.#06.96.97':445
'13#.#06.129.184':445
'13#.#06.48.62':445
'13#.#06.69.189':445
'13#.#06.39.117':445
'13#.#06.114.70':445
'13#.#06.227.229':445
'13#.#06.12.108':445
'13#.#06.16.220':445
'13#.#06.106.17':445
'13#.#06.152.16':445
'13#.#06.186.175':445
'13#.#06.169.60':445
'13#.#06.16.169':445
'13#.#06.115.230':445
'13#.#06.159.26':445
'13#.#06.105.252':445
'13#.#06.73.27':445
'13#.#06.76.114':445
'13#.#06.20.112':9988
'13#.#06.43.30':445
'13#.#06.34.58':445
'13#.#06.182.77':445
'13#.#06.113.225':445
'13#.#06.48.114':445
'13#.#06.40.108':445
'13#.#06.225.212':445
'13#.#06.193.181':445
'13#.#06.111.220':445
'13#.#06.141.249':445
'13#.#06.87.208':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней