Trojan.DownLoader21.52650

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'89.##2.234.60':3128
'58.#.75.96':3128
'17#.#22.163.183':3128
'77.##3.127.175':3128
'84.#10.34.1':3128
'11#.#65.21.170':3128
'12#.#02.149.237':3128
'17#.#22.161.10':3128
'74.#15.5.41':3128
'77.#1.11.83':3128
'2.##.90.203':3128
'20#.#67.48.141':3128
'11#.#00.101.127':3128
'94.#2.26.19':3128
'41.##6.12.78':3128
'12#.#20.82.252':3128
'20#.#84.0.26':3128
'12#.#6.129.71':3128
'24.##.206.135':3128
'12#.#20.143.105':3128
'82.##.156.76':3128
'20#.#48.45.233':3128
'18#.#27.42.6':3128
'19#.#34.187.101':3128
'20#.#72.230.241':3128
'12#.#1.102.50':3128
'20#.#84.2.198':3128
'20#.#7.122.251':3128
'78.##5.25.139':3128
'11#.#2.74.158':3128
'87.##0.150.113':3128
'19#.#49.50.68':3128
'12#.#27.129.166':3128
'19#.#13.176.245':3128
'85.##7.181.239':3128
'58.#.30.242':3128
'86.##3.42.47':3128
'12#.#20.145.183':3128
'58.##.56.108':3128
'24.##.100.188':3128
'11#.#2.246.225':3128
'83.##3.182.140':3128
'67.##3.102.213':3128
'79.##3.239.159':3128
'10#.#82.142.8':3128
'58.#.216.227':3128
'11#.#24.219.187':3128
'93.##.130.86':3128
'85.##5.94.22':3128
'59.##3.54.109':3128
'89.##8.72.70':3128
'11#.#5.68.63':3128
'11#.#96.13.134':3128
'17#.#5.130.127':3128
'92.##.142.41':3128
'95.#7.38.92':3128
'60.#3.6.178':3128
'20#.#65.11.102':3128
'11#.#02.17.103':3128
'14#.#41.3.74':3128
'19#.#07.110.169':3128
'95.##.215.253':3128
'19#.3.229.6':3128
'21#.#08.225.200':3128
'86.##7.14.36':3128
'83.##.210.109':3128
'78.##0.154.28':3128
'12#.#58.94.2':3128
'71.##.211.82':3128
'41.##3.57.76':3128
'17#.#44.131.202':3128
'18#.#8.31.141':3128
'59.##8.36.78':3128
'11#.#7.84.186':3128
'11#.#46.86.131':3128
'85.##0.229.245':3128
'12#.#20.145.139':3128
'19#.#34.186.100':3128
'20#.#38.207.169':3128
'12#.#02.195.227':3128
'85.##7.247.18':3128
'82.##1.137.149':3128
'58.#1.61.79':3128
'59.##.219.21':3128
'88.##6.79.53':3128
'89.##2.16.135':3128
'24.##8.210.39':3128
'92.##.168.120':3128
'77.##3.123.138':3128
'77.##5.251.153':3128
'19#.#58.230.139':3128
'89.##2.76.106':3128
'85.##7.57.116':3128
'11#.#4.56.143':3128
'87.##.75.183':3128
'95.##6.135.152':3128
'85.##6.196.130':3128
'89.##3.253.161':3128
'99.##7.197.172':3128
'99.##4.251.138':6667
'87.##5.146.101':6667
'86.##3.42.47':6667
'85.##5.94.22':6667
'11#.#96.13.134':6667
'89.##7.201.178':6667
'11#.#3.120.158':6667
'88.##6.79.53':6667
'41.##3.57.76':6667
'82.##8.3.148':6667
'95.##.132.65':3128
'localhost':794
'89.##3.48.226':3128
'89.##3.44.151':3128
'85.##5.92.217':6667
'19#.#17.45.181':6667
'20#.#34.68.250':6667
'61.##.216.84':6667
'61.##.216.86':6667
'19#.#16.232.31':3128
'19#.#34.168.18':3128
'75.##.32.229':3128
'19#.#04.148.80':3128
'85.##8.142.197':3128
'20#.#09.68.40':3128
'19#.#11.26.219':3128
'18#.#3.227.28':3128
'95.##.41.196':3128
'10#.#82.39.33':3128
'19#.#51.53.33':3128
'84.##0.42.113':3128
'89.##6.80.237':3128
'85.##5.93.51':3128
'17#.#50.83.150':3128
'13#.#32.68.126':3128
'24.##2.20.204':3128
'77.##5.46.36':3128
'78.##0.157.119':3128
'94.##.150.54':3128
'18#.#5.17.157':3128
'85.##5.92.217':3128
'11#.#97.218.182':3128
'82.##.141.57':3128
'12#.#32.194.82':3128
'19#.#10.232.80':3128
'86.##.170.92':3128
'75.##5.209.89':3128
'11#.#7.114.251':3128
'20#.19.7.7':3128
'75.##3.44.131':3128
'22#.#43.58.84':3128
'21#.#19.88.253':3128
'50.#.42.134':3128
'88.##3.36.111':3128
'78.##.11.200':3128
'88.##8.80.241':3128
'17#.#.108.198':3128
'84.##5.65.60':3128
'21#.#33.172.127':3128
'93.##3.135.32':3128
'90.##0.157.63':3128
'22#.#66.144.24':3128
'88.##7.38.114':3128
'77.##5.57.80':3128
'12#.#22.167.86':3128
'18#.#67.31.182':3128
'79.##5.215.138':3128
'21#.#12.233.19':3128
'83.##2.81.217':3128
'82.#5.76.46':3128
'77.##2.124.2':3128
'89.#5.5.227':3128
'87.##5.146.101':3128
'11#.#2.15.64':3128
'12#.#43.21.78':3128
'20#.#34.68.250':3128
'77.#6.69.74':3128
'80.##.229.28':3128
'11#.#18.139.94':3128
'82.##8.181.150':3128
'18#.#20.227.88':3128
'86.##7.4.236':3128
'18#.#0.127.218':3128
'85.##8.161.153':3128
'77.##4.36.85':3128
'11#.#87.53.101':3128
'68.##8.104.236':3128
'77.##9.10.86':3128
'20#.#59.217.140':3128
'60.##.83.118':3128
'21#.#07.211.28':3128
'21#.#6.112.137':3128
'85.##4.169.5':3128
'84.##2.179.18':3128
'11#.#52.104.173':3128
'24.##7.3.252':3128
'71.##.23.138':3128
'11#.#3.120.158':3128
'21#.#98.142.181':3128
'76.##5.78.223':3128
'20#.#64.211.106':3128
'22#.#43.61.31':3128
'67.##.137.125':3128
'84.##7.65.119':3128
'89.##7.75.85':3128
'20#.#48.139.97':3128
'20#.#02.75.6':3128
'24.#4.6.90':3128
'11#.#8.120.153':3128
'11#.#06.112.190':3128
'62.##3.174.192':3128
'11#.#7.179.69':3128
'11#.#24.231.22':3128
'21#.#54.91.61':3128
'89.##2.72.42':3128
'21#.#2.242.130':3128
'41.##7.15.36':3128
'11#.#5.55.146':3128
'41.##3.57.72':3128
'21#.#86.183.4':3128
'89.##7.201.178':3128
'82.##2.103.247':3128
'19#.#17.45.181':3128
'12#.#8.31.244':3128
'85.##5.41.173':3128
'77.##4.188.108':3128
'20#.#84.1.240':3128
'50.##.27.234':3128
'79.##3.216.52':3128
'20#.#09.60.66':3128
'12#.#53.194.91':3128
'12#.#22.83.163':3128
'21#.#22.182.79':3128
'95.##6.187.140':3128
'21#.#19.194.130':3128
'95.#.121.163':3128
'19#.#10.233.85':3128
'15#.#2.90.60':3128
'89.##.52.156':3128
'59.##3.54.47':3128
'21#.#07.98.194':3128
'83.##.153.57':3128
'21#.#22.183.133':3128
'94.##2.187.102':3128
'10#.#82.70.206':3128
'76.##9.47.171':3128
'60.##.148.98':3128
'21#.#13.52.200':3128
'11#.#65.4.134':3128
'72.##4.185.240':3128
'87.##.219.178':3128
'59.##.20.186':3128
'20#.#4.142.201':3128
'11#.#68.77.31':3128
'22#.#43.176.23':3128
'99.##4.251.138':3128
'81.##0.205.158':3128
'84.##7.151.131':3128
'12#.#.41.218':3128
'77.#31.34.6':3128
'21#.#38.71.192':3128
'24.##7.157.146':3128
'20#.#1.160.62':3128
'12#.#17.122.170':3128
'69.##4.152.58':3128
'79.##3.223.220':3128
'84.##8.28.123':3128
'19#.#20.60.143':3128
'10#.#0.143.16':3128
'20#.#4.103.163':3128
'88.##8.120.120':3128
'19#.#4.97.205':3128
'20#.#4.74.72':3128
'84.##8.206.247':3128
'21#.#6.47.24':3128
'81.##.136.152':3128
'17#.#5.170.65':3128
'77.##.79.191':3128
'localhost':4
'84.##0.72.132':3128
'10#.#82.70.89':3128
'10#.#82.3.146':3128
'78.##0.139.133':3128
'21#.#01.133.103':3128
'77.##.240.187':3128
'77.##4.52.53':3128
'95.##.41.220':3128
'80.##.145.28':3128
'65.##.103.67':3128
'81.##3.67.193':3128
'84.##8.28.40':3128
'20#.#60.161.155':3128
'41.##3.57.74':3128
'92.##.137.192':3128
'85.##.230.135':3128
'74.##.209.166':3128
'19#.#10.235.128':3128
'89.##3.156.108':3128
'11#.#24.225.160':3128
'87.##5.159.17':3128
'12#.#27.120.16':3128
'87.##5.32.83':3128
'79.##3.234.217':3128
'12#.#53.195.253':3128
'18#.#9.152.87':3128
'24.#.229.177':3128
'89.##2.85.171':3128
'21#.#12.197.166':3128
'98.##.253.11':3128
'62.##0.116.204':3128
'21#.#08.216.5':3128
'20#.#32.187.78':3128
'12#.#08.66.123':3128
'84.##.224.155':3128
'18#.#1.238.53':3128
'19#.#7.135.204':3128
'94.##.30.214':3128
'78.##.16.143':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней