Trojan.DownLoader3.56662

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'85.##7.165.12':3128
'19#.#4.97.205':3128
'95.##.153.127':3128
'12#.#9.192.42':3128
'24.##9.158.31':3128
'99.##9.65.220':3128
'85.##8.161.153':3128
'41.##0.116.126':3128
'85.##5.41.173':3128
'67.##3.102.213':3128
'24.##7.157.146':3128
'24.##2.20.204':3128
'84.##4.251.251':3128
'88.##6.79.53':3128
'12#.#.41.218':3128
'18#.#09.250.90':3128
'11#.#40.16.90':3128
'11#.#68.114.72':3128
'12#.#20.173.151':3128
'10#.#10.2.245':3128
'20#.#2.243.1':3128
'21#.#8.204.190':3128
'74.#15.5.41':3128
'18#.#09.47.62':3128
'11#.#2.74.158':3128
'20#.#67.48.141':3128
'19#.#61.230.206':3128
'78.##0.156.44':3128
'82.#5.76.46':3128
'41.##3.57.72':3128
'85.##1.85.186':3128
'75.##3.44.131':3128
'76.##9.47.171':3128
'89.##3.253.161':3128
'21#.#98.142.181':3128
'24.##7.3.252':3128
'10#.#0.143.16':3128
'41.##0.23.110':3128
'75.##5.209.89':3128
'89.##3.156.108':3128
'11#.#18.228.200':3128
'12#.#00.17.38':3128
'19#.#20.60.143':3128
'77.##3.80.240':3128
'21#.#98.142.157':3128
'18#.#27.42.6':3128
'21#.#6.47.24':3128
'90.##0.157.63':3128
'19#.#17.58.37':3128
'21#.#01.133.103':3128
'58.##.138.165':3128
'20#.#4.7.168':3128
'10#.#82.142.8':3128
'11#.#65.15.70':3128
'11#.#97.101.30':3128
'11#.#05.32.206':3128
'59.##.163.52':3128
'88.##1.207.2':3128
'95.##7.26.104':3128
'11#.#40.78.186':3128
'21#.#22.182.79':3128
'12#.#08.66.123':3128
'19#.#06.86.167':3128
'59.##.20.186':3128
'99.##7.197.172':3128
'95.##5.57.150':3128
'17#.#5.130.127':3128
'19#.#01.134.223':3128
'19#.#16.29.54':3128
'11#.#7.51.207':3128
'85.##6.196.130':3128
'59.##1.3.182':3128
'83.##3.182.140':3128
'80.#20.10.2':3128
'91.##6.191.99':3128
'12#.#6.129.71':3128
'83.##8.139.248':3128
'78.##0.145.66':3128
'41.##3.57.74':3128
'41.##7.15.36':3128
'77.##4.52.53':3128
'85.##.230.135':3128
'20#.#48.45.233':3128
'20#.#1.160.62':3128
'20#.#48.139.97':3128
'20#.#09.68.40':3128
'84.##0.72.132':3128
'12#.#32.194.82':3128
'85.##7.247.18':3128
'85.##8.130.25':3128
'17#.#49.32.122':3128
'41.##1.17.216':3128
'59.##1.5.168':3128
'93.##0.71.185':3128
'87.##5.207.113':3128
'18#.#14.143.139':3128
'12#.#22.83.163':3128
'93.##6.11.109':3128
'19#.#07.110.169':3128
'94.##.150.54':3128
'17#.#02.48.214':3128
'14#.#41.3.74':3128
'12#.#53.194.91':3128
'22#.#31.127.13':3128
'77.##2.124.2':3128
'59.##6.165.63':6667
'11#.#68.77.31':3128
'78.##5.25.139':3128
'99.##4.251.138':3128
'24.##8.210.39':3128
'58.#.30.178':3128
'22#.#43.58.84':3128
'11#.#02.17.103':3128
'20#.#2.92.109':3128
'19#.#16.232.31':3128
'19#.#04.148.80':3128
'13#.#32.68.126':3128
'77.##.240.187':3128
'19#.#13.176.245':3128
'95.##.215.253':3128
'20#.#40.2.66':3128
'21#.#86.183.4':3128
'22#.#43.176.23':3128
'62.##0.64.116':3128
'19#.#49.50.68':3128
'98.##.253.11':3128
'20#.#2.94.126':3128
'11#.#42.115.66':3128
'77.#1.11.83':3128
'21#.#38.66.44':3128
'94.##.30.214':3128
'59.#61.8.27':3128
'62.##0.116.204':3128
'11#.#54.134.172':3128
'17#.#50.83.150':3128
'69.##4.152.58':3128
'11#.#00.63.212':3128
'19#.#51.53.33':3128
'12#.#27.136.36':3128
'11#.#5.48.74':3128
'89.##8.72.70':3128
'74.##.209.166':3128
'79.##5.202.24':3128
'20#.#39.69.139':3128
'11#.#7.55.16':3128
'20#.#4.103.163':3128
'83.##2.81.217':3128
'18#.#5.17.157':3128
'18#.#3.227.28':3128
'59.##4.113.155':3128
'41.##9.83.200':3128
'41.##0.19.48':3128
'41.##8.202.162':3128
'41.##8.148.195':3128
'95.##6.135.152':3128
'21#.#19.108.210':3128
'41.##8.212.73':3128
'14#.#22.141.142':3128
'12#.#27.184.36':3128
'18#.#1.238.53':3128
'2.##.41.26':3128
'20#.#09.72.253':3128
'11#.#5.65.251':3128
'58.#.26.135':3128
'80.##3.99.204':3128
'41.##0.22.228':3128
'20#.#09.60.66':3128
'11#.#65.4.134':3128
'21#.#07.211.28':3128
'58.#.229.43':3128
'89.##5.12.49':3128
'11#.#35.78.205':3128
'59.##.243.118':3128
'83.##.91.175':3128
'84.##8.28.40':3128
'11#.#35.65.202':3128
'11#.#97.218.182':3128
'21#.#.25.204':3128
'21#.#65.176.235':3128
'95.##3.253.83':3128
'24.#.229.177':3128
'19#.#58.230.139':3128
'11#.#7.80.212':3128
'11#.#24.231.22':3128
'77.##9.10.86':3128
'78.##6.129.220':3128
'95.##.160.212':3128
'18#.#9.152.87':3128
'24.#4.6.90':3128
'11#.#3.120.158':3128
'58.##.227.186':3128
'84.##.52.118':3128
'12#.#68.217.244':3128
'85.##4.169.5':3128
'20#.#64.211.106':3128
'11#.#35.81.138':3128
'58.##.151.203':3128
'87.##0.150.113':3128
'21#.#12.197.166':3128
'10#.#82.39.33':3128
'82.##8.181.150':3128
'59.##3.54.47':3128
'21#.#33.172.127':3128
'89.##7.201.178':3128
'77.##5.42.69':3128
'83.##.153.57':3128
'11#.#7.84.36':3128
'12#.#20.143.105':3128
'61.##0.49.206':3128
'12#.#24.86.246':3128
'11#.#06.112.190':3128
'21#.#72.184.111':3128
'10#.#82.70.206':3128
'91.##.125.35':3128
'59.#5.8.148':3128
'89.##2.16.135':3128
'19#.#10.233.85':3128
'67.##.137.125':3128
'78.#9.44.98':3128
'78.##.46.158':3128
'11#.#35.73.109':3128
'99.##.191.109':3128
'11#.#35.75.212':3128
'41.##6.12.78':3128
'11#.#04.66.37':3128
'93.##3.135.32':3128
'59.##1.100.191':3128
'59.##6.165.63':3128
'20#.#7.122.251':3128
'21#.#22.183.133':3128
'21#.#09.162.104':3128
'18#.#3.36.194':3128
'11#.#18.139.94':3128
'12#.#43.21.78':3128
'12#.#26.29.193':3128
'79.##5.215.138':3128
'62.##3.174.192':3128
'81.##.171.13':3128
'11#.#7.114.251':3128
'11#.#46.86.131':3128
'11#.#94.235.36':3128
'60.#3.6.178':3128
'72.##8.40.67':3128
'17#.#5.170.65':3128
'41.##0.138.111':3128
'89.##3.48.226':3128
'18#.#8.31.141':3128
'21#.#2.242.130':3128
'11#.#41.167.36':3128
'95.#7.11.23':3128
'11#.#06.32.223':3128
'89.##.52.156':3128
'81.##3.67.193':3128
'86.##7.14.36':3128
'11#.#4.207.124':3128
'21#.#08.225.200':3128
'84.#10.34.1':3128
'10#.#22.74.214':3128
'95.##7.42.139':3128
'41.##3.57.76':3128
'59.##8.36.78':3128
'20#.#38.207.169':3128
'17#.#75.86.7':3128
'41.##9.51.182':3128
'20#.19.7.7':3128
'18#.#20.227.88':3128
'81.##0.205.158':3128
'10#.#82.70.89':3128
'19#.#36.167.158':3128
'21#.#19.88.253':3128
'59.#61.2.69':3128
'72.##4.185.240':3128
'89.#5.5.227':3128
'21#.#08.216.5':3128
'20#.#4.74.72':3128
'11#.#95.108.40':3128
'19#.3.229.6':3128
'78.##6.133.133':3128
'12#.#58.94.2':3128
'17#.#22.163.183':3128
'88.##8.80.241':3128
'50.#.42.134':3128
'94.#2.26.19':3128
'89.##7.75.85':3128
'83.##3.2.246':3128
'77.##7.90.141':3128
'11#.#2.15.64':3128
'84.##5.65.60':3128
'60.##.148.98':3128
'59.##1.13.105':3128
'11#.#55.3.189':3128
'11#.#93.235.240':3128
'78.##0.145.167':3128
'11#.#35.75.197':3128
'10#.#82.143.237':3128
'12#.#53.196.101':3128
'11#.#35.72.91':3128
'11#.#4.56.143':3128
'58.##.227.79':3128
'12#.#53.195.253':3128
'11#.#4.205.81':3128
'11#.#42.76.215':3128
'41.##9.95.89':3128
'82.##2.103.247':3128
'21#.#38.71.192':3128
'87.##5.32.83':3128
'85.##7.57.116':3128
'21#.#45.247.11':3128
'11#.#42.41.170':3128
'11#.#00.101.127':3128
'78.##2.60.27':3128
'61.##0.52.57':3128
'77.##.79.191':3128
'11#.#35.72.148':3128
'85.##0.229.245':3128
'20#.#34.68.250':3128
'77.#31.34.6':3128

UDP:

DNS ASK l.###aldomain

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней