Trojan.DownLoader4.48117

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Wmmvsvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SCardPrv] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c d.bat "<Полный путь к вирусу>"
<SYSTEM32>\svchost.exe -k Wmmvsvc
<SYSTEM32>\svchost.exe -k SCardPrv

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\KB25879.dat
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
<Текущая директория>\d.bat
<SYSTEM32>\scardprv.dll
<SYSTEM32>\Wmmvsvc.dll

Самоудаляется.

Сетевая активность:

Подключается к:

'56.##6.169.44':445
'17#.#9.213.49':445
'14#.#26.95.45':445
'25#.#17.118.39':445
'7.##.232.46':445
'25#.#17.118.38':445
'56.##6.169.43':445
'7.##.232.45':445
'60.##.121.39':445
'18#.#2.17.38':445
'7.##.232.47':445
'14#.#26.95.46':445
'18#.#2.17.40':445
'14#.#26.95.47':445
'17#.#9.213.51':445
'60.##.121.40':445
'18#.#2.17.39':445
'17#.#9.213.50':445
'56.##6.169.45':445
'25#.#17.118.40':445
'14#.#26.95.44':445
'56.##6.169.41':445
'60.##.121.36':445
'14#.#26.95.42':445
'25#.#17.118.36':445
'7.##.232.43':445
'14#.#26.95.41':445
'7.##.232.42':445
'18#.#2.17.35':445
'17#.#9.213.46':445
'25#.#17.118.35':445
'7.##.232.44':445
'25#.#17.118.37':445
'18#.#2.17.37':445
'60.##.121.38':445
'17#.#9.213.48':445
'17#.#9.213.47':445
'18#.#2.17.36':445
'60.##.121.37':445
'56.##6.169.42':445
'14#.#26.95.43':445
'58.##8.223.21':445
'58.##8.223.20':445
'58.##8.223.22':445
'58.##8.223.24':445
'58.##8.223.23':445
'58.##8.223.16':445
'58.##8.223.15':445
'58.##8.223.17':445
'58.##8.223.19':445
'58.##8.223.18':445
'58.##8.223.32':445
'58.##8.223.31':445
'58.##8.223.33':445
'58.##8.223.35':445
'58.##8.223.34':445
'58.##8.223.26':445
'58.##8.223.25':445
'58.##8.223.27':445
'58.##8.223.30':445
'58.##8.223.29':445
'58.##8.223.14':445
'14#.#26.95.48':445
'58.##8.223.9':445
'60.##.121.40':80
'7.##.232.49':445
'25#.#17.118.42':445
'18#.#2.17.41':445
'58.##8.223.8':445
'7.##.232.48':445
'17#.#9.213.52':445
'25#.#17.118.41':445
'7.##.232.52':445
'7.##.232.51':445
'58.##8.223.11':445
'58.##8.223.13':445
'58.##8.223.12':445
'58.##8.223.10':445
'25#.#17.118.42':139
'7.##.232.50':445
'58.##8.223.10':139
'56.##6.169.45':80
'10#.#5.161.32':445
'56.##6.169.33':445
'7.##.232.35':445
'60.##.121.28':445
'14#.#26.95.34':445
'25#.#17.118.27':445
'14#.#26.95.33':445
'18#.#2.17.27':445
'17#.#9.213.38':445
'13.##.198.31':445
'7.##.232.36':445
'56.##6.169.34':445
'14#.#26.95.35':445
'25#.#17.118.29':445
'60.##.121.29':445
'18#.#2.17.28':445
'25#.#17.118.28':445
'17#.#9.213.39':445
'10#.#5.161.33':445
'13.##.198.32':445
'60.##.121.27':445
'17#.#9.213.36':445
'25#.#17.118.25':445
'13.##.198.29':445
'10#.#5.161.30':445
'56.##6.169.31':445
'7.##.232.32':445
'10#.#5.161.29':445
'14#.#26.95.31':445
'60.##.121.25':445
'18#.#2.17.25':445
'17#.#9.213.37':445
'13.##.198.30':445
'56.##6.169.32':445
'7.##.232.34':445
'10#.#5.161.31':445
'14#.#26.95.32':445
'7.##.232.33':445
'60.##.121.26':445
'25#.#17.118.26':445
'18#.#2.17.26':445
'14#.#26.95.39':445
'56.##6.169.38':445
'7.##.232.40':445
'25#.#17.118.33':445
'18#.#2.17.33':445
'25#.#17.118.32':445
'56.##6.169.37':445
'18#.#2.17.32':445
'60.##.121.33':445
'17#.#9.213.43':445
'25#.#17.118.34':445
'18#.#2.17.34':445
'17#.#9.213.45':445
'56.##6.169.40':445
'60.##.121.35':445
'60.##.121.34':445
'17#.#9.213.44':445
'56.##6.169.39':445
'7.##.232.41':445
'14#.#26.95.40':445
'14#.#26.95.38':445
'25#.#17.118.30':445
'60.##.121.30':445
'18#.#2.17.30':445
'7.##.232.38':445
'17#.#9.213.41':445
'17#.#9.213.40':445
'18#.#2.17.29':445
'14#.#26.95.36':445
'56.##6.169.35':445
'7.##.232.37':445
'17#.#9.213.42':445
'18#.#2.17.31':445
'10#.#5.161.33':80
'7.##.232.39':445
'60.##.121.32':445
'14#.#26.95.37':445
'60.##.121.31':445
'56.##6.169.36':445
'25#.#17.118.31':445
'13.##.198.32':80
'58.##8.223.36':445
'56.##6.169.70':445
'13.##.198.75':445
'60.##.121.68':445
'56.##6.169.71':445
'13.##.198.76':445
'60.##.121.66':445
'56.##6.169.68':445
'13.##.198.74':445
'60.##.121.67':445
'56.##6.169.69':445
'56.##6.169.73':445
'60.##.121.71':445
'13.##.198.79':445
'56.##6.169.74':445
'60.##.121.72':445
'13.##.198.77':445
'60.##.121.69':445
'56.##6.169.72':445
'13.##.198.78':445
'60.##.121.70':445
'13.##.198.73':445
'56.##6.169.63':445
'13.##.198.68':445
'60.##.121.61':445
'56.##6.169.64':445
'13.##.198.69':445
'60.##.121.59':445
'56.##6.169.61':445
'13.##.198.67':445
'60.##.121.60':445
'56.##6.169.62':445
'60.##.121.64':445
'56.##6.169.66':445
'13.##.198.72':445
'60.##.121.65':445
'56.##6.169.67':445
'13.##.198.70':445
'60.##.121.62':445
'56.##6.169.65':445
'13.##.198.71':445
'60.##.121.63':445
'13.##.198.89':445
'60.##.121.81':445
'56.##6.169.84':445
'60.##.121.83':445
'60.##.121.82':445
'56.##6.169.82':445
'60.##.121.80':445
'13.##.198.87':445
'13.##.198.88':445
'56.##6.169.83':445
'60.##.121.85':445
'13.##.198.91':445
'7.##.232.55':445
'60.##.121.86':139
'60.##.121.86':445
'13.##.198.90':445
'56.##6.169.85':445
'56.##6.169.85':139
'7.##.232.54':445
'60.##.121.84':445
'56.##6.169.81':445
'13.##.198.82':445
'56.##6.169.76':445
'60.##.121.75':445
'13.##.198.83':445
'56.##6.169.77':445
'60.##.121.73':445
'13.##.198.80':445
'56.##6.169.75':445
'60.##.121.74':445
'13.##.198.81':445
'13.##.198.85':445
'60.##.121.78':445
'56.##6.169.80':445
'13.##.198.86':445
'60.##.121.79':445
'56.##6.169.78':445
'60.##.121.76':445
'13.##.198.84':445
'56.##6.169.79':445
'60.##.121.77':445
'60.##.121.41':139
'13.##.198.45':445
'13.##.198.46':445
'13.##.198.48':445
'13.##.198.47':445
'10#.#5.161.39':445
'13.##.198.43':445
'13.##.198.44':445
'14#.#26.95.48':80
'60.##.121.41':445
'25#.#17.118.42':80
'56.##6.169.46':445
'60.##.121.44':445
'56.##6.169.47':445
'13.##.198.52':445
'60.##.121.42':445
'13.##.198.49':445
'13.##.198.50':445
'13.##.198.51':445
'60.##.121.43':445
'10#.#5.161.38':445
'13.##.198.34':445
'13.##.198.33':445
'13.##.198.35':445
'13.##.198.37':445
'13.##.198.36':445
'58.##8.223.38':445
'58.##8.223.37':445
'58.##8.223.38':139
'18#.#2.17.41':80
'7.##.232.53':445
'10#.#5.161.36':445
'13.##.198.40':445
'13.##.198.41':445
'13.##.198.42':445
'10#.#5.161.37':445
'10#.#5.161.34':445
'13.##.198.38':445
'13.##.198.39':445
'10#.#5.161.35':445
'17#.#9.213.52':80
'60.##.121.54':445
'56.##6.169.56':445
'13.##.198.62':445
'60.##.121.55':445
'56.##6.169.57':445
'60.##.121.52':445
'13.##.198.60':445
'56.##6.169.55':445
'13.##.198.61':445
'60.##.121.53':445
'13.##.198.65':445
'60.##.121.57':445
'56.##6.169.60':445
'13.##.198.66':445
'60.##.121.58':445
'56.##6.169.58':445
'13.##.198.63':445
'60.##.121.56':445
'56.##6.169.59':445
'13.##.198.64':445
'56.##6.169.54':445
'60.##.121.47':445
'56.##6.169.49':445
'56.##6.169.50':445
'60.##.121.48':445
'13.##.198.55':445
'13.##.198.53':445
'60.##.121.45':445
'56.##6.169.48':445
'13.##.198.54':445
'60.##.121.46':445
'60.##.121.50':445
'13.##.198.58':445
'56.##6.169.53':445
'60.##.121.51':445
'13.##.198.59':445
'56.##6.169.51':445
'13.##.198.56':445
'60.##.121.49':445
'56.##6.169.52':445
'13.##.198.57':445
'25#.#17.118.0':80
'13.#7.198.4':80
'18#.62.17.1':445
'56.##6.169.5':80
'14#.#26.95.7':80
'10#.#5.161.5':445
'56.##6.169.5':139
'18#.62.17.0':80
'17#.#9.213.12':445
'60.#0.121.0':80
'25#.#17.118.1':139
'10#.#5.161.5':139
'56.##6.169.6':139
'7.##.232.8':445
'18#.62.17.1':139
'13.#7.198.5':445
'60.#0.121.1':445
'25#.#17.118.1':445
'56.##6.169.6':445
'14#.#26.95.8':445
'58.##8.223.7':139
'58.##8.223.6':445
'14#.#26.95.5':445
'7.##.232.7':139
'56.##6.169.3':445
'58.##8.223.7':445
'56.##6.169.1':445
'58.##8.223.5':445
'56.##6.169.2':445
'17#.#9.213.8':445
'7.##.232.7':445
'17#.#9.213.11':445
'10#.#5.161.3':445
'56.##6.169.5':445
'17#.#9.213.11':139
'10#.#5.161.4':445
'14#.#26.95.6':445
'17#.#9.213.9':445
'14#.#26.95.7':445
'17#.#9.213.10':445
'56.##6.169.4':445
'56.##6.169.10':445
'14#.#26.95.11':445
'17#.#9.213.16':445
'7.##.232.12':445
'25#.#17.118.5':445
'10#.#5.161.8':445
'25#.#17.118.4':445
'18#.62.17.4':445
'60.#0.121.4':445
'13.#7.198.8':445
'17#.#9.213.17':445
'56.##6.169.11':445
'7.##.232.13':445
'60.#0.121.6':445
'25#.#17.118.6':445
'10#.#5.161.9':445
'13.#7.198.9':445
'60.#0.121.5':445
'14#.#26.95.12':445
'18#.62.17.5':445
'7.##.232.11':445
'60.#0.121.2':445
'10#.#5.161.6':445
'13.#7.198.6':445
'56.##6.169.8':445
'14#.#26.95.9':445
'7.##.232.9':445
'56.##6.169.7':445
'17#.#9.213.13':445
'25#.#17.118.2':445
'18#.62.17.2':445
'13.#7.198.7':445
'60.#0.121.3':445
'14#.#26.95.10':445
'17#.#9.213.15':445
'56.##6.169.9':445
'18#.62.17.3':445
'17#.#9.213.14':445
'25#.#17.118.3':445
'10#.#5.161.7':445
'7.##.232.10':445
'19#.#8.247.24':445
'10#.#30.85.160':445
'30.##9.74.209':445
'13.#7.198.0':445
'16#.#1.25.239':445
'7.##.232.149':445
'13.#7.198.2':445
'17#.#9.213.0':445
'18#.62.17.0':445
'81.##3.163.249':445
'13.#7.198.1':445
'13#.#71.163.116':445
'57.##.46.117':445
'60.##.121.173':445
'10#.#9.63.148':445
'7.##.232.0':445
'16#.#9.171.198':445
'17#.#9.213.1':445
'43.##9.233.242':445
'58.##8.223.28':445
'20#.#98.84.198':445
'53.##.120.51':445
'20#.#5.128.107':445
'15#.#91.171.242':445
'20#.#59.240.46':445
'40.##2.125.2':445
'<IP-адрес в локальной сети>':139
'<IP-адрес в локальной сети>':445
'<IP-адрес в локальной сети>':80
'20#.#27.116.220':445
'wpad.localdomain':80
'10#.#17.46.7':445
'20#.#0.169.141':445
'17#.#9.213.146':445
'34.##.160.20':445
'18#.#2.17.150':445
'22#.#54.194.21':445
'15#.#29.228.62':445
'56.#5.14.74':445
'22#.#75.74.114':445
'12#.#78.143.112':445
'58.##8.223.3':445
'14#.#26.95.2':445
'17#.#9.213.5':445
'10#.#5.161.1':445
'56.##6.169.111':445
'79.##8.73.237':445
'7.##.232.3':445
'17#.#9.213.4':445
'7.##.232.4':445
'25#.#17.118.137':445
'10#.#5.161.2':445
'58.##8.223.4':445
'17#.#9.213.7':445
'14#.#26.95.4':445
'7.##.232.6':445
'17#.#9.213.6':445
'25#.#17.118.0':445
'14#.#26.95.3':445
'7.##.232.5':445
'56.##6.169.0':445
'14#.#26.95.1':445
'32.##.114.42':445
'24#.#57.153.82':445
'60.#0.121.0':445
'10#.#5.161.67':445
'13.#7.198.3':445
'17#.#9.213.2':445
'14#.#26.95.23':445
'7.##.232.1':445
'59.##4.86.181':445
'58.##8.223.0':445
'13.#7.198.4':445
'17#.#9.213.3':445
'10#.#5.161.0':445
'58.##8.223.2':445
'11#.#38.105.36':445
'58.##8.223.1':445
'14#.#26.95.0':445
'7.##.232.2':445
'10#.#8.156.72':445
'22#.#.155.223':445
'13.##.198.10':445
'56.##6.169.24':445
'17#.#9.213.29':445
'14#.#26.95.25':445
'10#.#5.161.23':445
'7.##.232.26':445
'25#.#17.118.18':445
'10#.#5.161.22':445
'60.##.121.18':445
'13.##.198.22':445
'18#.#2.17.18':445
'14#.#26.95.26':445
'17#.#9.213.30':445
'7.##.232.27':445
'60.##.121.20':445
'10#.#5.161.24':445
'25#.#17.118.19':445
'60.##.121.19':445
'18#.#2.17.19':445
'56.##6.169.25':445
'13.##.198.23':445
'7.##.232.25':445
'13.##.198.20':445
'25#.#17.118.16':445
'60.##.121.16':445
'18#.#2.17.16':445
'17#.#9.213.27':445
'56.##6.169.21':445
'18#.#2.17.15':445
'14#.#26.95.22':445
'10#.#5.161.20':445
'7.##.232.23':445
'18#.#2.17.17':445
'13.##.198.21':445
'17#.#9.213.28':445
'14#.#26.95.24':445
'56.##6.169.23':445
'7.##.232.24':445
'56.##6.169.22':445
'10#.#5.161.21':445
'60.##.121.17':445
'25#.#17.118.17':445
'18#.#2.17.23':445
'60.##.121.23':445
'25#.#17.118.23':445
'13.##.198.27':445
'17#.#9.213.34':445
'56.##6.169.28':445
'13.##.198.26':445
'10#.#5.161.27':445
'7.##.232.30':445
'14#.#26.95.29':445
'25#.#17.118.24':445
'60.##.121.24':445
'17#.#9.213.35':445
'56.##6.169.30':445
'13.##.198.28':445
'10#.#5.161.28':445
'56.##6.169.29':445
'14#.#26.95.30':445
'18#.#2.17.24':445
'7.##.232.31':445
'17#.#9.213.33':445
'7.##.232.28':445
'14#.#26.95.27':445
'10#.#5.161.25':445
'25#.#17.118.21':445
'60.##.121.21':445
'13.##.198.24':445
'18#.#2.17.20':445
'25#.#17.118.20':445
'56.##6.169.26':445
'17#.#9.213.31':445
'14#.#26.95.28':445
'7.##.232.29':445
'60.##.121.22':445
'25#.#17.118.22':445
'18#.#2.17.22':445
'13.##.198.25':445
'18#.#2.17.21':445
'56.##6.169.27':445
'10#.#5.161.26':445
'17#.#9.213.32':445
'60.#0.121.9':445
'18#.62.17.9':445
'10#.#5.161.13':445
'56.##6.169.15':445
'14#.#26.95.16':445
'7.##.232.16':445
'56.##6.169.14':445
'13.##.198.13':445
'17#.#9.213.20':445
'25#.#17.118.9':445
'10#.#5.161.14':445
'18#.#2.17.10':445
'14#.#26.95.17':445
'7.##.232.18':445
'56.##6.169.16':445
'25#.#17.118.10':445
'7.##.232.17':445
'13.##.198.14':445
'60.##.121.10':445
'17#.#9.213.21':445
'14#.#26.95.15':445
'25#.#17.118.7':445
'7.##.232.14':445
'13.##.198.11':445
'60.#0.121.7':445
'18#.62.17.7':445
'10#.#5.161.10':445
'18#.62.17.6':445
'14#.#26.95.13':445
'17#.#9.213.18':445
'56.##6.169.12':445
'13.##.198.12':445
'17#.#9.213.19':445
'18#.62.17.8':445
'10#.#5.161.12':445
'60.#0.121.8':445
'14#.#26.95.14':445
'10#.#5.161.11':445
'56.##6.169.13':445
'25#.#17.118.8':445
'7.##.232.15':445
'25#.#17.118.14':445
'7.##.232.21':445
'10#.#5.161.18':445
'17#.#9.213.25':445
'60.##.121.14':445
'17#.#9.213.24':445
'10#.#5.161.17':445
'60.##.121.13':445
'14#.#26.95.20':445
'56.##6.169.19':445
'10#.#5.161.19':445
'25#.#17.118.15':445
'60.##.121.15':445
'17#.#9.213.26':445
'13.##.198.19':445
'18#.#2.17.14':445
'13.##.198.18':445
'56.##6.169.20':445
'7.##.232.22':445
'14#.#26.95.21':445
'18#.#2.17.13':445
'14#.#26.95.18':445
'10#.#5.161.15':445
'56.##6.169.17':445
'25#.#17.118.12':445
'7.##.232.19':445
'13.##.198.15':445
'25#.#17.118.11':445
'60.##.121.11':445
'18#.#2.17.11':445
'17#.#9.213.22':445
'14#.#26.95.19':445
'56.##6.169.18':445
'7.##.232.20':445
'13.##.198.17':445
'25#.#17.118.13':445
'17#.#9.213.23':445
'13.##.198.16':445
'18#.#2.17.12':445
'10#.#5.161.16':445
'60.##.121.12':445

TCP:

Запросы HTTP GET:

wpad.localdomain/wpad.dat

UDP:

DNS ASK wpad.localdomain

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней