Trojan.DownLoader3.18113

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'93.##3.61.98':3128
'85.##.244.105':3128
'81.##0.16.80':3128
'83.##8.166.59':3128
'77.##6.249.32':3128
'18#.#96.111.138':3128
'84.#2.63.48':3128
'21#.#2.137.6':3128
'79.##1.14.232':3128
'18#.88.9.10':3128
'19#.#03.119.6':3128
'83.##8.82.159':3128
'11#.#01.82.98':3128
'85.##0.73.139':3128
'85.##7.162.129':3128
'79.##3.61.91':3128
'79.##7.30.238':3128
'20#.#49.127.77':3128
'46.##7.131.42':3128
'95.##4.163.236':3128
'87.##0.60.145':3128
'93.##2.130.174':3128
'20#.#7.127.205':3128
'19#.#05.248.192':3128
'95.#6.6.148':3128
'99.#5.8.241':3128
'21#.#2.133.252':3128
'84.##9.213.73':3128
'41.##3.57.76':3128
'11#.#3.168.16':3128
'94.##6.146.239':3128
'19#.#.103.21':3128
'21#.#1.240.116':3128
'94.##1.184.145':3128
'13#.#.157.199':3128
'41.##5.78.172':3128
'11#.#97.71.93':3128
'94.##6.156.68':3128
'11#.#0.87.133':3128
'94.##6.150.74':3128
'94.##6.155.154':3128
'19#.#20.242.233':3128
'79.##5.253.7':3128
'18#.#.162.222':3128
'86.##6.57.184':3128
'79.##2.91.208':3128
'19#.#18.93.154':3128
'78.##9.49.34':3128
'95.##8.220.4':3128
'67.##7.90.188':3128
'18#.#8.243.33':3128
'78.##.98.243':3128
'89.##6.229.70':3128
'95.##.128.188':3128
'93.##4.141.31':3128
'86.##5.249.203':3128
'94.##6.145.251':3128
'19#.#18.116.42':3128
'85.##7.42.16':3128
'21#.#2.200.158':3128
'93.##3.180.33':3128
'18#.#77.136.211':3128
'89.##0.164.105':3128
'93.##2.87.198':3128
'84.#28.4.97':3128
'81.##.38.251':3128
'94.##7.75.108':3128
'92.##5.120.75':3128
'87.##6.70.90':3128
'17#.#56.150.10':3128
'20#.#8.237.179':3128
'93.##2.121.118':3128
'18#.#4.245.25':3128
'59.#8.7.168':3128
'94.##6.155.148':3128
'11#.#8.177.243':3128
'18#.#37.10.213':3128
'86.##3.31.54':3128
'22#.#43.63.26':3128
'41.##1.87.186':3128
'94.##6.153.228':3128
'84.##8.104.184':3128
'99.##.68.138':3128
'19#.#01.36.3':3128
'12#.#27.65.14':3128
'19#.#17.60.1':3128
'12#.#65.113.35':3128
'20#.#0.94.202':3128
'77.##.171.98':3128
'90.##7.92.184':3128
'95.##.155.155':3128
'94.##6.153.34':3128
'11#.#07.54.105':3128
'79.##5.138.210':3128
'21#.#86.180.198':3128
'77.##4.236.112':3128
'11#.#97.68.57':3128
'94.##6.153.36':3128
'46.##9.128.232':3128
'94.##6.147.201':3128
'89.##.81.192':3128
'18#.#29.211.240':3128
'87.##0.166.58':3128
'41.##1.187.109':3128
'80.##.120.34':3128
'82.##7.106.170':3128
'20#.#50.135.203':3128
'89.##1.53.103':3128
'92.##4.28.97':3128
'94.##6.149.53':3128
'92.##.243.106':3128
'83.##.172.192':3128
'82.##.35.158':3128
'78.##3.48.99':3128
'18#.#4.4.120':3128
'19#.#4.154.170':3128
'86.##.162.29':3128
'19#.#6.196.3':3128
'59.##3.48.251':3128
'81.##2.135.250':3128
'61.##.186.155':3128
'72.##2.178.250':3128
'67.##2.108.82':3128
'86.##1.54.123':3128
'92.##.241.64':3128
'41.##3.28.111':3128
'95.##.72.172':3128
'19#.#07.110.169':3128
'75.##.82.189':3128
'62.##2.67.102':3128
'84.##8.44.142':3128
'84.##9.176.160':3128
'77.##.45.219':3128
'11#.#6.206.49':3128
'93.##5.96.73':3128
'84.#0.86.22':3128
'18#.#2.218.50':3128
'89.##.108.104':6667
'19#.#46.180.21':6667
'41.##8.111.120':3128
'94.##6.146.205':3128
'79.##4.1.167':3128
'59.#1.33.0':3128
'11#.#98.101.145':3128
'19#.#27.184.216':3128
'91.##4.103.71':3128
'20#.#60.194.178':3128
'91.##.126.12':3128
'89.##.80.162':3128
'70.##5.74.83':3128
'94.##6.146.105':3128
'88.##2.122.35':3128
'84.#11.97.9':3128
'94.##6.148.92':3128
'74.#15.3.63':3128
'20#.#65.145.119':3128
'11#.#2.146.151':3128
'12#.#92.69.237':3128
'84.##9.184.136':3128
'11#.#9.2.101':3128
'84.##9.138.125':3128
'79.##9.36.109':3128
'95.##5.98.55':3128
'17#.#49.6.74':3128
'84.##2.70.104':3128
'41.##3.57.74':3128
'78.##.43.234':3128
'89.##.168.14':3128
'86.##0.189.195':3128
'89.##.101.81':3128
'89.##2.135.228':3128
'59.##.102.145':3128
'94.##6.149.239':3128
'79.##9.104.95':3128
'19#.#85.8.79':3128
'41.#5.62.41':3128
'20#.#57.91.231':3128
'11#.#2.72.149':3128
'11#.#6.12.94':3128
'60.##3.20.225':3128
'77.##3.65.222':3128
'62.##1.115.56':3128
'12#.#9.13.83':3128
'94.##6.152.130':3128
'78.##.23.155':3128
'92.#7.4.97':3128
'94.##6.149.118':3128
'89.##2.60.59':3128
'19#.#6.200.226':3128
'81.##.163.101':3128
'95.##4.28.71':3128
'80.##1.174.115':3128
'78.##.139.53':3128
'94.##6.155.159':3128
'82.##.166.118':3128
'62.##.110.66':3128
'92.##5.121.10':3128
'18#.#.125.28':3128
'92.##7.201.197':3128
'79.##7.166.45':3128
'79.##3.35.170':3128
'83.##2.81.217':3128
'79.##6.165.190':3128
'20#.#3.161.247':3128
'19#.#37.222.60':3128
'20#.#65.227.159':3128
'86.##0.189.194':3128
'88.##3.201.3':3128
'86.##0.21.36':3128
'78.##.47.250':3128
'78.#8.99.95':3128
'94.##.56.138':3128
'18#.6.202.2':3128
'94.##6.156.237':3128
'94.##6.144.57':3128
'85.#7.35.85':3128
'62.##8.214.33':3128
'85.##6.113.144':3128
'87.##6.203.32':3128
'91.##6.44.35':3128
'92.##1.107.253':3128
'94.##6.158.155':3128
'88.##7.155.122':3128
'78.##.232.183':3128
'89.##.224.65':3128
'94.##6.147.158':3128
'11#.#96.232.85':3128
'80.##.188.68':3128
'94.##6.150.243':3128
'78.##.78.221':3128
'24.##4.181.228':3128
'84.##.149.232':3128
'92.#0.59.38':3128
'58.##3.45.98':3128
'93.##3.85.241':3128
'11#.#98.109.125':3128
'16#.9.22.67':3128
'89.##3.40.98':3128
'62.##1.128.84':3128
'94.##6.155.249':3128
'41.##5.12.152':3128
'78.##.166.73':3128
'18#.#08.36.193':3128
'18#.#16.148.126':3128
'85.##1.145.247':3128
'41.##3.57.72':3128
'86.##6.40.27':3128
'50.##.232.29':3128
'10#.#0.50.238':3128
'92.##.248.15':3128
'92.##.245.11':3128
'93.##5.208.118':3128
'12#.#36.94.191':3128
'74.##7.87.52':3128
'93.##3.222.119':3128
'94.##6.150.121':3128
'14#.#16.0.210':3128
'20#.#1.160.62':3128
'86.##6.81.92':3128
'94.##6.148.213':3128
'94.##6.153.203':3128
'89.#2.96.82':3128
'12#.#62.86.188':3128
'78.##.82.109':3128
'94.##6.154.70':3128
'78.##9.161.87':3128
'41.##0.173.38':3128
'98.##3.105.97':3128
'94.##6.156.213':3128
'20#.#07.17.49':3128
'61.##.131.206':3128
'94.##1.201.243':3128
'99.##.32.185':3128
'11#.#52.191.187':3128
'77.##.53.121':3128
'85.##0.60.241':3128
'94.##6.156.32':3128
'89.##.230.250':3128
'20#.#09.96.163':3128
'78.##9.1.150':3128
'18#.35.8.68':3128
'78.#6.12.82':3128
'87.#46.11.6':3128
'92.##4.208.205':3128
'95.##.234.232':3128
'21#.#2.160.203':3128
'81.##0.16.14':3128
'12#.#94.149.243':3128
'93.##.11.156':3128
'94.##6.151.45':3128
'77.##.118.252':3128
'94.##9.250.181':3128
'84.##8.29.234':3128
'89.#2.4.83':3128
'93.##.122.243':3128
'95.#6.51.47':3128
'18#.#9.227.204':3128
'84.##7.139.199':3128
'94.##6.147.88':3128
'85.##8.141.216':3128
'94.##6.149.211':3128
'19#.#7.47.227':3128
'19#.#9.245.131':3128
'18#.#20.95.240':3128
'18#.#5.48.10':3128
'41.##1.251.106':3128
'10#.#6.243.83':3128
'18#.#2.38.238':3128
'19#.#51.53.33':3128
'46.##9.27.48':3128
'22#.#7.108.247':3128
'84.##8.227.138':3128
'84.##9.80.141':3128
'89.#9.7.238':3128
'11#.#98.170.191':3128
'74.#15.5.41':3128
'18#.#20.226.164':3128
'89.##.254.120':3128
'78.##.20.221':3128
'85.##0.81.228':3128
'95.##0.157.245':3128
'79.##7.160.125':3128
'89.##3.69.41':3128
'77.##8.216.234':3128
'89.##.108.104':3128
'82.##8.116.81':3128
'77.##3.72.98':3128
'19#.#19.160.131':3128
'94.##6.156.89':3128
'94.##6.156.119':3128
'20#.#17.51.159':3128
'41.##.90.154':3128
'18#.#60.130.151':3128
'60.##0.147.209':3128
'79.##7.30.226':3128
'19#.#7.109.49':3128
'18#.#24.141.55':3128
'41.##8.191.212':3128
'82.##0.33.111':3128
'86.##1.149.169':3128
'88.##7.40.236':3128
'94.##6.158.27':3128
'84.##8.28.117':3128
'95.##.72.156':3128
'20#.#4.201.167':3128
'93.#6.8.136':3128
'89.##6.1.150':3128
'83.##8.197.86':3128
'85.##.232.220':3128
'95.#8.75.24':3128
'89.##8.74.52':3128
'67.##7.214.159':3128
'87.##1.19.76':3128
'46.##.73.184':3128
'22#.#58.173.198':3128
'78.##.242.233':3128
'72.##2.97.248':3128
'83.##5.73.118':3128
'18#.#12.138.52':3128
'62.##.252.61':3128
'86.##.33.178':3128
'94.##6.152.167':3128
'85.##6.104.184':3128
'84.##9.105.63':3128
'89.#5.254.3':3128
'95.##3.154.207':3128
'11#.#97.71.248':3128
'94.##6.99.105':3128
'94.##6.149.186':3128
'94.##6.157.99':3128
'93.##8.220.203':3128
'82.##2.103.247':3128
'87.##2.183.69':3128
'77.##1.28.60':3128
'86.##6.237.212':3128
'11#.#11.82.133':3128
'12#.#18.153.19':3128
'85.##4.89.245':3128
'20#.#48.28.235':3128
'17#.#48.244.217':3128
'67.##4.210.177':3128
'93.##.137.41':3128
'94.##6.147.140':3128
'19#.#01.23.168':3128
'20#.#54.153.36':3128
'94.##6.144.56':3128
'77.##.149.22':3128
'19#.#02.249.67':3128
'95.##4.18.47':3128
'92.##5.120.213':3128
'62.##3.176.118':3128
'94.##6.153.119':3128
'20#.#00.210.36':3128
'81.##2.174.151':3128
'85.##1.20.240':3128
'18#.#20.61.174':3128
'72.##6.103.194':3128
'95.#7.9.27':3128
'21#.#2.112.145':3128
'82.##.209.244':3128
'94.##6.149.13':3128
'20#.#1.232.181':3128
'18#.#12.160.18':3128
'93.##3.49.61':3128
'59.##.15.194':3128
'84.##8.152.171':3128
'92.##.125.81':3128
'78.##7.180.250':3128
'95.##.154.138':3128
'94.##6.149.46':3128
'19#.#55.209.74':3128
'65.#5.67.65':3128
'19#.#5.26.198':3128
'88.##6.111.111':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней