Trojan.DownLoader3.63827

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'86.##3.31.54':3128
'1.##.150.111':3128
'18#.#29.218.150':3128
'89.##2.4.225':3128
'17#.#23.44.93':3128
'19#.#55.209.74':3128
'82.##9.165.28':3128
'18#.#20.91.116':3128
'59.##3.48.53':3128
'94.##.112.74':3128
'18#.#5.9.149':3128
'46.#9.67.20':3128
'94.##.56.138':3128
'11#.#6.206.49':3128
'12#.#78.65.249':3128
'16#.9.22.67':3128
'46.##9.27.48':3128
'11#.#37.86.98':3128
'12#.#9.88.129':3128
'11#.#8.79.41':3128
'61.##.131.206':3128
'18#.#18.81.191':3128
'21#.#09.80.142':3128
'20#.#32.21.165':3128
'79.##2.91.208':3128
'86.##6.237.212':3128
'11#.#0.239.202':3128
'19#.#05.12.237':3128
'78.##4.140.172':3128
'86.#7.89.35':3128
'81.#0.0.18':3128
'46.##6.155.13':3128
'82.##7.106.170':3128
'88.##5.193.47':3128
'80.##.120.34':3128
'31.#.140.210':3128
'17#.#25.201.94':3128
'12#.#1.184.203':3128
'18#.#6.239.214':3128
'17#.#33.138.146':3128
'19#.#8.223.124':3128
'85.##.156.118':3128
'87.##6.74.225':3128
'91.##.126.12':3128
'85.##6.104.184':3128
'19#.#.103.21':3128
'11#.#07.21.34':3128
'86.##3.143.34':3128
'10#.#7.192.82':3128
'10#.#39.40.50':3128
'20#.#66.43.130':3128
'89.##.218.70':3128
'83.##8.82.159':3128
'11#.#52.56.220':3128
'95.##.50.233':3128
'78.##.47.250':3128
'83.##2.81.217':3128
'21#.#13.246.28':3128
'79.##5.253.7':3128
'19#.#3.151.16':3128
'18#.#2.216.51':3128
'22#.#43.61.190':3128
'20#.#12.129.137':3128
'88.##8.146.177':3128
'12#.#92.69.237':3128
'20#.#17.51.159':3128
'87.##6.203.32':3128
'95.##.194.164':3128
'17#.#23.54.228':3128
'46.##.53.183':3128
'20#.#48.243.134':3128
'19#.#4.73.134':3128
'19#.#18.179.26':3128
'50.##.133.19':3128
'89.##7.75.85':3128
'41.##5.12.152':3128
'41.##1.75.228':3128
'11#.#9.2.101':3128
'18#.#30.82.40':3128
'41.##1.74.239':3128
'11#.#6.12.94':3128
'94.##6.145.173':3128
'22#.#58.173.198':3128
'80.##.202.126':3128
'89.##4.139.50':3128
'79.##6.165.190':3128
'41.##3.25.235':3128
'41.##4.180.37':3128
'20#.#3.53.212':3128
'92.#7.4.97':3128
'92.##5.119.253':3128
'19#.#2.90.65':3128
'83.##8.197.86':3128
'78.##9.161.87':3128
'87.##1.19.76':3128
'21#.#96.68.177':3128
'12#.#31.201.68':3128
'85.##1.145.247':3128
'20#.#49.127.77':3128
'94.##9.250.181':3128
'83.##.172.192':3128
'18#.#30.192.195':3128
'82.##0.33.111':3128
'12#.#60.42.118':3128
'84.##.69.185':3128
'18#.#63.14.0':3128
'12#.#65.113.62':3128
'41.##3.57.74':3128
'84.##8.105.142':3128
'18#.#8.130.143':3128
'78.##7.180.250':3128
'18#.#73.49.47':3128
'11#.#52.241.216':3128
'19#.#7.45.175':3128
'77.##2.62.127':3128
'78.#9.76.18':3128
'94.##.136.173':3128
'87.##9.73.144':3128
'95.##.43.209':3128
'18#.#7.65.57':3128
'11#.#6.125.169':3128
'17#.#1.27.162':3128
'18#.#96.142.123':3128
'93.##3.85.241':3128
'21#.#11.249.148':3128
'18#.#88.253.13':3128
'88.##6.111.111':3128
'17#.#0.145.197':3128
'78.#7.50.29':3128
'12#.#6.219.206':3128
'18#.#2.242.128':3128
'41.##1.77.33':3128
'41.##5.78.172':3128
'95.##8.56.82':3128
'94.##4.41.159':3128
'18#.#96.138.106':3128
'89.#3.210.7':3128
'94.##.129.207':3128
'95.##.61.119':3128
'11#.#1.185.189':3128
'77.##3.37.253':3128
'92.##4.107.208':3128
'12#.#27.65.181':3128
'10#.#7.133.180':3128
'10#.#6.243.83':3128
'60.##8.114.171':3128
'99.##9.85.175':3128
'10#.#39.36.54':3128
'11#.#9.129.136':3128
'11#.#8.214.212':3128
'19#.#07.110.169':3128
'20#.#4.201.167':3128
'87.##0.166.58':3128
'41.##.162.210':3128
'11#.#2.72.149':3128
'12#.#36.25.75':3128
'18#.#12.138.52':3128
'41.##1.112.152':3128
'94.##8.215.205':3128
'27.##.34.144':3128
'94.##.107.65':3128
'41.##3.57.76':3128
'21#.#11.222.2':3128
'11#.#8.196.60':3128
'46.##.73.184':3128
'21#.#27.80.51':3128
'19#.#51.53.33':3128
'11#.#24.216.244':3128
'78.##.217.138':3128
'18#.#77.138.92':3128
'95.##4.33.171':3128
'62.##8.214.33':3128
'78.##.242.233':3128
'14.##5.130.95':3128
'18#.#29.211.240':3128
'18#.#2.80.42':3128
'92.##.156.249':3128
'92.##5.120.56':3128
'18#.#29.171.243':3128
'67.##7.198.35':3128
'12#.#38.17.64':3128
'92.##5.151.107':3128
'50.##.246.189':3128
'17#.#50.60.10':3128
'17#.#23.190.206':3128
'20#.#7.218.96':3128
'94.##8.129.185':3128
'94.#2.57.11':3128
'18#.#29.211.24':3128
'78.##.160.45':3128
'10#.#0.50.238':3128
'96.##.68.136':3128
'18#.#2.150.202':3128
'11#.#6.99.46':3128
'77.##7.205.28':3128
'18#.#29.215.124':3128
'85.##0.73.139':3128
'94.##.95.239':3128
'85.##0.81.228':3128
'82.##.125.210':3128
'93.##.61.137':3128
'82.##.238.16':3128
'92.##.85.163':3128
'20#.#53.86.208':3128
'94.##7.75.85':3128
'12#.#62.206.88':3128
'18#.#30.33.95':3128
'11#.#54.47.113':3128
'21#.#2.200.158':3128
'18#.#20.226.164':3128
'81.#8.61.41':3128
'11#.#93.161.122':3128
'79.##5.138.210':3128
'27.##5.56.137':3128
'95.##.129.248':3128
'46.##2.47.133':3128
'20#.#36.119.141':3128
'95.##.198.179':3128
'17#.#11.154.107':3128
'46.##.133.103':3128
'94.##6.159.103':3128
'20#.#62.60.235':3128
'86.##6.230.114':3128
'89.##.80.162':3128
'19#.#09.33.20':3128
'19#.#02.180.33':3128
'62.##3.176.118':3128
'21#.#33.174.238':3128
'12#.#53.128.30':3128
'18#.88.14.8':3128
'18#.#93.55.21':3128
'41.##3.57.72':3128
'11#.#52.191.187':3128
'10#.#39.46.219':3128
'21#.#5.88.163':3128
'94.##4.183.148':3128
'20#.#8.21.237':3128
'61.##.186.155':3128
'18#.#2.218.50':3128
'58.##3.125.236':3128
'11#.#93.128.2':3128
'21#.#.52.166':3128
'92.##.142.154':3128
'19#.#25.94.189':3128
'95.##.230.132':3128
'13#.#.157.199':3128
'22#.#7.108.247':3128
'18#.3.72.5':3128
'18#.#37.65.39':3128
'93.##5.96.73':3128
'24.##0.238.113':3128
'11#.#53.193.94':3128
'78.##.186.228':3128
'82.#28.3.71':3128
'11#.#64.192.24':3128
'2.###.52.138':3128
'11#.#7.11.143':3128
'20#.#32.61.93':3128
'11#.#9.2.129':3128
'12#.#25.64.82':3128
'18#.#15.160.10':3128
'18#.#15.36.80':3128
'21#.#75.4.226':3128
'20#.#11.203.98':3128
'84.##3.38.28':3128
'20#.#65.227.159':3128
'17#.#7.74.78':3128
'93.##3.49.61':3128
'11#.186.1.5':3128
'89.##4.70.215':3128
'10#.#.140.177':3128
'18#.#73.105.196':3128
'18#.#24.226.4':3128
'11#.#07.129.130':3128
'12#.#94.160.227':3128
'19#.#04.38.89':3128
'89.##0.164.105':3128
'11#.#00.211.107':3128
'91.##4.33.154':3128
'93.##.246.147':3128
'77.##0.180.124':3128
'82.##.88.127':3128
'89.##.230.250':3128
'20#.#48.139.95':3128
'76.#6.30.39':3128
'19#.#22.143.202':3128
'77.##6.167.28':3128
'46.##.133.16':3128
'82.##2.103.247':3128
'19#.#3.163.69':3128
'18#.#2.38.238':3128
'93.##8.250.214':3128
'89.#6.59.46':3128
'95.##.26.116':3128
'19#.#03.64.7':3128
'20#.#29.54.51':3128
'18#.#0.181.170':3128
'17#.#23.56.162':3128
'78.##3.48.99':3128
'17#.#22.71.119':3128
'21#.#18.119.40':3128
'86.##1.54.123':3128
'20#.#10.236.148':3128
'89.##3.128.162':3128
'11#.#6.124.137':3128
'89.##8.163.103':3128
'86.##6.40.27':3128
'11#.#52.7.105':3128
'95.##.175.189':3128
'20#.#1.160.62':3128
'95.##.174.183':3128
'17#.#26.2.11':3128
'11#.#97.17.82':3128
'77.##.45.219':3128
'41.##1.82.208':3128
'10#.#85.168.169':3128
'11#.#52.105.162':3128
'78.##.202.75':3128
'11#.#04.205.58':3128
'74.#15.3.63':3128
'41.##1.251.106':3128
'95.##.20.216':3128
'94.#0.39.72':3128
'89.##6.238.249':3128
'82.##8.19.32':3128
'89.##6.183.97':3128
'58.##7.129.53':3128
'22#.#30.69.202':3128
'12#.#18.153.19':3128
'95.##.131.253':3128
'21#.#12.254.186':3128
'79.##5.224.117':3128

UDP:

DNS ASK 19#.#25.http
DNS ASK ht##.#ocaldomain

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней