Trojan.Siggen2.50990

Добавлен в вирусную базу Dr.Web: 2011-07-07

Описание добавлено: 2011-07-07

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'11#.#2.163.177':3128
'84.##5.6.160':3128
'92.#3.24.91':3128
'15#.#48.198.108':3128
'11#.#60.145.71':3128
'21#.#2.200.158':3128
'79.##5.203.70':3128
'11#.#4.67.203':3128
'12#.#18.153.19':3128
'89.##2.12.19':3128
'77.##.201.143':3128
'77.##.126.21':3128
'94.##2.176.24':3128
'93.##6.235.9':3128
'77.##.127.210':3128
'11#.#04.65.177':3128
'19#.#07.110.169':3128
'65.#5.67.65':3128
'89.#05.51.2':3128
'62.##.252.61':3128
'61.##.190.105':3128
'18#.#27.115.60':3128
'92.#7.4.97':3128
'11#.#41.136.60':3128
'11#.#04.66.225':3128
'20#.#17.38.92':3128
'78.##.47.250':3128
'22#.#7.108.237':3128
'10#.#1.62.113':3128
'50.##.232.29':3128
'16#.9.22.67':3128
'95.##.134.226':3128
'11#.#6.12.94':3128
'86.##4.74.171':3128
'41.##7.156.32':3128
'88.##6.79.53':3128
'20#.#17.51.159':3128
'20#.#50.143.32':3128
'11#.#2.72.149':3128
'19#.#9.209.53':3128
'77.##.185.54':3128
'61.##3.112.248':3128
'61.#7.39.19':3128
'10#.#71.47.26':3128
'11#.#54.127.193':3128
'19#.#3.161.26':3128
'11#.#05.103.72':3128
'11#.#48.103.131':3128
'74.##7.86.201':3128
'84.##8.169.238':3128
'18#.#2.254.74':3128
'17#.#47.21.48':3128
'11#.#04.64.215':3128
'79.##2.22.193':3128
'82.##2.103.247':3128
'61.#7.72.54':3128
'86.##6.40.27':3128
'20#.#55.24.198':3128
'85.##0.81.228':3128
'20#.#39.135.118':3128
'18#.#26.83.3':3128
'17#.#14.135.5':3128
'86.##1.149.169':3128
'95.##8.254.210':3128
'20#.#49.163.95':3128
'20#.#4.130.196':3128
'94.##0.72.71':3128
'18#.#77.136.55':3128
'77.##1.241.91':3128
'87.##0.166.58':3128
'18#.#1.138.22':3128
'91.##6.161.236':3128
'62.##3.159.36':3128
'20#.#15.120.164':3128
'11#.#04.64.61':3128
'12#.#94.149.243':3128
'78.##2.45.86':3128
'95.##.128.137':3128
'18#.#4.24.219':3128
'95.##.147.162':3128
'21#.#43.149.110':3128
'18#.#5.48.22':3128
'11#.#6.129.216':3128
'14.##9.62.73':3128
'60.##.85.143':3128
'19#.#85.16.45':3128
'77.##.201.222':3128
'21#.#5.88.163':3128
'20#.#8.233.200':3128
'59.##.10.172':3128
'89.#.168.48':3128
'61.##.250.146':3128
'12#.#23.132.149':3128
'19#.#7.188.133':3128
'93.##.103.16':3128
'18#.#1.143.232':3128
'59.##3.48.185':3128
'20#.#32.61.93':3128
'11#.#04.66.127':3128
'77.##4.225.119':3128
'12#.#65.113.104':3128
'10#.#91.70.38':3128
'18#.35.7.79':3128
'85.##2.151.183':3128
'85.##4.89.245':3128
'21#.#28.85.189':3128
'89.##.211.144':3128
'20#.#8.99.196':3128
'17#.#4.66.168':3128
'79.##9.46.118':3128
'59.##2.119.76':3128
'62.##8.214.33':3128
'10#.#6.243.83':3128
'20#.#73.77.197':3128
'89.##.230.250':3128
'95.##8.71.32':3128
'20#.#07.17.49':3128
'94.##.95.151':3128
'95.##.214.37':3128
'17#.#65.19.33':3128
'22#.#0.202.5':3128
'22#.#43.58.94':3128
'18#.#24.50.225':3128
'11#.#3.132.37':3128
'18#.#14.34.197':3128
'62.##3.174.192':3128
'95.##5.98.55':3128
'19#.#21.91.228':3128
'85.##6.104.184':3128
'18#.3.133.9':3128
'18#.#73.179.240':3128
'94.##3.214.135':3128
'18#.#6.246.59':3128
'11#.#42.61.2':3128
'20#.#91.121.215':3128
'11#.#96.251.37':3128
'20#.#6.10.44':3128
'60.##3.109.105':3128
'46.##8.243.74':3128
'95.##.137.159':3128
'12#.#38.164.104':3128
'61.##7.51.250':3128
'78.#.107.45':3128
'77.##.206.128':3128
'46.#6.7.189':3128
'15#.#00.14.36':3128
'89.##8.177.68':3128
'82.##4.68.29':3128
'89.##3.69.41':3128
'59.##.239.205':3128
'20#.#8.234.251':3128
'41.##0.216.178':3128
'19#.#6.196.3':3128
'17#.#1.27.108':3128
'87.##6.203.32':3128
'11#.#00.74.40':3128
'11#.#41.32.76':3128
'58.##5.26.196':3128
'11#.#3.15.146':3128
'62.##.110.66':3128
'20#.#01.45.5':3128
'21#.#43.134.221':3128
'18#.#5.48.25':3128
'20#.#31.19.250':3128
'78.##.107.141':3128
'67.##7.193.91':3128
'21#.#02.24.139':3128
'60.##3.48.164':3128
'18#.#5.79.88':3128
'11#.#52.191.187':3128
'46.##7.131.42':3128
'88.##5.124.94':3128
'11#.#6.206.49':3128
'89.##0.164.105':3128
'94.##1.188.45':3128
'78.##.36.136':3128
'20#.#2.23.68':3128
'79.##5.253.7':3128
'18#.#36.205.149':3128
'89.##.107.28':3128
'41.##0.11.47':3128
'17#.#8.103.140':3128
'11#.#04.67.227':3128
'17#.#12.25.136':3128
'78.##.242.233':3128
'94.##3.218.50':3128
'69.##1.133.219':3128
'11#.#06.185.208':3128
'12#.#71.120.81':3128
'69.##.67.191':3128
'84.##9.151.212':3128
'11#.#04.75.42':3128
'11#.#04.68.47':3128
'93.##5.96.73':3128
'19#.#55.209.74':3128
'93.#6.8.51':3128
'10#.#62.166.123':3128
'58.#.140.217':3128
'86.##6.237.212':3128
'12#.#37.192.209':3128
'11#.#41.136.43':3128
'84.#2.63.48':3128
'18#.#62.62.157':3128
'13#.#.157.199':3128
'41.##1.251.106':3128
'11#.#97.145.76':3128
'11#.#04.66.49':3128
'22#.#6.233.35':3128
'79.##1.57.140':3128
'89.##3.134.172':3128
'18#.#6.217.65':3128
'86.##4.105.55':3128
'11#.#93.169.106':3128
'59.##3.48.134':3128
'21#.#6.25.163':3128
'85.##8.190.244':3128
'83.##5.73.118':3128
'11#.#04.71.69':3128
'80.##.188.68':3128
'59.##.209.131':3128
'18#.#1.137.168':3128
'78.#.127.239':3128
'12#.#92.69.237':3128
'20#.#1.160.62':3128
'58.##2.109.245':3128
'12#.#36.93.222':3128
'82.##8.18.125':3128
'77.##.98.122':3128
'92.##.38.223':3128
'59.#6.91.50':3128
'72.##.139.113':3128
'17#.#56.140.88':3128
'19#.#38.90.146':3128
'46.##8.47.71':3128
'19#.#3.163.49':3128
'85.##.42.152':3128
'62.##9.196.203':3128
'20#.#32.229.247':3128
'46.##0.52.17':3128
'21#.#86.183.4':3128
'11#.#00.4.234':3128
'77.##.45.219':3128
'11#.#93.72.178':3128
'19#.#2.186.19':3128
'81.##2.134.118':3128
'18#.#73.201.5':3128
'11#.#1.17.235':3128
'77.##.203.210':3128
'20#.#64.238.149':3128
'85.##6.113.144':3128
'18#.#54.103.138':3128
'11#.#2.188.34':3128
'74.#15.3.63':3128
'11#.#41.137.13':3128
'11#.#04.66.33':3128
'93.##5.193.97':3128
'19#.#6.10.24':3128
'21#.#1.54.134':3128
'81.##.215.203':3128
'18#.#8.112.37':3128
'11#.#04.67.136':3128
'11#.#6.109.252':3128
'11#.44.7.63':3128
'11#.#04.69.72':3128
'46.##8.12.209':3128
'77.##.209.21':3128
'11#.#7.66.250':3128
'68.##.102.81':3128
'82.##8.19.32':3128
'93.##3.175.22':3128
'94.##3.207.94':3128
'21#.#19.69.150':3128
'10#.#0.50.238':3128
'12#.#27.66.14':3128
'77.##.17.175':3128
'18#.#6.44.154':3128
'78.##9.165.59':3128
'11#.#42.62.1':3128
'11#.#4.75.133':3128
'46.##9.55.182':3128
'18#.#1.142.97':3128
'41.##1.36.126':3128
'86.##6.156.189':3128
'77.##2.209.214':3128
'89.#3.210.7':3128
'20#.#65.242.198':3128
'18#.#4.141.92':3128
'12#.#05.186.8':3128
'19#.#02.14.162':3128
'18#.#.62.166':3128
'22#.#43.57.30':3128
'85.##8.182.128':3128
'18#.#20.226.164':3128
'59.#.103.175':3128
'83.##8.82.159':3128
'19#.#42.147.154':3128
'21#.#96.75.122':3128
'18#.#09.164.118':3128
'62.##3.176.118':3128
'18#.2.88.72':3128
'18#.#12.138.52':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней