Trojan.DownLoader4.48350

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Wmmvsvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SCardPrv] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c d.bat "<Полный путь к вирусу>"
<SYSTEM32>\svchost.exe -k Wmmvsvc
<SYSTEM32>\svchost.exe -k SCardPrv

Изменения в файловой системе:

Создает следующие файлы:

<Текущая директория>\d.bat
<SYSTEM32>\KB25879.dat
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
<SYSTEM32>\scardprv.dll
<SYSTEM32>\Wmmvsvc.dll
<SYSTEM32>\mssscardprv.ax

Самоудаляется.

Сетевая активность:

Подключается к:

'22#.#47.146.33':445
'17#.#05.247.10':445
'18#.#44.1.12':445
'18#.#44.1.11':445
'34.##3.204.14':80
'21#.#26.39.18':445
'18#.#44.1.13':445
'22#.#47.146.34':139
'21#.#26.39.20':445
'21#.#26.39.19':445
'22#.#47.146.34':445
'17#.#05.247.11':445
'22#.#47.146.30':445
'21#.#26.39.15':445
'17#.#05.247.7':445
'22#.#47.146.29':445
'21#.#26.39.14':445
'17#.#05.247.6':445
'21#.#26.39.17':445
'22#.#47.146.32':445
'17#.#05.247.9':445
'22#.#47.146.31':445
'21#.#26.39.16':445
'17#.#05.247.8':445
'17#.#05.247.12':445
'18#.#44.1.14':139
'2.###.163.18':139
'34.##3.204.15':445
'17#.#1.163.18':445
'22#.#47.146.35':445
'9.#.175.17':80
'22#.#47.146.36':445
'17#.#1.163.18':80
'22#.#47.146.35':80
'34.##3.204.15':80
'17#.#05.247.12':80
'21#.#26.39.21':445
'2.###.163.17':445
'2.###.163.18':445
'17#.#05.247.11':139
'2.###.163.16':445
'18#.#44.1.14':445
'68.#4.255.9':445
'17#.#05.247.11':80
'9.#.175.17':445
'25.##2.198.8':445
'17#.#1.163.17':80
'22#.#47.146.34':80
'22#.#47.146.13':80
'21#.#26.39.4':80
'18#.#44.1.10':80
'18#.#44.1.10':445
'34.##3.204.14':445
'34.##3.204.14':139
'22#.#47.146.15':445
'22#.#47.146.16':445
'22#.#47.146.17':445
'17#.#05.247.2':80
'25.##2.198.7':80
'22#.#47.146.14':445
'2.###.163.15':445
'9.#.175.16':445
'25.##2.198.6':80
'68.#4.255.7':445
'17#.#05.247.1':80
'68.#4.255.8':445
'22#.#47.146.13':445
'17#.#05.247.2':445
'25.##2.198.7':445
'18#.144.1.9':80
'21#.#26.39.4':445
'34.##3.204.13':80
'22#.#47.146.26':445
'17#.#05.247.3':445
'9.#.175.16':80
'22#.#47.146.24':445
'22#.#47.146.25':445
'21#.#26.39.10':445
'22#.#47.146.28':445
'21#.#26.39.13':445
'17#.#05.247.5':445
'22#.#47.146.27':445
'21#.#26.39.12':445
'17#.#05.247.4':445
'21#.#26.39.5':445
'68.#4.255.8':80
'22#.#47.146.21':445
'22#.#47.146.18':445
'22#.#47.146.19':445
'22#.#47.146.20':445
'22#.#47.146.23':445
'21#.#26.39.8':445
'21#.#26.39.9':445
'21#.#26.39.6':445
'22#.#47.146.22':445
'21#.#26.39.7':445
'17#.#05.247.31':445
'17#.#05.247.32':445
'17#.#05.247.33':445
'17#.#05.247.28':445
'17#.#05.247.29':445
'17#.#05.247.30':445
'17#.#05.247.37':445
'17#.#05.247.37':139
'9.#.175.21':445
'17#.#05.247.34':445
'17#.#05.247.35':445
'17#.#05.247.36':445
'17#.#05.247.19':139
'17#.#05.247.20':445
'17#.#05.247.21':445
'9.#.175.20':445
'21#.#26.39.23':139
'9.#.175.20':139
'17#.#05.247.25':445
'17#.#05.247.26':445
'17#.#05.247.27':445
'17#.#05.247.22':445
'17#.#05.247.23':445
'17#.#05.247.24':445
'2.###.163.19':139
'68.##.255.10':139
'18#.#44.1.15':139
'22#.#47.146.56':80
'9.#.175.21':139
'17#.#1.163.19':139
'9.#.175.21':80
'68.##.255.10':80
'17#.#1.163.19':80
'34.##3.204.29':139
'21#.#26.39.24':139
'17#.#05.247.38':139
'34.##3.204.28':80
'18#.#44.1.15':445
'21#.#26.39.23':80
'17#.#1.163.19':445
'2.###.163.18':80
'68.##.255.10':445
'34.##3.204.29':445
'21#.#26.39.24':445
'17#.#05.247.38':445
'17#.#05.247.37':80
'25.##2.198.9':445
'2.###.163.19':445
'22#.#47.146.47':445
'34.##3.204.20':445
'22#.#47.146.48':445
'34.##3.204.18':445
'22#.#47.146.46':445
'34.##3.204.19':445
'22#.#47.146.50':445
'18#.#44.1.14':80
'17#.#05.247.13':445
'34.##3.204.21':445
'22#.#47.146.49':445
'34.##3.204.22':445
'22#.#47.146.40':445
'22#.#47.146.41':445
'22#.#47.146.42':445
'22#.#47.146.37':445
'22#.#47.146.38':445
'22#.#47.146.39':445
'22#.#47.146.44':445
'34.##3.204.17':445
'22#.#47.146.45':445
'22#.#47.146.43':445
'34.##3.204.16':445
'68.#4.255.9':80
'34.##3.204.28':445
'9.#.175.18':445
'25.##2.198.8':80
'34.##3.204.27':445
'22#.#47.146.55':445
'17#.#05.247.18':445
'22#.#47.146.56':139
'9.#.175.19':445
'21#.#26.39.23':445
'22#.#47.146.56':445
'17#.#05.247.19':445
'21#.#26.39.22':445
'34.##3.204.24':445
'22#.#47.146.52':445
'17#.#05.247.15':445
'34.##3.204.23':445
'22#.#47.146.51':445
'17#.#05.247.14':445
'22#.#47.146.54':445
'34.##3.204.26':445
'17#.#05.247.17':445
'34.##3.204.25':445
'22#.#47.146.53':445
'17#.#05.247.16':445
'2.##4.163.7':445
'18#.#0.209.155':445
'17.##.114.199':445
'9.#.175.7':445
'13.##9.46.180':445
'18#.#44.1.238':445
'9.#.175.8':139
'66.##0.242.208':445
'21#.#26.39.1':445
'21#.#26.39.0':445
'9.#.175.8':445
'18#.144.1.0':445
'10#.#09.245.179':445
'2.##4.163.5':445
'1.##.23.132':445
'2.##4.163.4':445
'22#.#.204.215':445
'9.#.175.5':445
'2.##4.163.6':445
'13#.#39.178.255':445
'21#.#26.39.11':445
'23#.#1.78.224':445
'9.#.175.6':445
'16#.#.48.176':445
'34.##3.204.2':445
'22#.#47.146.0':445
'25.##2.198.0':445
'22#.#47.146.134':445
'34.##3.204.1':445
'25.##2.198.109':445
'17#.#05.247.89':445
'17#.#05.247.0':445
'2.##4.163.7':80
'22#.#47.146.1':445
'68.##.255.146':445
'68.#4.255.0':445
'11#.#26.154.191':445
'17#.#1.163.72':445
'18#.144.1.1':139
'20#.#24.52.37':445
'18#.144.1.1':445
'81.##.181.108':445
'17#.#1.163.1':445
'34.##3.204.0':445
'61.##.143.45':445
'34.##3.204.10':445
'14#.#58.175.90':445
'17#.#1.163.0':445
'20#.#22.45.142':445
'14#.#25.72.239':445
'17#.#57.174.14':445
'83.##8.114.166':445
'52.##9.240.209':445
'18#.#00.33.128':445
'21#.#9.93.213':445
'23#.#3.106.53':445
'69.#.74.20':445
'72.##3.235.121':445
'68.##0.158.86':445
'59.##7.94.33':445
'wpad.localdomain':80
'5.##.248.2':445
'13#.#02.125.164':445
'<IP-адрес в локальной сети>':445
'<IP-адрес в локальной сети>':139
'<IP-адрес в локальной сети>':80
'13#.#1.3.169':445
'15#.#04.220.32':445
'11#.#02.240.202':445
'13#.#9.172.104':445
'14#.#7.47.218':445
'22#.#48.121.93':445
'91.##8.31.180':445
'9.#.175.3':445
'73.##7.49.217':445
'9.#.175.2':445
'86.##.165.87':445
'2.##4.163.2':445
'15#.#77.82.103':445
'15.##.112.62':445
'16#.#53.193.168':445
'19#.#32.75.208':445
'2.##4.163.3':445
'9.#.175.4':445
'2.###.163.27':445
'18#.#2.133.154':445
'9.#.175.0':445
'14#.#4.39.159':445
'85.##6.100.111':445
'9.#.175.180':445
'60.##2.201.225':445
'2.##4.163.1':445
'4.###.64.149':445
'2.##4.163.0':445
'13#.#09.77.175':445
'9.#.175.1':445
'22#.#47.146.12':445
'17#.#1.163.2':445
'17#.#1.163.3':445
'2.###.163.14':445
'18#.144.1.9':445
'22#.#47.146.11':445
'18#.144.1.9':139
'25.##2.198.6':139
'2.###.163.14':139
'17#.#05.247.1':445
'21#.#26.39.3':445
'9.#.175.15':139
'68.#4.255.6':445
'9.#.175.14':445
'22#.#47.146.9':445
'2.###.163.12':445
'34.##3.204.8':445
'18#.144.1.7':445
'18#.144.1.8':445
'9.#.175.15':445
'22#.#47.146.10':445
'25.##2.198.6':445
'2.###.163.13':445
'34.##3.204.9':445
'17#.#1.163.13':445
'34.##3.204.11':445
'17#.#1.163.14':445
'17#.#1.163.11':445
'22#.#47.146.12':80
'17#.#1.163.12':445
'17#.#1.163.16':445
'34.##3.204.13':139
'17#.#1.163.17':445
'34.##3.204.12':445
'17#.#1.163.15':445
'34.##3.204.13':445
'9.#.175.15':80
'21#.#26.39.3':80
'17#.#1.163.4':445
'34.##3.204.9':80
'17#.#1.163.3':80
'2.###.163.14':80
'17#.#1.163.8':445
'17#.#1.163.9':445
'17#.#1.163.10':445
'17#.#1.163.5':445
'17#.#1.163.6':445
'17#.#1.163.7':445
'18#.144.1.2':445
'9.#.175.9':445
'22#.#47.146.4':445
'22#.#47.146.3':445
'68.#4.255.1':445
'34.##3.204.3':445
'34.##3.204.4':445
'68.#4.255.2':445
'18#.144.1.3':445
'2.##4.163.8':445
'25.##2.198.1':445
'21#.#26.39.2':80
'68.#4.255.0':139
'34.##3.204.2':139
'25.##2.198.0':80
'9.#.175.8':80
'21#.#26.39.1':80
'18#.144.1.1':80
'17#.#05.247.0':80
'22#.#47.146.2':445
'21#.#26.39.2':139
'22#.#47.146.1':80
'68.#4.255.0':80
'21#.#26.39.2':445
'22#.#47.146.7':445
'25.##2.198.4':445
'2.###.163.11':445
'18#.144.1.5':445
'68.#4.255.4':445
'9.#.175.12':445
'9.#.175.13':445
'22#.#47.146.8':445
'25.##2.198.5':445
'34.##3.204.7':445
'18#.144.1.6':445
'68.#4.255.5':445
'25.##2.198.2':445
'34.##3.204.5':445
'18#.144.1.4':445
'9.#.175.10':445
'22#.#47.146.5':445
'2.##4.163.9':445
'25.##2.198.3':445
'2.###.163.10':445
'34.##3.204.6':445
'68.#4.255.3':445
'9.#.175.11':445
'22#.#47.146.6':445

TCP:

Запросы HTTP GET:

wpad.localdomain/wpad.dat

UDP:

DNS ASK wpad.localdomain

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней