Trojan.DownLoader10.3468

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER0734.dir00\svchost.exe.mdmp 16325836412032744

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER0734.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#13.2.150':139
'21#.#13.5.207':139
'21#.#13.223.237':139
'21#.#13.215.197':139
'21#.#13.65.106':139
'21#.#13.151.74':139
'21#.#13.0.104':139
'21#.#13.194.93':139
'21#.#13.189.13':139
'21#.#13.196.13':139
'21#.#13.238.171':139
'21#.#13.125.22':139
'21#.#13.96.148':139
'21#.#13.40.224':139
'21#.#13.142.8':139
'21#.#13.129.99':139
'21#.#13.51.186':139
'21#.#13.16.172':139
'21#.#13.163.23':139
'21#.#13.75.238':139
'21#.#13.114.181':139
'21#.#13.12.142':139
'21#.#13.9.166':139
'21#.#13.71.175':445
'21#.#13.25.10':445
'21#.#13.176.52':445
'21#.#13.31.39':139
'21#.#13.107.16':139
'21#.#13.187.2':445
'21#.#13.241.214':445
'21#.#13.97.6':445
'21#.#13.57.180':445
'21#.#13.167.204':445
'21#.#13.75.242':445
'21#.#13.52.104':139
'21#.#13.51.163':139
'21#.#13.51.33':139
'21#.#13.191.219':139
'21#.#13.25.194':139
'21#.#13.85.103':139
'21#.#13.171.17':139
'21#.#13.184.181':139
'21#.#13.212.174':139
'21#.#13.149.87':139
'21#.#13.2.141':139
'21#.#13.104.107':139
'21#.#13.56.176':445
'21#.#13.55.145':445
'21#.#13.236.96':445
'21#.#13.128.32':445
'21#.#13.97.57':445
'21#.#13.34.105':445
'21#.#13.206.54':445
'21#.#13.60.217':445
'21#.#13.131.183':445
'21#.#13.164.150':445
'21#.#13.20.227':445
'21#.#13.206.109':445
'21#.#13.28.218':445
'21#.#13.204.234':445
'21#.#13.168.201':445
'21#.#13.252.67':445
'21#.#13.164.38':445
'21#.#13.104.131':445
'21#.#13.59.68':445
'21#.#13.27.210':445
'21#.#13.71.184':445
'21#.#13.23.94':445
'21#.#13.252.110':445
'21#.#13.57.180':139
'21#.#13.241.214':139
'21#.#13.75.242':139
'21#.#13.187.2':139
'21#.#13.167.204':139
'21#.#13.97.6':139
'21#.#13.113.172':139
'21#.#13.246.113':139
'21#.#13.117.208':139
'21#.#13.74.152':139
'21#.#13.79.176':139
'21#.#13.25.10':139
'21#.#13.151.172':445
'21#.#13.160.151':445
'21#.#13.33.73':445
'21#.#13.197.252':445
'21#.#13.79.105':445
'21#.#13.92.177':445
'21#.#13.176.52':139
'21#.#13.71.175':139
'21#.#13.15.253':445
'21#.#13.120.110':445
'21#.#13.43.175':445
'21#.#13.74.152':445
'21#.#13.26.156':139
'21#.#13.248.251':139
'21#.#13.204.92':139
'21#.#13.98.172':139
'21#.#13.94.11':139
'21#.#13.134.249':139
'21#.#13.89.77':139
'21#.#13.73.252':139
'21#.#13.30.173':139
'21#.#13.232.69':139
'21#.#13.195.225':139
'21#.#13.172.95':139
'21#.#13.244.97':139
'21#.#13.164.246':139
'21#.#13.34.112':139
'21#.#13.69.61':139
'21#.#13.234.129':139
'21#.#13.18.126':139
'21#.#13.235.25':139
'21#.#13.94.235':139
'21#.#13.20.0':139
'21#.#13.169.81':139
'21#.#13.116.206':139
'21#.#13.197.181':139
'21#.#13.65.197':139
'21#.#13.27.25':139
'21#.#13.79.145':139
'21#.#13.199.169':139
'21#.#13.70.228':139
'21#.#13.196.90':139
'21#.#13.3.145':139
'21#.#13.124.76':139
'21#.#13.75.212':139
'21#.#13.39.76':139
'21#.#13.16.197':139
'21#.#13.74.202':139
'21#.#13.165.17':139
'21#.#13.12.103':139
'21#.#13.182.50':139
'21#.#13.24.57':139
'21#.#13.62.84':139
'21#.#13.185.220':139
'21#.#13.36.37':139
'21#.#13.143.124':139
'21#.#13.236.184':139
'21#.#13.117.217':139
'21#.#13.125.22':445
'21#.#13.215.197':445
'21#.#13.75.238':445
'21#.#13.114.181':445
'21#.#13.163.23':445
'21#.#13.65.106':445
'21#.#13.151.74':445
'21#.#13.196.13':445
'21#.#13.5.207':445
'21#.#13.223.237':445
'21#.#13.2.150':445
'21#.#13.9.166':445
'21#.#13.246.113':445
'21#.#13.129.99':445
'21#.#13.113.172':445
'21#.#13.79.176':445
'21#.#13.117.208':445
'21#.#13.51.186':445
'21#.#13.16.172':445
'21#.#13.12.142':445
'21#.#13.40.224':445
'21#.#13.142.8':445
'21#.#13.96.148':445
'21#.#13.52.104':445
'21#.#13.31.39':445
'21#.#13.212.174':445
'21#.#13.149.87':445
'21#.#13.184.181':445
'21#.#13.107.16':445
'21#.#13.101.201':139
'21#.#13.180.211':139
'21#.#13.201.147':139
'21#.#13.41.43':139
'21#.#13.1.243':139
'21#.#13.104.107':445
'21#.#13.194.93':445
'21#.#13.25.194':445
'21#.#13.0.104':445
'21#.#13.238.171':445
'21#.#13.189.13':445
'21#.#13.85.103':445
'21#.#13.171.17':445
'21#.#13.2.141':445
'21#.#13.51.33':445
'21#.#13.191.219':445
'21#.#13.51.163':445
'21#.#13.29.148':445
'21#.#13.83.152':445
'21#.#13.46.238':445
'21#.#13.22.103':445
'21#.#13.79.102':445
'21#.#13.13.83':445
'21#.#13.49.66':445
'21#.#13.231.32':445
'21#.#13.166.49':445
'21#.#13.75.13':445
'21#.#13.154.74':445
'21#.#13.118.32':445
'21#.#13.200.176':139
'21#.#13.61.111':139
'21#.#13.51.32':139
'21#.#13.226.154':139
'21#.#13.181.226':139
'21#.#13.236.140':445
'21#.#13.42.135':445
'21#.#13.78.68':445
'21#.#13.209.187':445
'21#.#13.132.240':445
'21#.#13.179.81':445
'21#.#13.209.117':445
'21#.#13.209.73':445
'21#.#13.240.80':445
'21#.#13.13.76':445
'21#.#13.150.15':445
'21#.#13.99.29':445
'21#.#13.116.99':445
'21#.#13.223.76':445
'21#.#13.26.246':445
'21#.#13.223.241':445
'21#.#13.133.215':445
'21#.#13.183.3':445
'21#.#13.9.57':445
'21#.#13.157.9':445
'21#.#13.57.54':445
'21#.#13.109.109':445
'21#.#13.19.215':445
'21#.#13.50.157':445
'21#.#13.197.42':445
'21#.#13.187.40':445
'21#.#13.182.207':445
'21#.#13.242.218':445
'21#.#13.158.81':445
'21#.#13.166.49':139
'21#.#13.49.66':139
'21#.#13.154.74':139
'21#.#13.13.83':139
'21#.#13.75.13':139
'21#.#13.231.32':139
'21#.#13.9.57':139
'21#.#13.157.9':139
'21#.#13.57.54':139
'21#.#13.109.109':139
'21#.#13.19.215':139
'21#.#13.83.152':139
'21#.#13.209.187':139
'21#.#13.42.135':139
'21#.#13.179.81':139
'21#.#13.236.140':139
'21#.#13.132.240':139
'21#.#13.78.68':139
'21#.#13.46.238':139
'21#.#13.29.148':139
'21#.#13.79.102':139
'21#.#13.118.32':139
'21#.#13.22.103':139
'21#.#13.26.246':139
'21#.#13.116.99':139
'21#.#13.133.215':139
'21#.#13.99.29':139
'21#.#13.223.241':139
'21#.#13.223.76':139
'21#.#13.155.4':139
'21#.#13.154.154':139
'21#.#13.222.243':139
'21#.#13.28.142':139
'21#.#13.125.102':139
'21#.#13.209.73':139
'21#.#13.182.207':139
'21#.#13.197.42':139
'21#.#13.158.81':139
'21#.#13.50.157':139
'21#.#13.242.218':139
'21#.#13.187.40':139
'21#.#13.240.80':139
'21#.#13.209.117':139
'21#.#13.150.15':139
'21#.#13.183.3':139
'21#.#13.13.76':139
'21#.#13.28.142':445
'21#.#13.131.183':139
'21#.#13.206.54':139
'21#.#13.20.227':139
'21#.#13.34.105':139
'21#.#13.164.150':139
'21#.#13.60.217':139
'21#.#13.151.172':139
'21#.#13.160.151':139
'21#.#13.33.73':139
'21#.#13.197.252':139
'21#.#13.79.105':139
'21#.#13.55.145':139
'21#.#13.71.184':139
'21#.#13.59.68':139
'21#.#13.252.110':139
'21#.#13.104.131':139
'21#.#13.23.94':139
'21#.#13.27.210':139
'21#.#13.236.96':139
'21#.#13.56.176':139
'21#.#13.97.57':139
'21#.#13.206.109':139
'21#.#13.128.32':139
'21#.#13.71.251':445
'21#.#13.48.106':445
'21#.#13.142.229':445
'21#.#13.36.240':445
'21#.#13.42.24':445
'21#.#13.76.46':445
'21#.#13.173.61':445
'21#.#13.153.30':445
'21#.#13.55.87':445
'21#.#13.93.1':445
'21#.#13.198.109':445
'21#.#13.33.120':445
'21#.#13.15.253':139
'21#.#13.126.176':445
'21#.#13.43.175':139
'21#.#13.92.177':139
'21#.#13.120.110':139
'21#.#13.16.127':445
'21#.#13.16.61':445
'21#.#13.44.200':445
'21#.#13.113.194':445
'21#.#13.168.16':445
'21#.#13.194.167':445
'21#.#13.42.135':9988
'21#.#13.49.66':9988
'21#.#13.150.15':9988
'21#.#13.209.187':9988
'21#.#13.183.3':9988
'21#.#13.158.81':9988
'21#.#13.28.142':9988
'21#.#13.126.176':139
'21#.#13.83.152':9988
'21#.#13.231.32':9988
'21#.#13.166.49':9988
'21#.#13.109.109':9988
'21#.#13.154.154':445
'21#.#13.226.154':445
'21#.#13.155.4':445
'21#.#13.125.102':445
'21#.#13.222.243':445
'21#.#13.181.226':445
'21#.#13.240.80':9988
'21#.#13.209.73':9988
'21#.#13.61.111':445
'21#.#13.51.32':445
'21#.#13.200.176':445
'21#.#13.55.87':139
'21#.#13.173.61':139
'21#.#13.198.109':139
'21#.#13.76.46':139
'21#.#13.93.1':139
'21#.#13.153.30':139
'21#.#13.28.218':139
'21#.#13.204.234':139
'21#.#13.168.201':139
'21#.#13.252.67':139
'21#.#13.164.38':139
'21#.#13.48.106':139
'21#.#13.113.194':139
'21#.#13.16.61':139
'21#.#13.194.167':139
'21#.#13.16.127':139
'21#.#13.168.16':139
'21#.#13.44.200':139
'21#.#13.142.229':139
'21#.#13.71.251':139
'21#.#13.42.24':139
'21#.#13.33.120':139
'21#.#13.36.240':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней