Trojan.DownLoader10.3474

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'14#.#36.35.153':139
'14#.#36.64.183':139
'14#.#36.153.161':139
'14#.#36.69.182':139
'14#.#36.161.230':139
'14#.#36.63.156':139
'14#.#36.167.152':139
'14#.#36.184.9':139
'14#.#36.31.192':139
'14#.#36.9.195':139
'14#.#36.29.59':139
'14#.#36.53.15':139
'14#.#36.220.108':139
'14#.#36.122.196':139
'14#.#36.211.173':445
'14#.#36.225.252':139
'14#.#36.63.56':139
'14#.#36.203.24':139
'14#.#36.55.121':139
'14#.#36.225.9':139
'14#.#36.200.239':139
'14#.#36.60.208':139
'14#.#36.151.21':139
'14#.#36.49.184':139
'14#.#36.21.95':139
'14#.#36.67.81':139
'14#.#36.65.101':139
'14#.#36.219.95':139
'14#.#36.48.25':139
'14#.#36.43.52':139
'14#.#36.215.189':139
'14#.#36.23.191':139
'14#.#36.210.10':139
'14#.#36.248.23':139
'14#.#36.226.139':139
'14#.#36.180.125':139
'14#.#36.151.61':139
'14#.#36.89.239':139
'14#.#36.233.237':139
'14#.#36.120.100':139
'14#.#36.82.96':139
'14#.#36.64.242':139
'14#.#36.165.75':139
'14#.#36.157.34':445
'14#.#36.50.224':445
'14#.#36.34.83':445
'14#.#36.119.150':445
'14#.#36.23.217':445
'14#.#36.131.124':445
'14#.#36.64.3':445
'14#.#36.44.144':445
'14#.#36.74.176':445
'14#.#36.27.139':445
'14#.#36.171.212':445
'14#.#36.85.165':445
'14#.#36.6.78':445
'14#.#36.55.222':445
'14#.#36.86.242':445
'14#.#36.85.51':445
'14#.#36.72.60':445
'14#.#36.79.185':445
'14#.#36.176.131':445
'14#.#36.232.16':445
'14#.#36.78.232':445
'14#.#36.33.227':445
'14#.#36.133.21':445
'14#.#36.33.84':445
'14#.#36.121.49':445
'14#.#36.49.199':445
'14#.#36.47.56':445
'14#.#36.194.74':445
'14#.#36.173.194':445
'14#.#36.74.159':445
'14#.#36.180.159':445
'14#.#36.35.81':445
'14#.#36.4.161':445
'14#.#36.166.205':445
'14#.#36.225.6':445
'14#.#36.84.195':445
'14#.#36.204.64':445
'14#.#36.5.207':445
'14#.#36.247.146':445
'14#.#36.47.239':445
'14#.#36.20.250':445
'14#.#36.59.102':445
'14#.#36.83.209':445
'14#.#36.253.28':139
'14#.#36.146.146':445
'14#.#36.106.220':445
'14#.#36.127.148':445
'14#.#36.61.85':445
'14#.#36.132.110':445
'14#.#36.38.202':139
'14#.#36.67.116':139
'14#.#36.178.153':139
'14#.#36.235.106':139
'14#.#36.10.218':139
'14#.#36.210.152':445
'14#.#36.23.191':445
'14#.#36.43.52':445
'14#.#36.215.189':445
'14#.#36.151.21':445
'14#.#36.49.184':445
'14#.#36.127.46':445
'14#.#36.204.76':445
'14#.#36.253.28':445
'14#.#36.219.95':445
'14#.#36.48.25':445
'14#.#36.42.238':139
'14#.#36.164.176':139
'14#.#36.126.245':139
'14#.#36.153.134':139
'14#.#36.111.240':139
'14#.#36.80.70':139
'14#.#36.112.246':139
'14#.#36.76.9':139
'14#.#36.21.76':139
'14#.#36.64.253':139
'14#.#36.128.16':139
'14#.#36.240.238':139
'14#.#36.62.248':139
'14#.#36.56.202':139
'14#.#36.95.126':139
'14#.#36.174.249':139
'14#.#36.51.14':139
'14#.#36.153.62':139
'14#.#36.238.227':139
'14#.#36.96.86':139
'14#.#36.78.57':139
'14#.#36.199.251':139
'14#.#36.55.121':445
'14#.#36.63.56':445
'14#.#36.200.239':445
'14#.#36.220.108':445
'14#.#36.225.9':445
'14#.#36.161.230':445
'14#.#36.153.161':445
'14#.#36.69.182':445
'14#.#36.203.24':445
'14#.#36.29.59':445
'14#.#36.53.15':445
'14#.#36.61.85':139
'14#.#36.132.110':139
'14#.#36.210.152':139
'14#.#36.127.46':139
'14#.#36.204.76':139
'14#.#36.225.252':445
'14#.#36.122.196':445
'14#.#36.106.220':139
'14#.#36.127.148':139
'14#.#36.146.146':139
'14#.#36.35.153':445
'14#.#36.82.96':445
'14#.#36.233.237':445
'14#.#36.165.75':445
'14#.#36.226.139':445
'14#.#36.64.242':445
'14#.#36.65.101':445
'14#.#36.21.95':445
'14#.#36.67.81':445
'14#.#36.120.100':445
'14#.#36.210.10':445
'14#.#36.248.23':445
'14#.#36.184.9':445
'14#.#36.63.156':445
'14#.#36.9.195':445
'14#.#36.64.183':445
'14#.#36.31.192':445
'14#.#36.89.239':445
'14#.#36.180.125':445
'14#.#36.151.61':445
'14#.#36.167.152':445
'14#.#36.60.208':445
'14#.#36.76.105':445
'14#.#36.189.224':445
'14#.#36.143.133':445
'14#.#36.197.96':445
'14#.#36.0.150':445
'14#.#36.23.196':445
'14#.#36.72.236':445
'14#.#36.217.204':445
'14#.#36.222.64':445
'14#.#36.135.46':445
'14#.#36.146.190':445
'14#.#36.81.148':139
'14#.#36.135.81':139
'14#.#36.87.34':139
'14#.#36.126.22':139
'14#.#36.111.146':139
'14#.#36.45.27':445
'14#.#36.67.152':445
'14#.#36.252.162':139
'14#.#36.90.228':139
'14#.#36.202.46':139
'14#.#36.135.39':445
'14#.#36.203.204':445
'14#.#36.16.32':445
'14#.#36.108.193':445
'14#.#36.234.20':445
'14#.#36.143.29':445
'14#.#36.235.182':445
'14#.#36.30.224':445
'14#.#36.183.24':445
'14#.#36.141.147':445
'14#.#36.24.153':445
'14#.#36.20.174':445
'14#.#36.27.78':445
'14#.#36.127.55':445
'14#.#36.16.120':445
'14#.#36.97.182':445
'14#.#36.29.4':445
'14#.#36.49.175':445
'14#.#36.75.62':445
'14#.#36.82.117':445
'14#.#36.77.201':445
'14#.#36.214.220':445
'14#.#36.97.182':139
'14#.#36.29.4':139
'14#.#36.135.39':139
'14#.#36.23.196':139
'14#.#36.72.236':139
'14#.#36.77.201':139
'14#.#36.214.220':139
'14#.#36.127.55':139
'14#.#36.16.120':139
'14#.#36.27.78':139
'14#.#36.217.204':139
'14#.#36.197.96':139
'14#.#36.0.150':139
'14#.#36.146.190':139
'14#.#36.67.152':139
'14#.#36.45.27':139
'14#.#36.222.64':139
'14#.#36.135.46':139
'14#.#36.189.224':139
'14#.#36.76.105':139
'14#.#36.143.133':139
'14#.#36.82.117':139
'14#.#36.229.167':139
'14#.#36.101.134':139
'14#.#36.66.57':139
'14#.#36.235.182':139
'14#.#36.30.224':139
'14#.#36.241.37':139
'14#.#36.21.201':139
'14#.#36.85.156':139
'14#.#36.27.252':139
'14#.#36.115.43':139
'14#.#36.183.24':139
'14#.#36.234.20':139
'14#.#36.143.29':139
'14#.#36.20.174':139
'14#.#36.49.175':139
'14#.#36.75.62':139
'14#.#36.141.147':139
'14#.#36.24.153':139
'14#.#36.16.32':139
'14#.#36.108.193':139
'14#.#36.203.204':139
'14#.#36.66.57':445
'14#.#36.204.64':139
'14#.#36.5.207':139
'14#.#36.33.227':139
'14#.#36.131.124':139
'14#.#36.64.3':139
'14#.#36.59.102':139
'14#.#36.83.209':139
'14#.#36.225.6':139
'14#.#36.84.195':139
'14#.#36.166.205':139
'14#.#36.44.144':139
'14#.#36.119.150':139
'14#.#36.23.217':139
'14#.#36.171.212':139
'14#.#36.72.60':139
'14#.#36.79.185':139
'14#.#36.74.176':139
'14#.#36.27.139':139
'14#.#36.50.224':139
'14#.#36.34.83':139
'14#.#36.157.34':139
'14#.#36.20.250':139
'14#.#36.114.116':445
'14#.#36.10.114':445
'14#.#36.211.173':139
'14#.#36.194.74':139
'14#.#36.173.194':139
'14#.#36.8.140':445
'14#.#36.166.151':445
'14#.#36.255.19':445
'14#.#36.182.150':445
'14#.#36.173.214':445
'14#.#36.74.159':139
'14#.#36.49.199':139
'14#.#36.47.56':139
'14#.#36.4.161':139
'14#.#36.247.146':139
'14#.#36.47.239':139
'14#.#36.180.159':139
'14#.#36.35.81':139
'14#.#36.33.84':139
'14#.#36.121.49':139
'14#.#36.133.21':139
'14#.#36.252.162':445
'14#.#36.197.96':9988
'14#.#36.202.46':445
'14#.#36.135.81':445
'14#.#36.90.228':445
'14#.#36.23.196':9988
'14#.#36.217.204':9988
'14#.#36.135.46':9988
'14#.#36.76.105':9988
'14#.#36.189.224':9988
'14#.#36.81.148':445
'14#.#36.115.43':445
'14#.#36.85.156':445
'14#.#36.27.252':445
'14#.#36.229.167':445
'14#.#36.101.134':445
'14#.#36.111.146':445
'14#.#36.87.34':445
'14#.#36.126.22':445
'14#.#36.241.37':445
'14#.#36.21.201':445
'14#.#36.135.39':9988
'14#.#36.85.51':139
'14#.#36.55.222':139
'14#.#36.86.242':139
'14#.#36.8.140':139
'14#.#36.166.151':139
'14#.#36.78.232':139
'14#.#36.176.131':139
'14#.#36.232.16':139
'14#.#36.85.165':139
'14#.#36.6.78':139
'14#.#36.255.19':139
'14#.#36.229.167':9988
'14#.#36.85.156':9988
'14#.#36.235.182':9988
'14#.#36.214.220':9988
'14#.#36.141.147':9988
'14#.#36.182.150':139
'14#.#36.173.214':139
'14#.#36.10.114':139
'14#.#36.87.34':9988
'14#.#36.114.116':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней