Trojan.DownLoader10.3475

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER1b8e.dir00\svchost.exe.mdmp 16325836412030700

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER1b8e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'63.##.37.148':445
'63.##.180.141':445
'63.##.134.39':445
'63.##.102.118':445
'63.##.100.196':445
'63.##.120.169':445
'63.#5.63.85':139
'63.##.169.253':445
'63.##.50.180':445
'63.##.24.106':445
'63.##.101.195':445
'63.##.100.25':445
'63.#5.17.26':445
'63.##.103.43':445
'63.##.25.234':445
'63.#5.2.213':445
'63.##.130.49':445
'63.##.42.246':445
'63.##.199.173':445
'63.#5.73.43':445
'63.##.30.203':139
'63.##.212.129':139
'63.#5.22.77':139
'63.##.89.247':139
'63.##.64.127':139
'63.#5.7.66':139
'63.##.231.55':139
'63.##.77.115':139
'63.##.112.160':139
'63.##.52.192':139
'63.#5.4.96':139
'63.#5.3.4':139
'63.#5.165.6':139
'63.##.246.223':139
'63.##.144.196':139
'63.##.39.116':139
'63.#5.29.15':139
'63.##.128.122':139
'63.#5.5.34':139
'63.##.33.218':139
'63.##.30.241':445
'63.##.139.30':445
'63.##.28.232':445
'63.##.12.225':445
'63.##.233.47':445
'63.##.51.113':445
'63.##.41.125':445
'63.##.135.42':445
'63.##.196.49':445
'63.#5.42.88':445
'63.##.180.141':139
'63.##.50.180':139
'63.##.37.148':139
'63.##.100.196':139
'63.##.134.39':139
'63.##.205.63':445
'63.##.47.158':445
'63.##.120.169':139
'63.##.24.106':139
'63.##.169.253':139
'63.##.149.161':445
'63.##.243.183':445
'63.#5.151.7':445
'63.##.246.118':445
'63.##.230.202':445
'63.##.29.244':445
'63.##.234.223':445
'63.#5.43.40':445
'63.##.13.163':445
'63.#5.77.8':445
'63.##.124.89':445
'63.##.194.126':445
'63.##.38.149':445
'63.#5.90.39':445
'63.##.112.214':445
'63.##.139.48':445
'63.#5.1.114':445
'63.##.244.164':445
'63.##.54.179':445
'63.##.116.220':445
'63.##.149.173':139
'63.##.193.134':445
'63.##.196.193':445
'63.##.134.95':445
'63.##.149.173':445
'63.##.36.150':445
'63.##.150.99':445
'63.##.193.97':445
'63.##.198.161':445
'63.#5.2.77':445
'63.##.37.163':445
'63.##.30.203':445
'63.##.212.129':445
'63.#5.22.77':445
'63.##.89.247':445
'63.##.64.127':445
'63.#5.7.66':445
'63.##.231.55':445
'63.##.77.115':445
'63.##.112.160':445
'63.##.52.192':445
'63.##.155.169':445
'63.#5.98.67':445
'63.##.168.215':445
'63.##.29.108':445
'63.##.215.87':445
'63.#5.30.52':445
'63.#5.40.31':445
'63.#5.52.65':445
'63.#5.1.216':445
'63.#5.153.1':445
'63.#5.19.17':445
'63.##.101.188':445
'63.#5.205.0':445
'63.##.46.114':445
'63.##.108.67':445
'63.#5.48.74':445
'63.#5.76.48':445
'63.#5.8.165':445
'63.##.84.125':445
'63.##.83.239':445
'63.##.101.188':139
'63.##.84.125':139
'63.#5.19.17':139
'63.##.108.67':139
'63.#5.205.0':139
'63.#5.76.48':139
'63.##.29.108':139
'63.#5.48.74':139
'63.##.83.239':139
'63.#5.8.165':139
'63.##.196.193':139
'63.#5.2.77':139
'63.##.193.134':139
'63.##.36.150':139
'63.##.134.95':139
'63.##.193.97':139
'63.##.46.114':139
'63.##.198.161':139
'63.##.37.163':139
'63.##.150.99':139
'63.#5.4.96':445
'63.#5.3.4':445
'63.##.144.196':445
'63.##.246.223':445
'63.#5.165.6':445
'63.##.39.116':445
'63.#5.29.15':445
'63.##.128.122':445
'63.#5.5.34':445
'63.##.33.218':445
'63.#5.98.67':139
'63.#5.1.216':139
'63.##.155.169':139
'63.##.215.87':139
'63.##.168.215':139
'63.#5.40.31':139
'63.#5.63.85':445
'63.#5.30.52':139
'63.#5.153.1':139
'63.#5.52.65':139
'63.##.194.186':445
'63.##.57.194':445
'63.##.186.206':445
'63.#5.1.185':139
'63.##.182.201':445
'63.#5.41.4':445
'63.##.139.163':445
'63.#5.4.59':445
'63.##.141.133':445
'63.#5.58.52':445
'63.#5.51.31':139
'63.#5.37.45':139
'63.##.127.227':139
'63.#5.44.39':139
'63.##.215.220':139
'63.##.169.92':139
'63.##.123.18':139
'63.##.220.133':139
'63.##.162.197':139
'63.#5.1.123':139
'63.##.43.201':445
'63.#5.19.45':445
'63.##.255.122':445
'63.##.57.141':445
'63.##.123.57':445
'63.##.93.141':445
'63.##.165.108':445
'63.#5.49.57':445
'63.##.227.73':445
'63.#5.213.0':445
'63.##.26.154':445
'63.#5.8.16':445
'63.##.48.231':445
'63.##.121.73':445
'63.#5.67.89':445
'63.##.222.121':445
'63.#5.65.43':445
'63.##.94.178':445
'63.##.18.124':445
'63.##.192.186':445
'63.#5.8.16':139
'63.##.94.178':139
'63.##.26.154':139
'63.#5.67.89':139
'63.##.48.231':139
'63.##.43.201':139
'63.##.222.121':139
'63.##.227.73':139
'63.##.18.124':139
'63.##.192.186':139
'63.##.57.194':139
'63.##.141.133':139
'63.##.194.186':139
'63.##.182.201':139
'63.##.186.206':139
'63.##.139.163':139
'63.##.121.73':139
'63.#5.41.4':139
'63.#5.58.52':139
'63.#5.4.59':139
'63.##.146.141':139
'63.#5.27.62':139
'63.##.127.38':139
'63.##.165.108':139
'63.##.38.103':139
'63.##.160.222':139
'63.##.69.167':139
'63.#5.93.69':139
'63.##.183.23':139
'63.##.92.159':139
'63.##.123.57':139
'63.##.255.122':139
'63.##.57.141':139
'63.#5.65.43':139
'63.#5.19.45':139
'63.##.117.90':139
'63.#5.69.24':139
'63.#5.213.0':139
'63.#5.49.57':139
'63.##.93.141':139
'63.##.38.103':445
'63.##.194.126':139
'63.##.54.179':139
'63.##.135.42':139
'63.##.38.149':139
'63.##.51.113':139
'63.#5.1.114':139
'63.##.246.118':139
'63.##.139.48':139
'63.##.116.220':139
'63.##.244.164':139
'63.##.30.241':139
'63.##.196.49':139
'63.##.139.30':139
'63.##.12.225':139
'63.##.28.232':139
'63.##.41.125':139
'63.##.124.89':139
'63.#5.90.39':139
'63.#5.42.88':139
'63.##.112.214':139
'63.##.100.25':139
'63.##.199.173':139
'63.##.25.234':139
'63.##.29.244':139
'63.##.234.223':139
'63.##.102.118':139
'63.##.130.49':139
'63.#5.73.43':139
'63.#5.2.213':139
'63.##.42.246':139
'63.##.13.163':139
'63.##.243.183':139
'63.##.149.161':139
'63.##.230.202':139
'63.#5.151.7':139
'63.#5.17.26':139
'63.##.101.195':139
'63.##.103.43':139
'63.#5.77.8':139
'63.#5.43.40':139
'63.##.127.227':445
'63.#5.37.45':445
'63.#5.51.31':445
'63.##.160.222':445
'63.##.215.220':445
'63.##.123.18':445
'63.#5.1.185':445
'63.##.220.133':445
'63.##.162.197':445
'63.#5.1.123':445
'63.##.146.141':445
'63.#5.27.62':445
'63.##.127.38':445
'63.##.117.90':445
'63.#5.69.24':445
'63.##.69.167':445
'63.#5.44.39':445
'63.#5.93.69':445
'63.##.183.23':445
'63.##.92.159':445
'63.##.146.141':9988
'63.##.215.220':9988
'63.##.117.90':9988
'63.#5.49.57':9988
'63.##.93.141':9988
'63.##.47.158':139
'63.##.233.47':139
'63.##.205.63':139
'63.##.69.167':9988
'63.#5.1.123':9988
'63.##.121.73':9988
'63.##.57.141':9988
'63.##.182.201':9988
'63.##.169.92':445
'63.##.57.194':9988
'63.#5.65.43':9988
'63.#5.19.45':9988
'63.##.192.186':9988
'63.##.255.122':9988
'63.##.18.124':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней