Trojan.DownLoader10.3405

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER4650.dir00\svchost.exe.mdmp 16325836412032288

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER4650.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'58.##3.195.41':139
'58.##3.194.59':139
'58.#73.63.7':139
'58.##3.39.36':139
'58.#73.7.39':139
'58.##3.156.136':139
'58.##3.226.167':139
'58.##3.147.30':139
'58.#73.52.3':139
'58.##3.191.121':139
'58.##3.95.119':445
'58.##3.172.228':445
'58.##3.254.47':445
'58.##3.69.159':445
'58.##3.223.21':445
'58.##3.39.75':445
'58.##3.114.105':139
'58.##3.160.41':445
'58.##3.88.230':445
'58.##3.229.132':445
'58.##3.31.192':139
'58.##3.105.32':139
'58.##3.192.120':139
'58.##3.24.146':139
'58.##3.121.24':139
'58.##3.58.254':139
'58.##3.128.59':139
'58.##3.161.61':139
'58.##3.9.105':139
'58.##3.155.9':139
'58.##3.161.119':139
'58.##3.10.161':139
'58.##3.119.210':139
'58.##3.79.213':139
'58.##3.210.79':139
'58.##3.255.35':139
'58.##3.234.105':139
'58.##3.174.198':139
'58.##3.199.10':139
'58.##3.181.237':139
'58.##3.59.251':139
'58.##3.152.60':139
'58.##3.11.45':445
'58.##3.105.14':445
'58.##3.30.79':445
'58.##3.28.156':139
'58.##3.65.28':139
'58.##3.183.174':139
'58.##3.160.28':139
'58.##3.96.241':139
'58.##3.177.244':445
'58.##3.19.110':445
'58.##3.196.114':445
'58.##3.231.134':445
'58.##3.215.12':445
'58.##3.223.119':445
'58.##3.212.223':445
'58.##3.37.242':445
'58.##3.140.253':445
'58.##3.220.141':445
'58.##3.160.28':445
'58.##3.96.241':445
'58.##3.152.60':445
'58.##3.39.75':139
'58.##3.59.251':445
'58.##3.79.65':445
'58.##3.163.40':445
'58.##3.65.28':445
'58.##3.183.174':445
'58.##3.28.156':445
'58.##3.223.21':139
'58.##3.254.47':139
'58.##3.69.159':139
'58.##3.79.65':139
'58.##3.163.40':139
'58.##3.229.132':139
'58.##3.160.41':139
'58.##3.88.230':139
'58.##3.95.119':139
'58.##3.172.228':139
'58.##3.132.127':139
'58.##3.125.158':445
'58.##3.136.72':445
'58.##3.22.107':445
'58.##3.197.123':139
'58.##3.252.197':139
'58.##3.172.109':445
'58.##3.208.218':445
'58.##3.127.196':445
'58.##3.150.137':445
'58.##3.139.44':445
'58.##3.131.49':139
'58.#73.6.0':139
'58.##3.120.209':139
'58.##3.172.109':139
'58.##3.208.218':139
'58.##3.50.238':139
'58.##3.15.193':139
'58.##3.62.135':139
'58.##3.246.146':139
'58.##3.39.17':139
'58.##3.180.104':139
'58.##3.10.59':139
'58.##3.97.233':139
'58.##3.95.60':139
'58.##3.252.197':445
'58.##3.17.132':139
'58.##3.64.17':139
'58.##3.111.40':139
'58.##3.114.186':139
'58.##3.25.115':139
'58.##3.39.17':445
'58.##3.246.146':445
'58.#73.6.0':445
'58.##3.120.209':445
'58.##3.131.49':445
'58.##3.197.123':445
'58.##3.162.151':139
'58.##3.15.193':445
'58.##3.62.135':445
'58.##3.50.238':445
'58.##3.210.79':445
'58.##3.119.210':445
'58.##3.79.213':445
'58.##3.156.136':445
'58.##3.226.167':445
'58.##3.181.237':445
'58.##3.174.198':445
'58.##3.199.10':445
'58.##3.161.119':445
'58.##3.10.161':445
'58.#73.7.39':445
'58.#73.63.7':445
'58.##3.39.36':445
'58.##3.238.166':139
'58.##3.114.105':445
'58.##3.191.121':445
'58.##3.147.30':445
'58.#73.52.3':445
'58.##3.195.41':445
'58.##3.194.59':445
'58.##3.238.166':445
'58.##3.22.107':139
'58.##3.132.127':445
'58.##3.58.254':445
'58.##3.128.59':445
'58.##3.139.44':139
'58.##3.127.196':139
'58.##3.150.137':139
'58.##3.125.158':139
'58.##3.136.72':139
'58.##3.121.24':445
'58.##3.192.120':445
'58.##3.24.146':445
'58.##3.255.35':445
'58.##3.234.105':445
'58.##3.155.9':445
'58.##3.161.61':445
'58.##3.9.105':445
'58.##3.31.192':445
'58.##3.105.32':445
'58.##3.70.242':445
'58.##3.62.50':445
'58.##3.161.32':445
'58.##3.177.164':139
'58.##3.120.6':445
'58.##3.165.189':445
'58.##3.249.130':445
'58.##3.236.241':445
'58.##3.92.176':445
'58.##3.196.115':445
'58.##3.31.223':139
'58.##3.124.33':139
'58.##3.16.49':139
'58.##3.144.194':139
'58.##3.118.172':139
'58.##3.60.135':139
'58.##3.93.177':139
'58.##3.177.15':139
'58.##3.137.36':139
'58.##3.34.60':139
'58.##3.80.66':445
'58.##3.20.43':445
'58.##3.8.102':445
'58.##3.43.81':445
'58.##3.165.129':445
'58.##3.85.144':445
'58.##3.19.70':445
'58.##3.194.165':445
'58.##3.166.222':445
'58.##3.133.165':445
'58.##3.116.12':445
'58.##3.12.84':445
'58.##3.22.41':445
'58.##3.204.249':445
'58.##3.17.178':445
'58.##3.182.168':445
'58.##3.81.109':445
'58.##3.224.254':445
'58.##3.46.254':445
'58.##3.253.115':445
'58.##3.12.84':139
'58.##3.46.254':139
'58.##3.22.41':139
'58.##3.17.178':139
'58.##3.116.12':139
'58.##3.81.109':139
'58.##3.43.81':139
'58.##3.182.168':139
'58.##3.253.115':139
'58.##3.224.254':139
'58.##3.161.32':139
'58.##3.120.6':139
'58.##3.165.189':139
'58.##3.92.176':139
'58.##3.236.241':139
'58.##3.249.130':139
'58.##3.62.50':139
'58.##3.204.249':139
'58.##3.70.242':139
'58.##3.196.115':139
'58.##3.36.30':139
'58.##3.206.239':139
'58.##3.154.143':139
'58.##3.143.31':139
'58.##3.138.8':139
'58.##3.78.182':139
'58.##3.186.28':139
'58.##3.31.140':139
'58.##3.62.129':139
'58.##3.61.189':139
'58.##3.8.102':139
'58.##3.133.165':139
'58.##3.165.129':139
'58.##3.20.43':139
'58.##3.80.66':139
'58.##3.85.144':139
'58.##3.124.159':139
'58.##3.19.70':139
'58.##3.166.222':139
'58.##3.194.165':139
'58.##3.124.159':445
'58.##3.220.141':139
'58.##3.37.242':139
'58.##3.140.253':139
'58.##3.177.244':139
'58.##3.19.110':139
'58.##3.30.79':139
'58.##3.11.45':139
'58.##3.105.14':139
'58.##3.223.119':139
'58.##3.212.223':139
'58.##3.169.13':139
'58.##3.162.238':139
'58.##3.13.224':139
'58.##3.191.104':139
'58.##3.48.35':139
'58.##3.215.12':139
'58.##3.196.114':139
'58.##3.231.134':139
'58.##3.27.216':139
'58.##3.135.27':139
'58.##3.191.104':445
'58.##3.48.35':445
'58.##3.67.39':445
'58.##3.159.156':445
'58.##3.125.86':445
'58.##3.27.216':445
'58.##3.135.27':445
'58.##3.162.238':445
'58.##3.13.224':445
'58.##3.169.13':445
'58.##3.21.167':445
'58.##3.120.99':445
'58.##3.185.200':445
'58.##3.122.253':445
'58.##3.123.93':445
'58.##3.5.229':445
'58.##3.157.22':445
'58.##3.36.60':445
'58.##3.20.211':445
'58.##3.197.168':445
'58.##3.31.223':445
'58.##3.124.33':445
'58.##3.16.49':445
'58.##3.186.28':445
'58.##3.118.172':445
'58.##3.60.135':445
'58.##3.93.177':445
'58.##3.177.15':445
'58.##3.137.36':445
'58.##3.34.60':445
'58.##3.36.30':445
'58.##3.206.239':445
'58.##3.154.143':445
'58.##3.143.31':445
'58.##3.138.8':445
'58.##3.78.182':445
'58.##3.144.194':445
'58.##3.31.140':445
'58.##3.62.129':445
'58.##3.61.189':445
'58.##3.197.168':139
'58.##3.36.60':139
'58.##3.20.211':139
'58.##3.21.167':139
'58.##3.120.99':139
'58.##3.125.86':139
'58.##3.67.39':139
'58.##3.159.156':139
'58.##3.5.229':139
'58.##3.157.22':139
'58.##3.161.32':9988
'58.##3.43.81':9988
'58.##3.22.41':9988
'58.##3.177.164':445
'58.##3.70.242':9988
'58.##3.123.93':139
'58.##3.185.200':139
'58.##3.122.253':139
'58.##3.177.15':9988
'58.##3.34.60':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней