Trojan.DownLoader10.3463

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1132 -dm 7 7 %TEMP%\WER6b29.dir00\svchost.exe.mdmp 16325836412027412

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER6b29.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Deletes itself.

Network activity:

Connects to:

'14.##1.31.193':445
'14.##1.151.29':445
'14.##1.255.160':445
'14.##1.129.39':445
'14.##1.80.70':445
'14.##1.44.253':445
'14.##1.49.222':445
'14.##1.161.151':445
'14.##1.212.254':445
'14.##1.115.100':445
'14.##1.185.157':445
'14.##1.100.60':445
'14.##1.178.176':445
'14.##1.162.174':445
'14.##1.177.128':445
'14.##1.10.219':445
'14.##1.172.93':445
'14.##1.84.241':445
'14.##1.45.143':139
'14.##1.49.222':139
'14.##1.173.40':139
'14.##1.152.57':139
'14.##1.210.19':139
'14.##1.80.134':139
'14.##1.92.171':139
'14.##1.95.252':139
'14.##1.226.128':139
'14.##1.88.126':445
'14.##1.245.89':139
'14.##1.200.140':445
'14.##1.204.236':445
'14.##1.139.103':139
'14.##1.113.166':139
'14.##1.44.253':139
'14.##1.12.169':445
'14.##1.232.168':139
'14.##1.96.23':445
'14.##1.10.141':139
'14.##1.139.103':445
'14.##1.218.171':445
'14.##1.245.89':445
'14.##1.232.168':445
'14.##1.152.57':445
'14.##1.59.79':139
'14.##1.173.40':445
'14.##1.45.143':445
'14.##1.24.186':139
'14.#91.3.47':139
'14.##1.10.171':139
'14.##1.17.87':139
'14.##1.152.31':139
'14.##1.61.77':139
'14.##1.121.109':445
'14.##1.121.147':139
'14.#91.61.3':139
'14.##1.196.254':445
'14.##1.99.230':445
'14.##1.80.134':445
'14.##1.92.171':445
'14.##1.230.45':445
'14.##1.111.23':445
'14.##1.45.116':445
'14.##1.244.141':445
'14.##1.200.76':445
'14.##1.218.171':139
'14.##1.47.39':139
'14.##1.67.218':139
'14.##1.121.109':139
'14.##1.67.20':139
'14.##1.226.128':445
'14.##1.102.148':445
'14.##1.210.19':445
'14.##1.95.252':445
'14.##1.240.95':139
'14.##1.110.191':139
'14.##1.32.210':445
'14.##1.195.25':139
'14.##1.33.143':139
'14.##1.226.36':139
'14.##1.31.143':139
'14.##1.167.212':139
'14.##1.12.115':445
'14.##1.88.108':445
'14.##1.226.179':445
'14.##1.31.143':445
'14.##1.226.68':445
'14.#91.65.2':445
'14.##1.181.56':445
'14.##1.23.189':445
'14.##1.169.134':445
'14.##1.184.148':445
'14.##1.25.118':445
'14.##1.171.221':445
'14.##1.17.210':445
'14.##1.86.94':445
'14.##1.47.19':445
'14.##1.97.153':445
'14.##1.5.247':445
'14.##1.84.217':445
'14.##1.125.170':445
'14.##1.226.179':139
'14.#91.65.2':139
'14.##1.226.68':139
'14.##1.88.108':139
'14.##1.184.148':139
'14.##1.23.189':139
'14.##1.169.134':139
'14.##1.181.56':139
'14.##1.32.210':139
'14.##1.226.36':445
'14.##1.178.176':139
'14.##1.96.23':139
'14.##1.115.100':139
'14.##1.100.60':139
'14.##1.162.174':139
'14.##1.129.39':139
'14.##1.48.89':139
'14.##1.31.193':139
'14.#91.18.8':139
'14.##1.48.89':445
'14.##1.48.213':445
'14.##1.200.76':139
'14.##1.196.254':139
'14.##1.244.141':139
'14.##1.230.45':139
'14.##1.45.116':139
'14.##1.111.23':139
'14.##1.99.230':139
'14.##1.185.157':139
'14.##1.240.95':445
'14.##1.151.29':139
'14.##1.48.213':139
'14.##1.110.191':445
'14.##1.212.254':139
'14.##1.195.25':445
'14.##1.167.212':445
'14.##1.33.143':445
'14.##1.84.241':139
'14.##1.177.128':139
'14.##1.172.93':139
'14.##1.102.148':139
'14.##1.10.219':139
'14.##1.255.160':139
'14.##1.161.151':139
'14.##1.80.70':139
'14.##1.21.245':139
'14.##1.176.152':139
'14.##1.185.249':445
'14.##1.67.58':445
'14.##1.10.171':445
'14.##1.176.152':445
'14.##1.17.87':445
'14.##1.24.186':445
'14.##1.152.31':445
'14.##1.252.4':445
'14.##1.163.28':445
'14.##1.0.227':445
'14.##1.105.142':445
'14.##1.78.80':445
'14.##1.58.246':445
'14.##1.73.236':445
'14.##1.216.164':445
'14.##1.206.52':445
'14.##1.142.224':445
'14.##1.47.221':445
'14.##1.56.216':139
'14.##1.216.63':139
'14.##1.220.75':139
'14.##1.216.181':139
'14.##1.3.114':139
'14.##1.41.14':139
'14.##1.63.32':139
'14.##1.95.57':139
'14.##1.91.27':139
'14.#91.3.47':445
'14.#91.61.3':445
'14.##1.121.147':445
'14.##1.61.77':445
'14.##1.167.164':445
'14.#91.2.85':445
'14.##1.169.104':139
'14.##1.247.35':445
'14.##1.55.217':445
'14.##1.6.149':445
'14.##1.143.193':445
'14.##1.132.195':445
'14.##1.68.202':445
'14.##1.117.249':445
'14.##1.203.12':445
'14.##1.64.48':445
'14.##1.41.14':445
'14.##1.9.195':445
'14.##1.17.154':445
'14.##1.216.181':445
'14.##1.95.57':445
'14.##1.169.104':445
'14.##1.220.75':445
'14.##1.56.216':445
'14.##1.181.220':445
'14.##1.39.49':445
'14.##1.91.27':445
'14.##1.3.114':445
'14.##1.166.32':445
'14.##1.198.99':445
'14.##1.160.237':445
'14.##1.111.254':445
'14.##1.136.124':445
'14.##1.155.231':445
'14.##1.84.162':445
'14.##1.161.222':445
'14.##1.136.151':445
'14.##1.63.32':445
'14.##1.31.251':445
'14.##1.118.136':445
'14.##1.193.165':445
'14.##1.80.53':445
'14.##1.14.88':445
'14.##1.183.148':445
'14.##1.19.90':445
'14.##1.242.30':445
'14.##1.136.151':139
'14.##1.47.39':445
'14.##1.106.182':139
'14.##1.142.224':139
'14.##1.127.168':139
'14.##1.161.222':139
'14.##1.58.246':139
'14.##1.235.54':139
'14.##1.59.79':445
'14.##1.53.230':139
'14.##1.155.231':139
'14.##1.84.162':139
'14.##1.73.236':139
'14.##1.46.28':139
'14.##1.37.167':139
'14.##1.6.149':139
'14.##1.198.99':139
'14.##1.84.206':139
'14.##1.252.4':139
'14.##1.216.164':139
'14.##1.55.219':139
'14.##1.136.149':139
'14.##1.206.52':139
'14.##1.164.3':139
'14.##1.67.58':139
'14.##1.242.129':139
'14.##1.185.249':139
'14.##1.10.141':445
'14.##1.67.20':445
'14.##1.78.80':139
'14.##1.0.227':139
'14.##1.158.86':139
'14.##1.245.67':139
'14.##1.163.28':139
'14.##1.47.221':139
'14.##1.105.142':139
'14.##1.136.124':139
'14.##1.19.90':139
'14.##1.117.249':139
'14.##1.64.48':139
'14.##1.118.136':139
'14.##1.80.53':139
'14.##1.193.165':139
'14.##1.167.164':139
'14.##1.31.251':139
'14.##1.41.192':139
'14.##1.9.195':139
'14.##1.133.85':139
'14.##1.17.154':139
'14.##1.68.202':139
'14.##1.203.12':139
'14.##1.39.49':139
'14.##1.132.195':139
'14.##1.12.33':139
'14.##1.181.220':139
'14.#91.2.85':139
'14.##1.106.182':445
'14.##1.242.30':139
'14.##1.166.32':139
'14.##1.46.28':445
'14.##1.55.219':445
'14.##1.136.149':445
'14.##1.158.86':445
'14.##1.127.168':445
'14.##1.160.237':139
'14.##1.183.148':139
'14.##1.31.142':139
'14.##1.143.193':139
'14.##1.111.254':139
'14.##1.32.92':139
'14.##1.14.88':139
'14.##1.247.35':139
'14.##1.55.217':139
'14.##1.110.137':445
'14.##1.36.120':445
'14.##1.104.156':445
'14.##1.176.146':445
'14.#91.8.29':445
'14.##1.45.176':445
'14.#91.56.0':445
'14.##1.183.81':445
'14.##1.35.91':445
'14.##1.22.123':445
'14.##1.91.187':445
'14.##1.121.198':445
'14.##1.184.36':445
'14.##1.180.149':445
'14.##1.12.92':445
'14.##1.42.97':445
'14.##1.136.169':445
'14.##1.189.90':445
'14.##1.13.146':445
'14.##1.91.22':445
'14.##1.154.218':445
'14.##1.13.127':445
'14.##1.199.115':445
'14.##1.188.175':445
'14.##1.129.136':445
'14.##1.70.23':445
'14.##1.80.246':445
'14.##1.124.189':445
'14.##1.45.214':445
'14.##1.243.230':445
'14.##1.138.12':445
'14.##1.32.228':445
'14.##1.96.172':445
'14.##1.88.25':445
'14.##1.245.176':445
'14.##1.136.204':445
'14.##1.21.229':445
'14.##1.12.126':445
'14.##1.94.13':445
'14.##1.206.93':445
'14.##1.7.153':445
'14.#91.14.1':445
'14.##1.103.142':139
'14.##1.243.23':139
'14.##1.121.72':139
'14.##1.244.76':139
'14.##1.15.177':139
'14.##1.45.214':9988
'14.##1.21.229':9988
'14.##1.124.189':9988
'14.##1.13.127':9988
'14.##1.103.142':445
'14.##1.243.23':445
'14.##1.121.72':445
'14.##1.244.76':445
'14.##1.15.177':445
'14.##1.251.102':445
'14.##1.56.107':445
'14.##1.254.107':445
'14.##1.143.126':445
'14.##1.21.53':445
'14.#91.41.9':445
'14.##1.181.16':445
'14.##1.92.30':445
'14.##1.22.31':445
'14.##1.94.13':139
'14.#91.14.1':139
'14.##1.7.153':139
'14.##1.206.93':139
'14.##1.236.36':445
'14.##1.143.212':445
'14.##1.29.105':445
'14.##1.151.126':445
'14.##1.94.144':445
'14.##1.189.90':139
'14.##1.13.146':139
'14.##1.93.62':139
'14.##1.12.126':139
'14.##1.151.47':139
'14.##1.224.252':139
'14.##1.40.134':139
'14.##1.37.48':139
'14.##1.136.204':139
'14.##1.94.144':139
'14.##1.12.92':139
'14.##1.32.228':139
'14.##1.117.128':139
'14.##1.45.214':139
'14.##1.243.230':139
'14.##1.29.105':139
'14.##1.70.23':139
'14.##1.36.111':139
'14.##1.96.172':139
'14.##1.176.146':139
'14.##1.42.97':139
'14.##1.53.131':139
'14.##1.115.111':139
'14.##1.236.36':139
'14.##1.143.126':139
'14.##1.4.143':139
'14.#91.8.29':139
'14.##1.91.187':139
'14.##1.138.12':139
'14.##1.21.229':139
'14.##1.88.25':139
'14.##1.13.127':139
'14.##1.136.169':139
'14.##1.184.36':139
'14.##1.199.115':139
'14.##1.245.176':139
'14.##1.183.81':139
'14.##1.36.120':139
'14.##1.35.91':139
'14.##1.115.111':445
'14.##1.4.143':445
'14.##1.56.107':139
'14.##1.92.30':139
'14.##1.22.31':139
'14.##1.143.212':139
'14.##1.251.102':139
'14.##1.36.111':445
'14.##1.151.47':445
'14.##1.81.110':445
'14.##1.117.128':445
'14.##1.93.62':445
'14.##1.40.134':445
'14.##1.53.131':445
'14.##1.37.48':445
'14.##1.224.252':445
'14.#91.56.0':139
'14.##1.154.218':139
'14.##1.180.149':139
'14.##1.91.22':139
'14.##1.188.175':139
'14.##1.129.136':139
'14.##1.81.110':139
'14.##1.80.246':139
'14.##1.124.189':139
'14.##1.121.198':139
'14.##1.181.16':139
'14.##1.21.53':139
'14.##1.151.126':139
'14.#91.41.9':139
'14.##1.22.123':139
'14.##1.254.107':139
'14.##1.104.156':139
'14.##1.45.176':139
'14.##1.238.77':139
'14.##1.73.178':139
'14.##1.78.161':139
'14.##1.174.34':139
'14.##1.107.30':139
'14.##1.246.45':139
'14.##1.242.35':139
'14.##1.27.47':139
'14.##1.123.224':139
'14.##1.24.76':139
'14.##1.90.191':139
'14.##1.10.236':139
'14.##1.128.5':139
'14.##1.49.65':139
'14.##1.17.210':139
'14.##1.206.55':139
'14.##1.74.61':139
'14.##1.84.217':139
'14.##1.242.15':139
'14.##1.212.208':139
'14.##1.182.217':445
'14.##1.112.121':139
'14.##1.225.120':139
'14.##1.210.48':445
'14.##1.24.110':445
'14.##1.219.94':445
'14.##1.161.67':445
'14.##1.72.33':445
'14.##1.148.231':139
'14.##1.218.200':139
'14.##1.31.100':139
'14.##1.200.8':139
'14.##1.7.101':139
'14.##1.121.232':139
'14.##1.241.86':139
'14.##1.20.237':139
'14.##1.3.160':139
'14.##1.86.94':139
'14.##1.107.30':445
'14.##1.123.224':445
'14.##1.78.161':445
'14.##1.242.35':445
'14.##1.7.101':445
'14.##1.225.120':445
'14.##1.200.8':445
'14.##1.121.232':445
'14.##1.212.208':445
'14.##1.90.191':445
'14.##1.10.236':445
'14.##1.128.5':445
'14.##1.49.65':445
'14.##1.24.76':445
'14.##1.31.100':445
'14.##1.242.15':445
'14.##1.27.47':445
'14.##1.148.231':445
'14.##1.171.221':139
'14.##1.25.118':139
'14.##1.20.237':445
'14.##1.12.115':139
'14.##1.110.137':139
'14.##1.97.153':139
'14.##1.125.170':139
'14.##1.5.247':139
'14.##1.47.19':139
'14.##1.206.55':445
'14.##1.246.45':445
'14.##1.174.34':445
'14.##1.241.86':445
'14.##1.74.61':445
'14.##1.112.121':445
'14.##1.218.200':445
'14.##1.73.178':445
'14.##1.3.160':445
'14.##1.158.13':139
'14.##1.180.108':139
'14.##1.35.133':139
'14.##1.168.239':139
'14.##1.24.248':139
'14.##1.112.106':139
'14.##1.213.189':139
'14.##1.136.164':139
'14.##1.174.69':139
'14.##1.109.234':139
'14.##1.213.115':445
'14.##1.11.212':139
'14.##1.216.109':139
'14.##1.255.253':139
'14.#91.2.99':139
'14.##1.194.188':139
'14.##1.78.103':445
'14.##1.238.77':445
'14.##1.115.111':9988
'14.##1.129.136':9988
'14.##1.51.115':139
'14.##1.117.128':9988
'14.##1.40.134':9988
'14.##1.213.115':139
'14.##1.78.103':139
'14.##1.53.131':9988
'14.##1.4.143':9988
'14.##1.144.88':139
'14.##1.230.63':139
'14.##1.114.96':139
'14.##1.44.152':139
'14.##1.63.85':139
'14.##1.140.10':139
'14.##1.133.81':139
'14.##1.85.207':139
'14.##1.32.134':139
'14.##1.55.162':139
'14.##1.144.88':445
'14.##1.85.207':445
'14.##1.194.188':445
'14.##1.168.239':445
'14.##1.174.69':445
'14.##1.136.164':445
'14.##1.213.189':445
'14.##1.114.96':445
'14.##1.44.152':445
'14.##1.55.162':445
'14.##1.11.212':445
'14.##1.94.231':445
'14.##1.160.233':445
'14.##1.216.109':445
'14.#91.2.99':445
'14.##1.35.133':445
'14.##1.255.253':445
'14.##1.109.234':445
'14.##1.210.48':139
'14.##1.72.33':139
'14.##1.51.115':445
'14.##1.182.217':139
'14.##1.24.110':139
'14.##1.160.233':139
'14.##1.94.231':139
'14.##1.161.67':139
'14.##1.219.94':139
'14.##1.230.63':445
'14.##1.63.85':445
'14.##1.24.248':445
'14.##1.112.106':445
'14.##1.158.13':445
'14.##1.140.10':445
'14.##1.133.81':445
'14.##1.180.108':445
'14.##1.32.134':445

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней