Trojan.DownLoader4.60618

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Executes the following:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Virus name>" dir=in action=allow program="<Full path to virus>"

Modifies file system :

Creates the following files:

%APPDATA%\engel\updates.exe

Network activity:

Connects to:

'59.##3.172.14':3128
'41.##4.172.234':3128
'11#.#62.106.108':3128
'77.##.95.221':3128
'17#.#22.35.246':3128
'77.##1.127.231':3128
'59.#0.65.41':3128
'14.##.235.215':3128
'95.##.149.29':3128
'17#.#24.20.221':3128
'19#.#38.105.157':3128
'85.##.196.245':3128
'12#.#8.126.145':3128
'95.##.185.85':3128
'11#.#3.150.245':3128
'17#.#12.203.228':3128
'95.##.232.122':3128
'18#.#9.20.67':3128
'22#.#9.198.239':3128
'89.##.224.167':3128
'10#.#07.241.175':3128
'19#.#3.163.69':3128
'92.##.248.58':3128
'95.##.10.209':3128
'20#.#8.164.34':3128
'93.##.190.32':3128
'87.##7.63.73':3128
'61.#.114.227':3128
'39.##9.46.164':3128
'22#.#89.167.133':3128
'61.##4.34.122':3128
'59.#.17.148':3128
'20#.#4.189.77':3128
'92.##4.107.208':3128
'19#.#25.94.189':3128
'19#.#6.196.3':3128
'18#.2.220.6':3128
'91.##.126.226':3128
'12#.#4.43.181':3128
'82.##7.14.199':3128
'11#.#8.250.186':3128
'11#.#73.49.72':3128
'11#.#27.127.126':3128
'59.##.130.46':3128
'14.##.27.137':3128
'95.##.35.133':3128
'17#.#22.220.180':3128
'59.#.204.224':3128
'89.##3.98.138':3128
'79.##7.72.35':3128
'94.##0.225.53':3128
'92.#7.4.97':3128
'89.##2.31.250':3128
'59.##.200.104':3128
'79.##5.253.7':3128
'18#.#2.175.110':3128
'84.##.77.131':3128
'95.#1.9.128':3128
'11#.#96.144.102':3128
'18#.#22.136.3':3128
'86.#5.83.86':3128
'59.##.187.255':3128
'11#.#98.215.4':3128
'61.##5.165.16':3128
'27.#7.15.81':3128
'27.##5.56.150':3128
'12#.#61.228.166':3128
'14.##.216.84':3128
'11#.#96.129.221':3128
'11#.#17.187.144':3128
'12#.#8.126.150':3128
'20#.#90.2.33':3128
'95.##.128.164':3128
'92.##.251.80':3128
'77.##0.34.74':3128
'87.##7.12.127':3128
'95.#8.99.48':3128
'93.##7.170.99':3128
'91.##.209.182':3128
'19#.#38.105.152':3128
'91.##.208.55':3128
'78.##.193.208':3128
'71.##4.19.142':3128
'18#.#29.234.223':3128
'89.#1.107.4':3128
'82.##7.106.170':3128
'95.##.252.139':3128
'91.##.127.128':3128
'11#.#94.179.116':3128
'95.##.196.181':3128
'89.##.108.104':3128
'14#.#16.1.172':3128
'41.##3.57.72':3128
'27.#.9.36':3128
'86.##3.31.54':3128
'93.##.196.214':3128
'17#.#23.14.199':3128
'18#.#78.78.128':3128
'17#.#23.120.76':3128
'18#.#.168.83':3128
'21#.#96.68.187':3128
'11#.#3.126.68':3128
'89.##6.196.198':3128
'93.#4.53.59':3128
'89.##.194.10':3128
'77.##2.145.60':3128
'22#.#20.224.147':3128
'59.##.211.177':3128
'95.##.196.56':3128
'17#.#22.122.48':3128
'18#.#19.6.89':3128
'93.##5.146.24':3128
'62.##.41.160':3128
'94.#7.66.75':3128
'17#.#23.47.192':3128
'89.##4.140.166':3128
'94.##8.115.117':3128
'93.#8.229.7':3128
'78.##.123.26':3128
'22#.#2.80.18':3128
'22#.#41.34.100':3128
'87.##7.54.115':3128
'11#.#4.60.66':3128
'21#.#11.110.101':3128
'11#.#93.251.225':3128
'18#.#56.145.138':3128
'22#.#55.226.149':3128
'91.##5.250.119':3128
'84.##.221.14':3128
'21#.#72.250.98':3128
'87.##7.62.237':3128
'17#.#26.128.76':3128
'85.##.118.162':3128
'19#.#18.98.60':3128
'95.##.195.241':3128
'95.##.69.207':3128
'27.##5.56.137':3128
'12#.#23.210.234':3128
'92.##.148.73':3128
'60.##4.26.150':3128
'67.##1.127.111':3128
'61.##.186.155':3128
'59.##3.195.126':3128
'86.##7.164.155':3128
'89.##.255.65':3128
'46.##3.69.207':3128
'82.##5.19.227':3128
'87.##6.176.188':3128
'17#.#9.147.219':3128
'78.##.242.233':3128
'19#.#12.76.158':3128
'11#.#05.2.136':3128
'61.#.8.16':3128
'87.##0.166.58':3128
'12#.#79.202.148':3128
'18#.#1.192.179':3128
'92.##2.78.120':3128
'20#.#59.214.105':3128
'59.##.235.222':3128
'92.##.244.16':3128
'10#.#34.115.119':3128
'21#.#11.217.253':3128
'22#.#5.173.93':3128
'95.#9.0.85':3128
'65.##7.139.62':3128
'86.##6.40.27':3128
'89.##2.194.5':3128
'95.##1.158.94':3128
'14#.#6.141.223':3128
'12#.#01.84.212':3128
'79.##2.92.52':3128
'79.##4.206.25':3128
'12#.#94.145.64':3128
'59.##1.39.13':3128
'21#.#9.18.231':3128
'95.##.143.74':3128
'94.##0.228.235':3128
'77.##.45.219':3128
'84.##.230.244':3128
'84.##.71.185':3128
'88.##7.242.196':3128
'84.##.66.135':3128
'11#.#96.235.122':3128
'91.##4.250.233':3128
'11#.#04.67.233':3128
'18#.#15.164.100':3128
'66.#8.85.2':3128
'89.##5.248.47':3128
'95.##.18.232':3128
'79.##4.154.144':3128
'58.##3.125.236':3128
'17#.#24.71.128':3128
'12#.#23.104.13':3128
'81.#1.87.26':3128
'95.##.135.68':3128
'58.##4.135.156':3128
'83.##8.82.159':3128
'12#.#1.68.74':3128
'11#.#99.122.247':3128
'18#.#31.84.147':3128
'92.##.176.176':3128
'95.#8.42.53':3128
'95.##.204.228':3128
'95.##.69.203':3128
'12#.#92.93.118':3128
'91.##8.170.188':3128
'85.#55.46.6':3128
'12#.#01.86.207':3128
'89.##5.244.229':3128
'49.##2.110.128':3128
'77.##0.156.167':3128
'84.##.77.145':3128
'11#.#67.99.23':3128
'81.#0.0.17':3128
'95.##.75.170':3128
'77.##2.214.21':3128
'50.##.58.235':3128
'91.##.126.12':3128
'95.##1.138.48':3128
'79.##5.138.210':3128
'93.##8.243.205':3128
'17#.#00.63.28':3128
'31.##4.162.14':3128
'77.##.164.211':3128
'84.##.102.136':3128
'88.##6.111.111':3128
'77.##6.3.122':3128
'91.##2.106.115':3128
'59.#1.206.9':3128
'93.##8.250.214':3128
'27.##6.52.13':3128
'93.##8.17.226':3128
'59.##.155.43':3128
'95.##.59.213':3128
'91.##8.169.197':3128
'12#.#66.97.131':3128
'82.##7.12.169':3128
'46.##1.238.56':3128
'95.##1.180.207':3128
'59.#8.7.163':3128
'92.##3.173.57':3128
'94.#3.69.3':3128
'12#.#01.135.204':3128
'92.##.204.130':3128
'19#.#.35.154':3128
'93.##.84.246':3128
'14.##.11.247':3128
'95.#9.5.224':3128
'89.##5.100.183':3128
'17#.#24.9.135':3128
'71.##.101.169':3128
'18#.#.195.54':3128
'11#.#70.15.239':3128
'11#.#54.71.9':3128
'59.##3.69.219':3128
'41.##3.57.74':3128
'12#.#38.67.45':3128
'77.#20.4.98':3128
'82.##8.83.29':3128
'20#.#64.38.101':3128
'11#.#8.41.233':3128
'92.##.248.231':3128
'82.##7.2.182':3128
'82.#07.2.37':3128
'21#.#.140.221':3128
'81.##.11.164':3128
'49.##.101.32':3128
'21#.#2.200.158':3128
'87.##1.19.76':3128
'95.##.181.35':3128
'12#.#37.29.47':3128
'77.##5.31.248':3128
'18#.#12.138.56':3128
'78.##.172.77':3128
'61.##.197.229':3128
'93.##.189.183':3128
'95.##.153.54':3128
'19#.#0.161.143':3128
'89.##.96.133':3128
'61.##.65.142':3128
'12#.#23.125.48':3128
'18#.#30.97.78':3128
'18#.#29.187.244':3128
'77.##.26.246':3128
'95.#6.84.50':3128
'63.##9.44.98':3128
'14.##.136.234':3128
'91.##5.9.169':3128
'87.##7.51.89':3128
'78.##3.48.99':3128
'59.##3.192.72':3128
'18#.#.228.74':3128
'92.##.204.54':3128
'79.##6.149.161':3128
'11#.#54.61.167':3128
'94.##0.163.207':3128
'94.##2.73.61':3128
'84.##.67.100':3128
'46.##.112.153':3128
'86.##1.54.123':3128
'82.#07.12.1':3128
'10#.251.8.6':3128
'46.##7.211.87':3128
'17#.#22.141.21':3128
'93.##4.98.36':3128
'85.#5.97.49':3128
'87.##7.53.162':3128
'18#.#41.86.20':3128
'77.##.246.81':3128
'18#.#4.95.220':3128
'68.##.222.177':3128
'62.##.74.140':3128
'11#.#2.72.149':3128
'41.##2.25.64':3128
'89.##.208.29':3128
'93.##0.75.23':3128
'92.##.150.38':3128
'10#.#07.207.222':3128
'11#.#6.56.215':3128
'41.#2.53.74':3128
'91.##.116.129':3128
'87.##7.49.249':3128
'81.##.253.169':3128
'21#.#66.211.224':3128
'94.##3.199.37':3128
'82.##7.3.216':3128
'98.##4.76.79':3128
'95.##5.98.55':3128
'95.##.111.128':3128
'59.##.132.140':3128
'12#.#7.93.144':3128
'91.##8.142.202':3128
'82.##7.3.130':3128
'89.##.217.150':3128
'11#.#8.19.133':3128
'94.##.56.138':3128
'18#.#73.249.25':3128
'82.##9.165.28':3128
'11#.#6.246.194':3128
'84.##7.61.206':3128
'59.##3.148.211':3128
'12#.#1.180.76':3128
'82.#07.0.59':3128
'41.##3.228.17':3128
'77.##4.42.181':3128
'46.##7.228.156':3128
'61.#.114.185':3128
'22#.#75.241.106':3128
'95.##.78.149':3128
'84.##.69.185':3128
'95.##.139.229':3128
'85.##0.81.228':3128
'17#.#11.96.237':3128
'46.##.123.170':3128
'41.##5.30.243':3128
'80.##.120.34':3128
'18#.#.95.147':3128
'46.##7.191.247':3128
'95.#2.36.17':3128
'85.#85.73.6':3128
'18#.#.65.147':3128
'89.##.209.150':3128
'46.##.168.143':3128
'22#.#75.241.127':3128
'11#.#99.149.157':3128
'84.##8.111.237':3128
'79.##0.189.171':3128
'46.##7.181.254':3128
'59.##5.203.32':3128
'95.##.228.89':3128
'62.##8.214.33':3128
'95.##.241.147':3128
'79.##8.113.12':3128
'10#.#7.137.226':3128
'22#.#17.164.228':3128
'12#.#23.128.238':3128
'92.##.135.159':3128
'22#.#08.170.50':3128
'11#.#13.61.195':3128
'11#.#1.26.41':3128
'89.##4.103.52':3128
'93.##6.154.250':3128
'17#.#37.50.145':3128
'14.##.120.163':3128
'17#.#25.205.166':3128
'22#.#67.4.130':3128
'18#.#3.94.153':3128
'10#.#04.178.89':3128
'91.##5.208.211':3128
'18#.#21.197.126':3128
'92.##.90.127':3128
'11#.#8.45.41':3128
'17#.#22.2.41':3128
'82.##3.89.116':3128
'83.##2.81.217':3128
'68.##.174.42':3128
'41.##.136.110':3128
'59.#8.7.167':3128
'12#.#8.126.152':3128
'89.##.230.250':3128
'91.##3.174.178':3128
'93.##7.133.158':3128
'59.#8.7.162':3128
'11#.#05.182.117':3128
'94.##7.75.85':3128
'94.##2.176.24':3128
'89.##.237.46':3128
'21#.#11.249.148':3128
'17#.#23.230.223':3128
'82.#07.1.42':3128
'11#.#78.24.226':3128
'82.##0.33.111':3128
'17#.#57.83.139':3128
'12#.#52.11.254':3128
'82.##7.14.179':3128
'92.##.182.236':3128
'77.##6.181.140':3128
'95.##.44.165':3128
'18#.#.145.156':3128
'49.#4.61.65':3128
'46.##1.235.57':3128
'19#.#9.248.132':3128
'27.##5.11.242':3128
'95.##.15.247':3128
'59.#8.7.168':3128
'92.#5.40.52':3128
'10#.#39.46.232':3128
'19#.#38.105.236':3128
'58.##2.178.14':3128
'41.##3.57.75':3128
'12#.#.35.116':3128
'62.##.50.166':3128
'84.##.66.118':3128
'89.##.159.184':3128
'58.##5.211.20':3128
'19#.#8.176.140':3128
'14#.#36.179.51':3128
'93.##.210.56':3128
'80.##.202.126':3128
'92.##.203.22':3128
'18#.#4.248.248':3128
'41.##.174.220':3128
'91.##8.171.17':3128
'95.##.37.113':3128
'18#.#.197.245':3128
'18#.#82.70.146':3128
'11#.#54.122.246':3128
'92.##.244.154':3128
'93.##8.220.203':3128
'17#.#17.166.33':3128
'14.#7.21.87':3128
'95.#8.47.68':3128
'77.##1.241.91':3128
'91.##.93.133':3128
'79.##2.91.208':3128
'82.##7.198.152':3128
'87.##.122.107':3128
'18#.#.133.18':3128
'49.##.104.198':3128
'20#.#92.212.21':3128
'95.##.135.193':3128
'95.##.137.47':3128
'86.##.253.46':3128
'81.#0.0.18':3128
'94.#2.57.11':3128
'79.##0.250.79':3128
'74.#15.6.49':3128
'21#.#6.133.151':3128
'92.#7.4.17':3128
'95.##1.65.242':3128
'61.##.113.16':3128
'12#.#7.84.251':3128
'59.#8.7.173':3128
'94.##0.225.162':3128
'2.###.223.87':3128
'89.##3.128.171':3128
'89.##3.213.96':3128
'19#.#79.172.174':3128
'12#.#23.231.99':3128
'20#.#02.194.70':3128
'46.##7.160.40':3128
'81.##.164.231':3128
'91.##8.168.163':3128
'91.##8.168.214':3128
'19#.#18.93.154':3128
'95.##1.162.223':3128
'11#.#02.118.60':3128
'92.#6.20.99':3128
'91.##.209.190':3128
'95.##.61.140':3128
'84.##6.240.205':3128
'18#.#2.216.51':3128
'41.##3.57.76':3128
'81.##7.8.192':3128
'20#.#64.143.27':3128
'12#.#7.92.55':3128
'91.##4.250.88':3128
'78.##.48.127':3128
'94.##6.192.166':3128
'95.##2.83.163':3128
'20#.#4.170.104':3128
'12#.1.15.40':3128
'11#.#8.3.207':3128
'11#.207.5.6':3128
'11#.#07.11.6':3128
'59.##3.24.245':3128
'86.##5.106.56':3128
'86.##.242.61':3128
'85.##.156.118':3128
'21#.#5.88.163':3128
'21#.#35.231.128':3128
'78.##1.19.210':3128
'92.##.150.34':3128
'14.##2.18.219':3128
'61.##.191.105':3128
'85.##5.40.78':3128
'98.##.81.164':3128
'18#.#.201.11':3128
'74.#15.3.63':3128
'62.##3.176.118':3128
'77.##3.31.178':3128
'79.##6.112.20':3128
'11#.#8.160.130':3128
'91.##3.175.83':3128
'95.##0.101.61':3128
'87.##7.52.155':3128
'99.##3.157.129':3128
'95.##.150.185':3128
'91.##4.134.197':3128
'17#.#24.42.140':3128
'11#.#94.173.28':3128
'82.##5.16.67':3128
'46.##8.22.159':3128
'18#.#77.137.11':3128
'59.##.204.66':3128
'59.##.213.81':3128

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial