Trojan.DownLoader18.40903

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Profile Connect Link Microsoft' = '<SYSTEM32>\huctneeyhti.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Backup Information PNRP Time] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\zduikrpdh.exe' "<SYSTEM32>\huctneeyhti.exe"
'%WINDIR%\Temp\amwejnqtngb4yvu.exe' -r 30409 tcp
'%TEMP%\amwejnxzn7j2yvutal3kt.exe'
'<SYSTEM32>\huctneeyhti.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\lowopdrcwyx\run
<SYSTEM32>\lowopdrcwyx\rng
%WINDIR%\Temp\amwejnqtngb4yvu.exe
<SYSTEM32>\lowopdrcwyx\cfg
<SYSTEM32>\zduikrpdh.exe
%TEMP%\amwejnxzn7j2yvutal3kt.exe
<SYSTEM32>\lowopdrcwyx\tst
<SYSTEM32>\huctneeyhti.exe
<SYSTEM32>\lowopdrcwyx\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\zduikrpdh.exe
<SYSTEM32>\huctneeyhti.exe

Удаляет следующие файлы:

%WINDIR%\Temp\amwejnqtngb4yvu.exe
<DRIVERS>\etc\hosts
%TEMP%\amwejnxzn7j2yvutal3kt.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'li###lse.net':80
'th####mportant.net':80
'th###else.net':80
'th###nice.net':80
'li###ice.net':80
'fe###ice.net':80
'we###ice.net':80
'we###ine.net':80
'li####portant.net':80
'fe###ine.net':80
'li###ine.net':80
'so###nice.net':80
'fi###nice.net':80
'fi###fine.net':80
'fa###break.net':80
'so###fine.net':80
'fi####mportant.net':80
'th###fine.net':80
'so####mportant.net':80
'so###else.net':80
'fi###else.net':80
'po###nice.net':80
'ca###ice.net':80
'ca###ine.net':80
'le####portant.net':80
'po###fine.net':80
'ca####portant.net':80
'no###ine.net':80
'po####mportant.net':80
'po###else.net':80
'ca###lse.net':80
'ta####mportant.net':80
'we####portant.net':80
'ta###fine.net':80
'fe####portant.net':80
'fe###lse.net':80
'we###lse.net':80
'ta###else.net':80
'le###lse.net':80
'le###ice.net':80
'le###ine.net':80
'ta###nice.net':80
'le###reak.net':80
'po###slept.net':80
'ta###break.net':80
'th###while.net':80
'le###rove.net':80
'po###prove.net':80
'ca###rove.net':80
'ca###ers.net':80
'ca###lept.net':80
'po###hers.net':80
'ef###tbuilt.net':80
'se####strong.net':80
'si######edwerryhouse.net':80
'de####promise.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'of####urprise.net':80
'ri###nstorm.net':80
'gw#####ynhuddleston.net':80
'mo####gduring.net':80
'ch####nother.net':80
'ri###lept.net':80
'fa###slept.net':80
'we###reak.net':80
'we###ers.net':80
'we###rove.net':80
'fa###prove.net':80
'ri###reak.net':80
'ri###rove.net':80
'ri###ers.net':80
'fa###hers.net':80
'we###lept.net':80
'li###lept.net':80
'no###ers.net':80
'no###lept.net':80
'po###break.net':80
'ca###reak.net':80
'no###reak.net':80
'li###reak.net':80
'li###rove.net':80
'li###ers.net':80
'no###rove.net':80

TCP:

Запросы HTTP GET:

http://li###lse.net/index.php
http://th####mportant.net/index.php
http://th###else.net/index.php
http://th###nice.net/index.php
http://li###ice.net/index.php
http://fe###ice.net/index.php
http://we###ice.net/index.php
http://we###ine.net/index.php
http://li####portant.net/index.php
http://fe###ine.net/index.php
http://li###ine.net/index.php
http://so###nice.net/index.php
http://fi###nice.net/index.php
http://fi###fine.net/index.php
http://fa###break.net/index.php
http://so###fine.net/index.php
http://fi####mportant.net/index.php
http://th###fine.net/index.php
http://so####mportant.net/index.php
http://so###else.net/index.php
http://fi###else.net/index.php
http://po###nice.net/index.php
http://ca###ice.net/index.php
http://ca###ine.net/index.php
http://le####portant.net/index.php
http://po###fine.net/index.php
http://ca####portant.net/index.php
http://no###ine.net/index.php
http://po####mportant.net/index.php
http://po###else.net/index.php
http://ca###lse.net/index.php
http://ta####mportant.net/index.php
http://we####portant.net/index.php
http://ta###fine.net/index.php
http://fe####portant.net/index.php
http://fe###lse.net/index.php
http://we###lse.net/index.php
http://ta###else.net/index.php
http://le###lse.net/index.php
http://le###ice.net/index.php
http://le###ine.net/index.php
http://ta###nice.net/index.php
http://le###reak.net/index.php
http://po###slept.net/index.php
http://ta###break.net/index.php
http://th###while.net/index.php
http://le###rove.net/index.php
http://po###prove.net/index.php
http://ca###rove.net/index.php
http://ca###ers.net/index.php
http://ca###lept.net/index.php
http://po###hers.net/index.php
http://ef###tbuilt.net/index.php
http://se####strong.net/index.php
http://si######edwerryhouse.net/index.php
http://de####promise.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://of####urprise.net/index.php
http://ri###nstorm.net/index.php
http://gw#####ynhuddleston.net/index.php
http://mo####gduring.net/index.php
http://ch####nother.net/index.php
http://ri###lept.net/index.php
http://fa###slept.net/index.php
http://we###reak.net/index.php
http://we###ers.net/index.php
http://we###rove.net/index.php
http://fa###prove.net/index.php
http://ri###reak.net/index.php
http://ri###rove.net/index.php
http://ri###ers.net/index.php
http://fa###hers.net/index.php
http://we###lept.net/index.php
http://li###lept.net/index.php
http://no###ers.net/index.php
http://no###lept.net/index.php
http://po###break.net/index.php
http://ca###reak.net/index.php
http://no###reak.net/index.php
http://li###reak.net/index.php
http://li###rove.net/index.php
http://li###ers.net/index.php
http://no###rove.net/index.php

UDP:

DNS ASK li###lse.net
DNS ASK th####mportant.net
DNS ASK th###else.net
DNS ASK th###nice.net
DNS ASK li###ice.net
DNS ASK fe###ice.net
DNS ASK we###ice.net
DNS ASK we###ine.net
DNS ASK li####portant.net
DNS ASK fe###ine.net
DNS ASK li###ine.net
DNS ASK so###nice.net
DNS ASK fi###nice.net
DNS ASK fi###fine.net
DNS ASK fa###break.net
DNS ASK so###fine.net
DNS ASK fi####mportant.net
DNS ASK th###fine.net
DNS ASK so####mportant.net
DNS ASK so###else.net
DNS ASK fi###else.net
DNS ASK po###nice.net
DNS ASK ca###ice.net
DNS ASK ca###ine.net
DNS ASK le####portant.net
DNS ASK po###fine.net
DNS ASK ca####portant.net
DNS ASK no###ine.net
DNS ASK po####mportant.net
DNS ASK po###else.net
DNS ASK ca###lse.net
DNS ASK ta####mportant.net
DNS ASK we####portant.net
DNS ASK ta###fine.net
DNS ASK fe####portant.net
DNS ASK fe###lse.net
DNS ASK we###lse.net
DNS ASK ta###else.net
DNS ASK le###lse.net
DNS ASK le###ice.net
DNS ASK le###ine.net
DNS ASK ta###nice.net
DNS ASK ri###reak.net
DNS ASK ta###break.net
DNS ASK le###reak.net
DNS ASK le###rove.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK ca###ers.net
DNS ASK po###prove.net
DNS ASK po###hers.net
DNS ASK po###slept.net
DNS ASK ca###lept.net
DNS ASK se####strong.net
DNS ASK si######edwerryhouse.net
DNS ASK de####promise.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK of####urprise.net
DNS ASK ri###nstorm.net
DNS ASK gw#####ynhuddleston.net
DNS ASK mo####gduring.net
DNS ASK ch####nother.net
DNS ASK ca###rove.net
DNS ASK we###reak.net
DNS ASK ri###lept.net
DNS ASK we###rove.net
DNS ASK we###lept.net
DNS ASK we###ers.net
DNS ASK ri###rove.net
DNS ASK fa###prove.net
DNS ASK fa###hers.net
DNS ASK fa###slept.net
DNS ASK ri###ers.net
DNS ASK li###lept.net
DNS ASK no###ers.net
DNS ASK no###lept.net
DNS ASK po###break.net
DNS ASK ca###reak.net
DNS ASK no###reak.net
DNS ASK li###reak.net
DNS ASK li###rove.net
DNS ASK li###ers.net
DNS ASK no###rove.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней