Trojan.DownLoader21.44398

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Problem Input Helper Encrypting' = '<SYSTEM32>\rrwmymauccfj.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\UPnP Tablet Program IKE IP Level] 'ImagePath' = '<SYSTEM32>\rrwmymauccfj.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\UPnP Tablet Program IKE IP Level] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\jchriylcmqxqz\run
<SYSTEM32>\jchriylcmqxqz\rng
%WINDIR%\Temp\tsejraq33uhqzvib.exe
<SYSTEM32>\jchriylcmqxqz\cfg
<SYSTEM32>\utnevdimtmr.exe
%TEMP%\tsejraq2x8mqzvibwyzhooj.exe
<SYSTEM32>\jchriylcmqxqz\tst
<SYSTEM32>\rrwmymauccfj.exe
<SYSTEM32>\jchriylcmqxqz\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\utnevdimtmr.exe
<SYSTEM32>\rrwmymauccfj.exe

Удаляет следующие файлы:

%WINDIR%\Temp\tsejraq33uhqzvib.exe
<DRIVERS>\etc\hosts
%TEMP%\tsejraq2x8mqzvibwyzhooj.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'we###eft.net':80
'sp###left.net':80
'sp###hope.net':80
'mu###hurry.net':80
'we###ope.net':80
'sp###hurry.net':80
'fr###hope.net':80
'we###urry.net':80
'we####irteen.net':80
'sp####hirteen.net':80
'ya###ope.net':80
'mu###hope.net':80
'ha###urry.net':80
'ha####irteen.net':80
'hu###hurry.net':80
'mu####hirteen.net':80
'ya###urry.net':80
'ya####irteen.net':80
'ya###eft.net':80
'mu###left.net':80
'of###hope.net':80
'wi###eft.net':80
'jo####irteen.net':80
'jo###eft.net':80
'jo###ope.net':80
'wi###ope.net':80
'de###ope.net':80
'ro###ope.net':80
'wi###urry.net':80
'wi####irteen.net':80
'jo###urry.net':80
'of####hirteen.net':80
'fr###hurry.net':80
'fr####hirteen.net':80
'fr###left.net':80
'of###left.net':80
'se#####erthirteen.net':80
'se####berhurry.net':80
'se####berleft.net':80
'of###hurry.net':80
'se####berhope.net':80
'hu####hirteen.net':80
'jo###ompe.net':80
'wi###ompe.net':80
'se####bercount.net':80
'be##lxc.com':80
'ha###ount.net':80
'wi###ell.net':80
'jo###ount.net':80
'jo###ell.net':80
'jo###our.net':80
'wi###our.net':80
'mi###hown.net':80
'ab###ell.net':80
'mo###ugust.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'al###being.net':80
'ri###nstorm.net':80
'ca####nbring.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'wi###ount.net':80
'ma###ell.net':80
'wr###count.net':80
'wr###fell.net':80
'wr###hour.net':80
'ma###our.net':80
'hu###left.net':80
'ha###eft.net':80
'ha###ope.net':80
'ma###ount.net':80
'hu###hope.net':80
'ro###our.net':80
'de###ell.net':80
'de###our.net':80
'de###ompe.net':80
'ro###ompe.net':80
'wr###compe.net':80
'ma###ompe.net':80
'ro###ount.net':80
'ro###ell.net':80
'de###ount.net':80

TCP:

Запросы HTTP GET:

http://we###eft.net/index.php
http://sp###left.net/index.php
http://sp###hope.net/index.php
http://mu###hurry.net/index.php
http://we###ope.net/index.php
http://sp###hurry.net/index.php
http://fr###hope.net/index.php
http://we###urry.net/index.php
http://we####irteen.net/index.php
http://sp####hirteen.net/index.php
http://ya###ope.net/index.php
http://mu###hope.net/index.php
http://ha###urry.net/index.php
http://ha####irteen.net/index.php
http://hu###hurry.net/index.php
http://mu####hirteen.net/index.php
http://ya###urry.net/index.php
http://ya####irteen.net/index.php
http://ya###eft.net/index.php
http://mu###left.net/index.php
http://of###hope.net/index.php
http://wi###eft.net/index.php
http://jo####irteen.net/index.php
http://jo###eft.net/index.php
http://jo###ope.net/index.php
http://wi###ope.net/index.php
http://de###ope.net/index.php
http://ro###ope.net/index.php
http://wi###urry.net/index.php
http://wi####irteen.net/index.php
http://jo###urry.net/index.php
http://of####hirteen.net/index.php
http://fr###hurry.net/index.php
http://fr####hirteen.net/index.php
http://fr###left.net/index.php
http://of###left.net/index.php
http://se#####erthirteen.net/index.php
http://se####berhurry.net/index.php
http://se####berleft.net/index.php
http://of###hurry.net/index.php
http://se####berhope.net/index.php
http://hu####hirteen.net/index.php
http://jo###ompe.net/index.php
http://wi###ompe.net/index.php
http://se####bercount.net/index.php
http://be##lxc.com/index.php
http://ha###ount.net/index.php
http://wi###ell.net/index.php
http://jo###ount.net/index.php
http://jo###ell.net/index.php
http://jo###our.net/index.php
http://wi###our.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://mo###ugust.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://ca####nbring.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://wi###ount.net/index.php
http://ma###ell.net/index.php
http://wr###count.net/index.php
http://wr###fell.net/index.php
http://wr###hour.net/index.php
http://ma###our.net/index.php
http://hu###left.net/index.php
http://ha###eft.net/index.php
http://ha###ope.net/index.php
http://ma###ount.net/index.php
http://hu###hope.net/index.php
http://ro###our.net/index.php
http://de###ell.net/index.php
http://de###our.net/index.php
http://de###ompe.net/index.php
http://ro###ompe.net/index.php
http://wr###compe.net/index.php
http://ma###ompe.net/index.php
http://ro###ount.net/index.php
http://ro###ell.net/index.php
http://de###ount.net/index.php

UDP:

DNS ASK sp###left.net
DNS ASK we####irteen.net
DNS ASK we###eft.net
DNS ASK we###ope.net
DNS ASK sp###hope.net
DNS ASK fr###hope.net
DNS ASK of###hope.net
DNS ASK sp###hurry.net
DNS ASK sp####hirteen.net
DNS ASK we###urry.net
DNS ASK mu###hurry.net
DNS ASK ya###ope.net
DNS ASK mu###hope.net
DNS ASK ha###urry.net
DNS ASK ha####irteen.net
DNS ASK hu###hurry.net
DNS ASK mu####hirteen.net
DNS ASK ya###urry.net
DNS ASK ya####irteen.net
DNS ASK ya###eft.net
DNS ASK mu###left.net
DNS ASK jo####irteen.net
DNS ASK wi####irteen.net
DNS ASK wi###eft.net
DNS ASK wi###ope.net
DNS ASK jo###eft.net
DNS ASK ro###ope.net
DNS ASK de###eft.net
DNS ASK de###ope.net
DNS ASK jo###urry.net
DNS ASK wi###urry.net
DNS ASK jo###ope.net
DNS ASK of####hirteen.net
DNS ASK fr###hurry.net
DNS ASK fr####hirteen.net
DNS ASK fr###left.net
DNS ASK of###left.net
DNS ASK se#####erthirteen.net
DNS ASK se####berhurry.net
DNS ASK se####berleft.net
DNS ASK of###hurry.net
DNS ASK se####berhope.net
DNS ASK hu####hirteen.net
DNS ASK jo###ompe.net
DNS ASK wi###ompe.net
DNS ASK se####bercount.net
DNS ASK be##lxc.com
DNS ASK ha###ount.net
DNS ASK wi###ell.net
DNS ASK jo###ount.net
DNS ASK jo###ell.net
DNS ASK jo###our.net
DNS ASK wi###our.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK mo###ugust.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK ca####nbring.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK wi###ount.net
DNS ASK ma###ell.net
DNS ASK wr###count.net
DNS ASK wr###fell.net
DNS ASK wr###hour.net
DNS ASK ma###our.net
DNS ASK hu###left.net
DNS ASK ha###eft.net
DNS ASK ha###ope.net
DNS ASK ma###ount.net
DNS ASK hu###hope.net
DNS ASK ro###our.net
DNS ASK de###ell.net
DNS ASK de###our.net
DNS ASK de###ompe.net
DNS ASK ro###ompe.net
DNS ASK wr###compe.net
DNS ASK ma###ompe.net
DNS ASK ro###ount.net
DNS ASK ro###ell.net
DNS ASK de###ount.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней