Trojan.Hosts.46652

Trojan.Hosts.46652

Добавлен в вирусную базу Dr.Web: 2019-09-15

Описание добавлено: 2019-09-17

Technical Information

Modifies file system

Creates the following files

<Current directory>\4r4r8yr1t7.exe
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\dnserrordiagoff_weboc[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\down[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\navcancl[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\errorpagetemplate[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\navcancl[1]
<Current directory>\res.ini
<Current directory>\res.exe
%TEMP%\1yzgnncu.0.vb
%TEMP%\1yzgnncu.cmdline
%TEMP%\1yzgnncu.out
%TEMP%\vbc8000.tmp
%TEMP%\res8001.tmp
<Current directory>\user ac1df9aaf.exe
<Current directory>\res.log
<Current directory>\user ac1df9aaf.res
%TEMP%\vbc967f.tmp
%TEMP%\jj0lxvks.0.vb
%TEMP%\jj0lxvks.cmdline
%TEMP%\jj0lxvks.out
%TEMP%\vbc8ae0.tmp
%TEMP%\res8ae1.tmp
%TEMP%\ybuojy5n.0.vb
%TEMP%\ybuojy5n.cmdline
%TEMP%\ybuojy5n.out
%TEMP%\res9680.tmp
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\bullet[1]

Deletes the following files

%TEMP%\res8001.tmp
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\navcancl[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\bullet[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\background_gradient[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\4qwyjxrb\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\wef9wryg\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\errorpagetemplate[1]
%TEMP%\ybuojy5n.cmdline
%TEMP%\ybuojy5n.out
%TEMP%\ybuojy5n.0.vb
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\yuk3f9l0\info_48[1]
%TEMP%\vbc967f.tmp
%TEMP%\jj0lxvks.cmdline
%TEMP%\jj0lxvks.out
%TEMP%\jj0lxvks.0.vb
%TEMP%\vbc8ae0.tmp
%TEMP%\res8ae1.tmp
<Current directory>\res.ini
<Current directory>\res.log
<Current directory>\res.exe
<Current directory>\user ac1df9aaf.res
<Current directory>\user ac1df9aaf.exe
%TEMP%\1yzgnncu.out
%TEMP%\1yzgnncu.cmdline
%TEMP%\1yzgnncu.0.vb
%TEMP%\vbc8000.tmp
%TEMP%\res9680.tmp
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\53q3wotx\bullet[1]

Moves the following files

from <Current directory>\4r4r8yr1t7.exe to %HOMEPATH%\desktop\user 4r4r8yr1t7.exe

Substitutes the following files

<Current directory>\res.exe
<Current directory>\user ac1df9aaf.exe
<Current directory>\res.log
<Current directory>\res.ini
<Current directory>\user ac1df9aaf.res

Modifies the HOSTS file.

Deletes itself.

Network activity

UDP

DNS ASK en###eles.net
DNS ASK ek##nkk.net
DNS ASK fa###ook.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_WINHELP' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'<Current directory>\res.exe' -extract <Current directory>\user AC1DF9AAF.exe,<Current directory>\user AC1DF9AAF.res,VERSIONINFO,,
'<Current directory>\res.exe' -delete <Current directory>\4R4R8YR1T7.exe,<Current directory>\res.exe,VERSIONINFO,,
'<Current directory>\res.exe' -addoverwrite <Current directory>\4R4R8YR1T7.exe,<Current directory>\4R4R8YR1T7.exe,<Current directory>\user AC1DF9AAF.res,VERSIONINFO,1,
'%HOMEPATH%\desktop\user 4r4r8yr1t7.exe'
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1yzgnncu.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8001.tmp" "%TEMP%\vbc8000.tmp"' (with hidden window)
'<Current directory>\res.exe' -extract <Current directory>\user AC1DF9AAF.exe,<Current directory>\user AC1DF9AAF.res,VERSIONINFO,,' (with hidden window)
'<Current directory>\res.exe' -delete <Current directory>\4R4R8YR1T7.exe,<Current directory>\res.exe,VERSIONINFO,,' (with hidden window)
'<Current directory>\res.exe' -addoverwrite <Current directory>\4R4R8YR1T7.exe,<Current directory>\4R4R8YR1T7.exe,<Current directory>\user AC1DF9AAF.res,VERSIONINFO,1,' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj0lxvks.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8AE1.tmp" "%TEMP%\vbc8AE0.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ybuojy5n.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9680.tmp" "%TEMP%\vbc967F.tmp"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1yzgnncu.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8001.tmp" "%TEMP%\vbc8000.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jj0lxvks.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8AE1.tmp" "%TEMP%\vbc8AE0.tmp"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ybuojy5n.cmdline"
'%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9680.tmp" "%TEMP%\vbc967F.tmp"
'<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 5

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней