Trojan.AVKill.28760

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '54rk' = ''

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\Tencentl00.exe

Запускает на исполнение:

<SYSTEM32>\ping.exe 127.0.0.1 -n 2
<SYSTEM32>\cmd.exe /c restart.bat

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0D2NOP
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAI3MS7B
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAERGDEJ
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0ZJC7T
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAW5AZC9
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAXG9XC9
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAIJYLMV
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA89A30P
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAED2EW0
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAUVKLU3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0XUZ45
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAUBWTER
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA2SC7XA
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAUZS12N
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAV8C566
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA6N45M7
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAOV2LA3
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA3EW35U
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA4D2Z0X
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAOSN426
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA27GT2F
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[87]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[86]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[88]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[90]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[89]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[83]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[82]
<Текущая директория>\restart.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[85]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[84]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[97]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[96]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[98]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAFR1242
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[99]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[92]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[91]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[93]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[95]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[94]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA49878X
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWRY7OV
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CARDYVBR
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA901RMU
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA278PE7
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CACXQNK1
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA27WLOD
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA70X2UZ
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAFPBR8W
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAIF2QCQ
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQNOXYV
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWXIB81
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAAJJV8E
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAZVB8SP
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAZXPW30
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAEVC9UT
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAQDX6A1
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CACT27KT
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0GMUIL
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAWP238T
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA70CH22
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CANVYIYB
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAY1XSCO
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAEYED0Z
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA45U3CX
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAJ72KAD
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAYDKNY9
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAIVM9SR
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAM9ILZ2
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAU7SPAV
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CADXG3AC
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAY3O14P
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA6228MS
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CABKT4T8
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAT9XMYS
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAK9Y709
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA0FEDWR
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CARCA7DI
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CANBT30B
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA9YXI8K
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAK5K32T
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAMZGJSN
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[26]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[25]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[27]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[29]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[28]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[21]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[20]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[22]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[24]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[23]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[36]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[35]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[37]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[39]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[38]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[31]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[30]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[32]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[34]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[33]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[19]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[6]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[8]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[7]
<SYSTEM32>\Tencentl00.exe
<SYSTEM32>\cfghw.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[2]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[15]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[14]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[16]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[18]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[17]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[10]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[9]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[11]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[13]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[12]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[40]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[68]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[67]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[69]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[71]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[70]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[63]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[62]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[64]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[66]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[65]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[78]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[77]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[79]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[81]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[80]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[73]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[72]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[74]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[76]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[75]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[61]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[47]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[46]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[48]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[50]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[49]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[42]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[41]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[43]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[45]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[44]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[57]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[56]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[58]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[60]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[59]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[52]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[51]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[53]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[55]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[54]

Сетевая активность:

Подключается к:

'ge##.zgpmsj.com':3721
'www.ip##8.com':80
'localhost':1064
'localhost':1037
'21#.#5.152.43':1803
'localhost':1042

TCP:

Запросы HTTP GET:

www.ip##8.com/

UDP:

DNS ASK www.ip##8.com
DNS ASK ge##.zgpmsj.com
DNS ASK ok#.#aonmb.com

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней