Trojan.DownLoader8.22256

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '54rk' = ''

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\RarSFX0\lf.exe
<SYSTEM32>\Tencentl00.exe
%TEMP%\RarSFX0\dnf.exe

Запускает на исполнение:

<SYSTEM32>\ping.exe 127.0.0.1 -n 2
<SYSTEM32>\cmd.exe /c restart.bat

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[18]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[17]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[19]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[21]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[20]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[13]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[12]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[14]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[16]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[15]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[22]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[29]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[28]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[30]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[32]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[31]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[24]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[23]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[25]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[27]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[26]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Dnflian[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[83]
%TEMP%\RarSFX0\Dnflian.bmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ad[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ip138[1]
%TEMP%\RarSFX0\restart.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[80]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[81]
%TEMP%\RarSFX0\ver.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[82]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[8]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[7]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[9]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[11]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[10]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[3]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[2]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[6]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[33]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[61]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[60]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[62]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[64]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[63]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[56]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[55]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[57]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[59]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[58]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[65]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[72]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[71]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[73]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[75]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[74]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[67]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[66]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[68]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[70]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[69]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[40]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[39]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[41]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[43]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[42]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[35]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[34]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[36]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[38]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[37]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[44]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[51]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[50]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[52]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[54]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[53]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[46]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[45]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[47]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[49]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ip138[48]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[22]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[21]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[23]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[25]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[24]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[17]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[16]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[18]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[20]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[19]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[26]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[33]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[32]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[34]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[36]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[35]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[28]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[27]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[29]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[31]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[30]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[1]
<SYSTEM32>\Tencentl00.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[2]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[4]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[3]
%TEMP%\RarSFX0\loading.bmp
%TEMP%\RarSFX0\lf.exe
%TEMP%\RarSFX0\bbxcomm.dll
<SYSTEM32>\cfghw.tmp
%TEMP%\RarSFX0\dnf.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[5]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[12]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[11]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[13]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[15]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[14]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[7]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[6]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[8]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[10]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[9]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[37]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[65]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[64]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[66]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[68]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[67]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[60]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[59]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[61]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[63]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[62]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[69]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[76]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[75]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[77]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[79]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[78]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[71]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[70]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[72]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[74]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[73]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[44]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[43]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[45]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[47]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[46]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[39]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[38]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[40]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[42]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[41]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[48]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[55]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[54]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[56]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[58]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[57]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[50]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[49]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[51]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[53]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip138[52]

Сетевая активность:

Подключается к:

'www.dn###anfa.net':80
'www.ip##8.com':80
'localhost':1066
'localhost':1065
'18#.#1.164.109':1123
'localhost':1037
'ge##.zgpmsj.com':3721
'localhost':1041

TCP:

Запросы HTTP GET:

www.dn###anfa.net/ad.html
www.dn###anfa.net/Dnflian.jpg
www.ip##8.com/

UDP:

DNS ASK www.ip##8.com
DNS ASK www.dn###anfa.net
DNS ASK ok#.#aonmb.com
DNS ASK ge##.zgpmsj.com

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: '??????????'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней