Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5cd8f17f4086744065eb0992a09e05a2' = '"%TEMP%\Trojan.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '5cd8f17f4086744065eb0992a09e05a2' = '"%TEMP%\Trojan.exe" ..'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Trojan.exe' = '%TEMP%\Trojan.exe:*:Enabled:Trojan.exe'
Создает и запускает на исполнение:
- %TEMP%\Trojan.exe
- %TEMP%\2.exe
- %TEMP%\1.exe
Запускает на исполнение:
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%TEMP%\Trojan.exe" "Trojan.exe" ENABLE
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Trojan.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ne[1]
- %TEMP%\1.exe
- %TEMP%\2.exe
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ne[1]
Сетевая активность:
Подключается к:
- 'localhost':1177
- 'www.gr#.com':80
TCP:
Запросы HTTP GET:
- www.gr#.com/x/ne.dll?aa########################################################
UDP:
- DNS ASK 10.###.##.204.test.senderbase.org
- DNS ASK 10.###.#.199.in-addr.arpa
- DNS ASK 10.###.###.204.test.senderbase.org
- DNS ASK 10.###.#7.204.in-addr.arpa
- DNS ASK 1.###.###.198.test.senderbase.org
- DNS ASK yq#######l2n4ng4l4sc33yuib.com
- DNS ASK 10.###.#.#99.test.senderbase.org
- DNS ASK 1.###.##3.198.in-addr.arpa
- DNS ASK 10.###.#17.204.in-addr.arpa
- DNS ASK 12#.###.67.208.in-addr.arpa
- DNS ASK 12#.###.##.208.test.senderbase.org
- DNS ASK 22#.###.##.208.test.senderbase.org
- DNS ASK 30.##.##.#8.origin.asn.cymru.com
- DNS ASK 20#.###.#94.204.in-addr.arpa
- DNS ASK 20#.###.##4.204.test.senderbase.org
- DNS ASK 25.##.##.#8.origin.asn.cymru.com
- DNS ASK 35#######kydgtpklrr24hnahh.com
- DNS ASK 2.###.###.74.test.senderbase.org
- DNS ASK 25.##.#.#8.origin.asn.cymru.com
- DNS ASK 25#.##.###.129.test.senderbase.org
- DNS ASK 2.###.##8.74.in-addr.arpa
- DNS ASK 30.##.##1.68.in-addr.arpa
- DNS ASK 25.##.##1.68.in-addr.arpa
- DNS ASK 1.###.##8.74.in-addr.arpa
- DNS ASK 1.###.###.74.test.senderbase.org
- DNS ASK 25#.##.#50.129.in-addr.arpa
- DNS ASK 22.##.##4.156.in-addr.arpa
- DNS ASK 22.##.###.156.test.senderbase.org
- DNS ASK 25.##.##4.156.in-addr.arpa
- DNS ASK 25.##.###.156.test.senderbase.org
- DNS ASK 1.##.###.#56.test.senderbase.org
- DNS ASK 30.##.#.#8.origin.asn.cymru.com
- DNS ASK s5#######hpn53e1cqr2xqm0ya.com
- DNS ASK 1.##.###.156.in-addr.arpa
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK 25.##.###.156.origin.asn.cymru.com
- DNS ASK lw#######q5wdn1sjesc2mlyme.com
- DNS ASK 10.###.#.#99.origin.asn.cymru.com
- DNS ASK 1.###.###.198.origin.asn.cymru.com
- DNS ASK ih#######qbauzvkqhsylecbuf.com
- DNS ASK 25#.##.###.129.origin.asn.cymru.com
- DNS ASK 22.##.###.156.origin.asn.cymru.com
- DNS ASK 1.##.###.#56.origin.asn.cymru.com
- DNS ASK 10.###.##.204.origin.asn.cymru.com
- DNS ASK 22#.#.##.#09.origin.asn.cymru.com
- DNS ASK 11#.#.##.#09.origin.asn.cymru.com
- DNS ASK 2.##.###.#16.origin.asn.cymru.com
- DNS ASK 2.###.##.#16.origin.asn.cymru.com
- DNS ASK 20#.###.###.204.origin.asn.cymru.com
- DNS ASK 10.###.###.204.origin.asn.cymru.com
- DNS ASK 22#.###.##.208.origin.asn.cymru.com
- DNS ASK 12#.###.##.208.origin.asn.cymru.com
- DNS ASK 2.###.##.#16.test.senderbase.org
- DNS ASK 22#.#.##.209.in-addr.arpa
- DNS ASK 2.##.###.#16.test.senderbase.org
- DNS ASK 2.###.##.216.in-addr.arpa
- DNS ASK 11#.#.##.#09.test.senderbase.org
- DNS ASK qf#######u3131y3u4qq0cb3ub.com
- DNS ASK 22#.#.##.#09.test.senderbase.org
- DNS ASK 11#.#.##.209.in-addr.arpa
- DNS ASK or#######rhawp5cprqkhtrejb.com
- DNS ASK 30.##.###.68.origin.asn.cymru.com
- DNS ASK 25.##.###.68.origin.asn.cymru.com
- DNS ASK 2.###.###.74.origin.asn.cymru.com
- DNS ASK 1.###.###.74.origin.asn.cymru.com
- DNS ASK 15#.##.##.68.origin.asn.cymru.com
- DNS ASK 2.##.###.216.in-addr.arpa
- DNS ASK 1s#######2rgae41qpswij10jc.com
- DNS ASK 17#.##.##.68.origin.asn.cymru.com
- DNS ASK ul#######yb2njk3jzrgxs1eed.com
- DNS ASK 29.##.###.24.test.senderbase.org
- DNS ASK 8.#.#.#.in-addr.arpa
- DNS ASK 30.##.###.24.test.senderbase.org
- DNS ASK 29.##.##3.24.in-addr.arpa
- DNS ASK ne###.#ebindtest.com
- DNS ASK ne##.#ebindtest.com
- DNS ASK 8.#.#.#.test.senderbase.org
- DNS ASK ne####.rebindtest.com
- DNS ASK 30.##.##3.24.in-addr.arpa
- DNS ASK 2.##.##.#6.test.senderbase.org
- DNS ASK 2.###.##.64.in-addr.arpa
- DNS ASK 2.###.##.66.test.senderbase.org
- DNS ASK 2.##.##.66.in-addr.arpa
- DNS ASK 2.##.##.#4.test.senderbase.org
- DNS ASK si#######b3ijlbgmwri532gra.com
- DNS ASK 2.###.##.64.test.senderbase.org
- DNS ASK 2.##.##.64.in-addr.arpa
- DNS ASK 1.#.#.#.in-addr.arpa
- DNS ASK 1.#.#.#.test.senderbase.org
- DNS ASK 2.#.#.#.in-addr.arpa
- DNS ASK 2.#.#.#.test.senderbase.org
- DNS ASK www.gr#.com
- DNS ASK 4a########nvdapbeus4gd5w2h.isc.org
- DNS ASK 1.#.#.#0.in-addr.arpa
- DNS ASK is#.org
- DNS ASK 3.#.#.#.test.senderbase.org
- DNS ASK 6.#.#.#.test.senderbase.org
- DNS ASK 5.#.#.#.in-addr.arpa
- DNS ASK l1#######sfrz2iy3urymlhj1f.com
- DNS ASK 6.#.#.#.in-addr.arpa
- DNS ASK 4.#.#.#.test.senderbase.org
- DNS ASK 3.#.#.#.in-addr.arpa
- DNS ASK 5.#.#.#.test.senderbase.org
- DNS ASK 4.#.#.#.in-addr.arpa
- DNS ASK 2.###.##.66.in-addr.arpa
- DNS ASK 2.###.##.#4.origin.asn.cymru.com
- DNS ASK 2.##.##.#4.origin.asn.cymru.com
- DNS ASK 15#.##.#7.68.in-addr.arpa
- DNS ASK 15#.##.##.68.test.senderbase.org
- DNS ASK 29.##.###.24.origin.asn.cymru.com
- DNS ASK 30.##.##.68.in-addr.arpa
- DNS ASK 30.##.###.24.origin.asn.cymru.com
- DNS ASK ie#######yk0zqbeefruojlipg.com
- DNS ASK bl#######2gx25lwx5q4g23cyd.com
- DNS ASK 2.###.##.#6.origin.asn.cymru.com
- DNS ASK 25.##.##0.68.in-addr.arpa
- DNS ASK 30.##.##0.68.in-addr.arpa
- DNS ASK 30.##.###.68.test.senderbase.org
- DNS ASK 17#.##.#7.68.in-addr.arpa
- DNS ASK 17#.##.##.68.test.senderbase.org
- DNS ASK 25.##.###.68.test.senderbase.org
- DNS ASK 2.##.##.#6.origin.asn.cymru.com
- DNS ASK s5#######oqfg32nazqmkws14h.com
- DNS ASK 30.##.#.68.in-addr.arpa
- DNS ASK 2.#.#.#.#rigin.asn.cymru.com
- DNS ASK 1.#.#.#.#rigin.asn.cymru.com
- DNS ASK 25.##.#.#8.test.senderbase.org
- DNS ASK hv#######lpbpjyjc0tmgk4eyf.com
- DNS ASK 30.##.#.#8.test.senderbase.org
- DNS ASK 25.##.#.68.in-addr.arpa
- DNS ASK 3.#.#.#.#rigin.asn.cymru.com
- DNS ASK 25.##.##.68.in-addr.arpa
- DNS ASK 25.##.##.68.test.senderbase.org
- DNS ASK 30.##.##.68.test.senderbase.org
- DNS ASK 8.#.#.#.#rigin.asn.cymru.com
- DNS ASK 5.#.#.#.#rigin.asn.cymru.com
- DNS ASK 4.#.#.#.#rigin.asn.cymru.com
- DNS ASK 6.#.#.#.#rigin.asn.cymru.com
- DNS ASK ky#######rxm1nffl1tk2ddrbh.com
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
