Trojan.DownLoader16.43287

Добавлен в вирусную базу Dr.Web: 2015-09-25

Описание добавлено: 2015-09-25

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Secure VC Intelligent Networking WebClient' = '<SYSTEM32>\pxhbqdmzgni.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Port Defender CardSpace Portable File] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\wbohnfda.exe' "<SYSTEM32>\pxhbqdmzgni.exe"
'%WINDIR%\Temp\hgogro2ry3iw.exe' -r 35971 tcp
'%TEMP%\hgogro2m7xiwur76ago.exe'
'<SYSTEM32>\pxhbqdmzgni.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\moipyfyrjsg\run
<SYSTEM32>\moipyfyrjsg\rng
%WINDIR%\Temp\hgogro2ry3iw.exe
<SYSTEM32>\moipyfyrjsg\cfg
<SYSTEM32>\wbohnfda.exe
%TEMP%\hgogro2m7xiwur76ago.exe
<SYSTEM32>\moipyfyrjsg\tst
<SYSTEM32>\pxhbqdmzgni.exe
<SYSTEM32>\moipyfyrjsg\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\wbohnfda.exe
<SYSTEM32>\pxhbqdmzgni.exe

Удаляет следующие файлы:

%WINDIR%\Temp\hgogro2ry3iw.exe
<DRIVERS>\etc\hosts
%TEMP%\hgogro2m7xiwur76ago.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'si###oll.net':80
'ro###eal.net':80
'si###uild.net':80
'ro###oll.net':80
'ju###ron.net':80
'mo###uild.net':80
'si###eal.net':80
'mo###ron.net':80
'ro###uild.net':80
'pi###oll.net':80
'so###oll.net':80
'pi###uild.net':80
'so###uild.net':80
'ro###ron.net':80
'si###ron.net':80
'pi###eal.net':80
'so###eal.net':80
'ju###uild.net':80
'wh###eal.net':80
'fe###ron.net':80
'wh###oll.net':80
'hi###eal.net':80
'lo###uild.net':80
'fe###oll.net':80
'lo###ron.net':80
'fe###uild.net':80
'hi###oll.net':80
'mo###eal.net':80
'ju###eal.net':80
'mo###oll.net':80
'ju###oll.net':80
'hi###uild.net':80
'wh###uild.net':80
'hi###ron.net':80
'wh###ron.net':80
'fe###erve.net':80
'lo###erve.net':80
'fe###ome.net':80
'lo###ome.net':80
'th###come.net':80
'th###nerve.net':80
'th###weight.net':80
'th###took.net':80
'lo###ook.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'lo###eight.net':80
'fe###ook.net':80
'wh###erve.net':80
'fe###eight.net':80
'dr###weight.net':80
'kn###oll.net':80
'ab###oll.net':80
'kn###uild.net':80
'ab###uild.net':80
'pi###ron.net':80
'so###ron.net':80
'kn###eal.net':80
'ab###eal.net':80
'ab###ron.net':80
'wi###ook.net':80
'dr###come.net':80
'wi###eight.net':80
'dr###took.net':80
'wi###erve.net':80
'kn###ron.net':80
'wi###ome.net':80
'dr###nerve.net':80

TCP:

Запросы HTTP GET:

http://si###oll.net/index.php
http://ro###eal.net/index.php
http://si###uild.net/index.php
http://ro###oll.net/index.php
http://ju###ron.net/index.php
http://mo###uild.net/index.php
http://si###eal.net/index.php
http://mo###ron.net/index.php
http://ro###uild.net/index.php
http://pi###oll.net/index.php
http://so###oll.net/index.php
http://pi###uild.net/index.php
http://so###uild.net/index.php
http://ro###ron.net/index.php
http://si###ron.net/index.php
http://pi###eal.net/index.php
http://so###eal.net/index.php
http://ju###uild.net/index.php
http://wh###eal.net/index.php
http://fe###ron.net/index.php
http://wh###oll.net/index.php
http://hi###eal.net/index.php
http://lo###uild.net/index.php
http://fe###oll.net/index.php
http://lo###ron.net/index.php
http://fe###uild.net/index.php
http://hi###oll.net/index.php
http://mo###eal.net/index.php
http://ju###eal.net/index.php
http://mo###oll.net/index.php
http://ju###oll.net/index.php
http://hi###uild.net/index.php
http://wh###uild.net/index.php
http://hi###ron.net/index.php
http://wh###ron.net/index.php
http://fe###erve.net/index.php
http://lo###erve.net/index.php
http://fe###ome.net/index.php
http://lo###ome.net/index.php
http://th###come.net/index.php
http://th###nerve.net/index.php
http://th###weight.net/index.php
http://th###took.net/index.php
http://lo###ook.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://lo###eight.net/index.php
http://fe###ook.net/index.php
http://wh###erve.net/index.php
http://fe###eight.net/index.php
http://dr###weight.net/index.php
http://kn###oll.net/index.php
http://ab###oll.net/index.php
http://kn###uild.net/index.php
http://ab###uild.net/index.php
http://pi###ron.net/index.php
http://so###ron.net/index.php
http://kn###eal.net/index.php
http://ab###eal.net/index.php
http://ab###ron.net/index.php
http://wi###ook.net/index.php
http://dr###come.net/index.php
http://wi###eight.net/index.php
http://dr###took.net/index.php
http://wi###erve.net/index.php
http://kn###ron.net/index.php
http://wi###ome.net/index.php
http://dr###nerve.net/index.php

UDP:

DNS ASK si###oll.net
DNS ASK ro###eal.net
DNS ASK si###uild.net
DNS ASK ro###oll.net
DNS ASK ju###ron.net
DNS ASK mo###uild.net
DNS ASK si###eal.net
DNS ASK mo###ron.net
DNS ASK ro###uild.net
DNS ASK pi###oll.net
DNS ASK so###oll.net
DNS ASK pi###uild.net
DNS ASK so###uild.net
DNS ASK ro###ron.net
DNS ASK si###ron.net
DNS ASK pi###eal.net
DNS ASK so###eal.net
DNS ASK ju###uild.net
DNS ASK wh###eal.net
DNS ASK fe###ron.net
DNS ASK wh###oll.net
DNS ASK hi###eal.net
DNS ASK lo###uild.net
DNS ASK fe###oll.net
DNS ASK lo###ron.net
DNS ASK fe###uild.net
DNS ASK hi###oll.net
DNS ASK mo###eal.net
DNS ASK ju###eal.net
DNS ASK mo###oll.net
DNS ASK ju###oll.net
DNS ASK hi###uild.net
DNS ASK wh###uild.net
DNS ASK hi###ron.net
DNS ASK wh###ron.net
DNS ASK so###ron.net
DNS ASK fe###erve.net
DNS ASK lo###erve.net
DNS ASK fe###ome.net
DNS ASK lo###ome.net
DNS ASK th###come.net
DNS ASK th###nerve.net
DNS ASK th###weight.net
DNS ASK th###took.net
DNS ASK lo###ook.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK lo###eight.net
DNS ASK fe###ook.net
DNS ASK wh###erve.net
DNS ASK fe###eight.net
DNS ASK ab###uild.net
DNS ASK kn###oll.net
DNS ASK ab###ron.net
DNS ASK kn###uild.net
DNS ASK ab###eal.net
DNS ASK pi###ron.net
DNS ASK ab###oll.net
DNS ASK kn###eal.net
DNS ASK kn###ron.net
DNS ASK dr###took.net
DNS ASK wi###ook.net
DNS ASK dr###weight.net
DNS ASK wi###eight.net
DNS ASK dr###nerve.net
DNS ASK wi###erve.net
DNS ASK dr###come.net
DNS ASK wi###ome.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней