Trojan.DownLoader16.63260

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\ec525f4.exe
C:\ec525f4\ec525f4.exe

Сетевая активность:

Подключается к:

'vi###riaro.ru':80
'wa#######gefortlauderdale.info':80
'ge####llardart.com':80
'gj#####icambridge.com':80
'kh####iaorder.com':80
'pc#####gkeyboards.com':80
'le###ertabi.net':80
'ag##gh.com':80
'en###cade.org':80
'ao###sion.com':80
'ka####eservat.com':80
'br######gmentationnow.com':80
'di#####ion.ardinova.com':80
'an######ikzeminkaplama.com':80
'hu###kusagi.com':80
'fo##be.ru':80
'hc##s.com':80
'bd###ndia.com':80
'gu#####esportsteam.com':80
'da####ollmusic.com':80
'my####rnalip.com':80
'ip##ddr.es':80
'bi##el.com':80
'cu###yip.com':80
'ao##23.com':80
'co####ntenerife.com':80
'by###rders.com':80
'li#######araimprimirdinero.com':80
'ge####letsnow.com':80
'de##.###international.com':80
'as####toshiko.com':80
'at##vt.com':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://gj#####icambridge.com/OLD%20FILES/new-site/images/3.php?m=##########
http://ge####llardart.com/wp-admin/network/3.php?h=##########
http://an######ikzeminkaplama.com/wp-includes/theme-compat/1.php?k=##########
http://vi###riaro.ru/wp-content/plugins/tubepress/src/main/web/js/jscolor/4.php?o=##########
http://ag##gh.com/wos/js/1.php?h=##########
http://le###ertabi.net/site/components/com_user/3.php?o=##########
http://wa#######gefortlauderdale.info/wp-content/cache/1.php?u=##########
http://en###cade.org/documentos/2014/05/3.php?g=##########
http://br######gmentationnow.com/wp-content/plugins/contact-form-7/languages/2.php?p=##########
http://ka####eservat.com/wp-content/plugins/js_composer/assets/lib/vcIconPicker/themes/grey-theme/5.php?t=##########
http://ao###sion.com/gsqgu/.f6e2634/1.php?n=##########
http://di#####ion.ardinova.com/wp-admin/images/screenshots/2.php?t=##########
http://fo##be.ru/wp-content/plugins/wp-super-popup/tiny_mce/themes/advanced/skins/o2k7/4.php?r=##########
http://hu###kusagi.com/wp-includes/SimplePie/Net/3.php?c=##########
http://kh####iaorder.com/wp-includes/SimplePie/Cache/3.php?m=##########
http://gu#####esportsteam.com/wp-content2/plugins/backupbuddy/views/settings/3.php?e=##########
http://de##.###international.com/2.php?v=##########
http://ge####letsnow.com/wp-content/pep-vn/static-vars/3.php?n=##########
http://da####ollmusic.com/.f622361ee0b4be53991dffe21b5a361f/b/a/2.php?j=##########
http://bi##el.com/media/media/css/1.php?b=##########
http://bd###ndia.com/wp-includes/Text/Diff/Engine/1.php?k=##########
http://hc##s.com/3.php?k=##########
http://li#######araimprimirdinero.com/magaly/wp-admin/css/3.php?y=##########
http://by###rders.com/2.php?c=##########
http://pc#####gkeyboards.com/wp-content/plugins/wordpress-seo/vendor/composer/installers/tests/Composer/5.php?f=##########
http://ao##23.com/gsqgu/.f6e2634/1.php?x=##########
http://at##vt.com/wp-includes/Text/Diff/1.php?n=##########
http://as####toshiko.com/parts/org/1.php?q=##########
http://co####ntenerife.com/wp-content/plugins/post-ratings/templates/2.php?f=##########