Trojan.DownLoader16.64011

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Proxy Backup Tracking Search' = '<SYSTEM32>\cgchzcsgpfei.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Auto-Discovery Video Search Thread] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\lppxlcujz.exe' "<SYSTEM32>\cgchzcsgpfei.exe"
'%WINDIR%\Temp\ixte2ve3nh2qjgws.exe' -r 41836 tcp
'%TEMP%\ixte2ve3472qjgwsa9pfxjs.exe'
'<SYSTEM32>\cgchzcsgpfei.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\achqdppob\run
<SYSTEM32>\achqdppob\rng
%WINDIR%\Temp\ixte2ve3nh2qjgws.exe
<SYSTEM32>\achqdppob\cfg
<SYSTEM32>\lppxlcujz.exe
%TEMP%\ixte2ve3472qjgwsa9pfxjs.exe
<SYSTEM32>\achqdppob\tst
<SYSTEM32>\cgchzcsgpfei.exe
<SYSTEM32>\achqdppob\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\lppxlcujz.exe
<SYSTEM32>\cgchzcsgpfei.exe

Удаляет следующие файлы:

%WINDIR%\Temp\ixte2ve3nh2qjgws.exe
<DRIVERS>\etc\hosts
%TEMP%\ixte2ve3472qjgwsa9pfxjs.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'mu###outer.net':80
'we###hoe.net':80
'ya###uter.net':80
'ya###oon.net':80
'mu###moon.net':80
'we###oon.net':80
'sp###moon.net':80
'sp####ctober.net':80
'sp###shoe.net':80
'we###ctober.net':80
'ha###oon.net':80
'hu###outer.net':80
'hu###moon.net':80
'hu####ctober.net':80
'ha###ctober.net':80
'ya###ctober.net':80
'mu####ctober.net':80
'mu###shoe.net':80
'ha###uter.net':80
'ya###hoe.net':80
'we###uter.net':80
'jo###hoe.net':80
'wi###hoe.net':80
'se####berouter.net':80
'se#####eroctober.net':80
'se####bermoon.net':80
'wi###oon.net':80
'jo###uter.net':80
'jo###oon.net':80
'jo###ctober.net':80
'wi###ctober.net':80
'fr####ctober.net':80
'of####ctober.net':80
'of###shoe.net':80
'sp###outer.net':80
'fr###shoe.net':80
'of###outer.net':80
'se####bershoe.net':80
'fr###outer.net':80
'fr###moon.net':80
'of###moon.net':80
'ha###hoe.net':80
'se####berroll.net':80
'ha###eal.net':80
'ha###oll.net':80
'ha###uild.net':80
'se####berbuild.net':80
'jo###uild.net':80
'wi###uild.net':80
'wi###ron.net':80
'se####berdeal.net':80
'jo###ron.net':80
'de###lxc.com':80
'fr###roll.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'ha###ron.net':80
'se####beriron.net':80
'of###deal.net':80
'of###roll.net':80
'fr###deal.net':80
'jo###oll.net':80
'wr###build.net':80
'ma###uild.net':80
'ma###ron.net':80
'ro###eal.net':80
'wr###iron.net':80
'ma###eal.net':80
'hu###shoe.net':80
'wr###deal.net':80
'wr###roll.net':80
'ma###oll.net':80
'de###ron.net':80
'ro###ron.net':80
'wi###eal.net':80
'wi###oll.net':80
'jo###eal.net':80
'ro###oll.net':80
'de###eal.net':80
'de###oll.net':80
'de###uild.net':80
'ro###uild.net':80

TCP:

Запросы HTTP GET:

http://mu###outer.net/index.php
http://we###hoe.net/index.php
http://ya###uter.net/index.php
http://ya###oon.net/index.php
http://mu###moon.net/index.php
http://we###oon.net/index.php
http://sp###moon.net/index.php
http://sp####ctober.net/index.php
http://sp###shoe.net/index.php
http://we###ctober.net/index.php
http://ha###oon.net/index.php
http://hu###outer.net/index.php
http://hu###moon.net/index.php
http://hu####ctober.net/index.php
http://ha###ctober.net/index.php
http://ya###ctober.net/index.php
http://mu####ctober.net/index.php
http://mu###shoe.net/index.php
http://ha###uter.net/index.php
http://ya###hoe.net/index.php
http://we###uter.net/index.php
http://jo###hoe.net/index.php
http://wi###hoe.net/index.php
http://se####berouter.net/index.php
http://se#####eroctober.net/index.php
http://se####bermoon.net/index.php
http://wi###oon.net/index.php
http://jo###uter.net/index.php
http://jo###oon.net/index.php
http://jo###ctober.net/index.php
http://wi###ctober.net/index.php
http://fr####ctober.net/index.php
http://of####ctober.net/index.php
http://of###shoe.net/index.php
http://sp###outer.net/index.php
http://fr###shoe.net/index.php
http://of###outer.net/index.php
http://se####bershoe.net/index.php
http://fr###outer.net/index.php
http://fr###moon.net/index.php
http://of###moon.net/index.php
http://ha###hoe.net/index.php
http://se####berroll.net/index.php
http://ha###eal.net/index.php
http://ha###oll.net/index.php
http://ha###uild.net/index.php
http://se####berbuild.net/index.php
http://jo###uild.net/index.php
http://wi###uild.net/index.php
http://wi###ron.net/index.php
http://se####berdeal.net/index.php
http://jo###ron.net/index.php
http://de###lxc.com/index.php
http://fr###roll.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://ha###ron.net/index.php
http://se####beriron.net/index.php
http://of###deal.net/index.php
http://of###roll.net/index.php
http://fr###deal.net/index.php
http://jo###oll.net/index.php
http://wr###build.net/index.php
http://ma###uild.net/index.php
http://ma###ron.net/index.php
http://ro###eal.net/index.php
http://wr###iron.net/index.php
http://ma###eal.net/index.php
http://hu###shoe.net/index.php
http://wr###deal.net/index.php
http://wr###roll.net/index.php
http://ma###oll.net/index.php
http://de###ron.net/index.php
http://ro###ron.net/index.php
http://wi###eal.net/index.php
http://wi###oll.net/index.php
http://jo###eal.net/index.php
http://ro###oll.net/index.php
http://de###eal.net/index.php
http://de###oll.net/index.php
http://de###uild.net/index.php
http://ro###uild.net/index.php

UDP:

DNS ASK we###hoe.net
DNS ASK sp###shoe.net
DNS ASK mu###outer.net
DNS ASK mu###moon.net
DNS ASK ya###uter.net
DNS ASK sp###moon.net
DNS ASK we###uter.net
DNS ASK we###oon.net
DNS ASK we###ctober.net
DNS ASK sp####ctober.net
DNS ASK ya###oon.net
DNS ASK ha###oon.net
DNS ASK hu###outer.net
DNS ASK hu###moon.net
DNS ASK hu####ctober.net
DNS ASK ha###ctober.net
DNS ASK ya###ctober.net
DNS ASK mu####ctober.net
DNS ASK mu###shoe.net
DNS ASK ha###uter.net
DNS ASK ya###hoe.net
DNS ASK wi###hoe.net
DNS ASK jo###ctober.net
DNS ASK jo###hoe.net
DNS ASK se####bermoon.net
DNS ASK se####berouter.net
DNS ASK jo###uter.net
DNS ASK wi###uter.net
DNS ASK wi###oon.net
DNS ASK wi###ctober.net
DNS ASK jo###oon.net
DNS ASK se#####eroctober.net
DNS ASK fr####ctober.net
DNS ASK of####ctober.net
DNS ASK of###shoe.net
DNS ASK sp###outer.net
DNS ASK fr###shoe.net
DNS ASK of###outer.net
DNS ASK se####bershoe.net
DNS ASK fr###outer.net
DNS ASK fr###moon.net
DNS ASK of###moon.net
DNS ASK ha###hoe.net
DNS ASK se####berroll.net
DNS ASK ha###eal.net
DNS ASK ha###oll.net
DNS ASK ha###uild.net
DNS ASK se####berbuild.net
DNS ASK jo###uild.net
DNS ASK wi###uild.net
DNS ASK wi###ron.net
DNS ASK se####berdeal.net
DNS ASK jo###ron.net
DNS ASK de###lxc.com
DNS ASK fr###roll.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK ha###ron.net
DNS ASK se####beriron.net
DNS ASK of###deal.net
DNS ASK of###roll.net
DNS ASK fr###deal.net
DNS ASK jo###oll.net
DNS ASK wr###build.net
DNS ASK ma###uild.net
DNS ASK ma###ron.net
DNS ASK ro###eal.net
DNS ASK wr###iron.net
DNS ASK ma###eal.net
DNS ASK hu###shoe.net
DNS ASK wr###deal.net
DNS ASK wr###roll.net
DNS ASK ma###oll.net
DNS ASK de###ron.net
DNS ASK ro###ron.net
DNS ASK wi###eal.net
DNS ASK wi###oll.net
DNS ASK jo###eal.net
DNS ASK ro###oll.net
DNS ASK de###eal.net
DNS ASK de###oll.net
DNS ASK de###uild.net
DNS ASK ro###uild.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней