Trojan.DownLoader17.32212

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Endpoint TP Human' = '<SYSTEM32>\gimckwkmolaj.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Source Filtering Device Base Themes List] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\iigbwsk.exe' "<SYSTEM32>\gimckwkmolaj.exe"
'%WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe' -r 29416 tcp
'%TEMP%\vhs1vzbu3b15n5kqja7nycws.exe'
'<SYSTEM32>\gimckwkmolaj.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\wqqmsqtmyqsg\run
<SYSTEM32>\wqqmsqtmyqsg\rng
%WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe
<SYSTEM32>\wqqmsqtmyqsg\cfg
<SYSTEM32>\iigbwsk.exe
%TEMP%\vhs1vzbu3b15n5kqja7nycws.exe
<SYSTEM32>\wqqmsqtmyqsg\tst
<SYSTEM32>\gimckwkmolaj.exe
<SYSTEM32>\wqqmsqtmyqsg\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\iigbwsk.exe
<SYSTEM32>\gimckwkmolaj.exe

Удаляет следующие файлы:

%WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe
<DRIVERS>\etc\hosts
%TEMP%\vhs1vzbu3b15n5kqja7nycws.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'eq###neck.net':80
'gr###neck.net':80
'ta###meet.net':80
'ta###food.net':80
'gl###eet.net':80
'eq###shown.net':80
'eq###meet.net':80
'gr###meet.net':80
'gr###food.net':80
'gr###shown.net':80
'eq###food.net':80
'sa###ood.net':80
'sp###eet.net':80
'sp###ood.net':80
'sp###hown.net':80
'sa###hown.net':80
'sa###eet.net':80
'ta###shown.net':80
'gl###ood.net':80
'gl###hown.net':80
'gl###eck.net':80
'ta###neck.net':80
'wa###meet.net':80
'fa###eet.net':80
'fa###ood.net':80
'fa###hown.net':80
'wa###food.net':80
'dr###neck.net':80
'dr###food.net':80
'th###ood.net':80
'th###hown.net':80
'th###eck.net':80
'dr###shown.net':80
'vi###shown.net':80
'sp###food.net':80
'sp###shown.net':80
'sp###neck.net':80
'vi###neck.net':80
'vi###food.net':80
'fa###eck.net':80
'wa###shown.net':80
'wa###neck.net':80
'sp###meet.net':80
'vi###meet.net':80
'sa###eck.net':80
'fa###roud.net':80
'wa###raise.net':80
'wa###croud.net':80
'wa###price.net':80
'fa###rice.net':80
'fa###aise.net':80
'th###rice.net':80
'dr###croud.net':80
'dr###price.net':80
'wa###reach.net':80
'fa###each.net':80
'de###lxc.com':80
'vi###price.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'sp###croud.net':80
'sp###reach.net':80
'vi###reach.net':80
'vi###raise.net':80
'vi###croud.net':80
'sp###raise.net':80
'wh###neck.net':80
'up###hown.net':80
'up###eck.net':80
'ar###meet.net':80
'so###meet.net':80
'wh###shown.net':80
'wh###meet.net':80
'sp###eck.net':80
'up###eet.net':80
'up###ood.net':80
'wh###food.net':80
'dr###reach.net':80
'th###each.net':80
'th###aise.net':80
'th###roud.net':80
'dr###raise.net':80
'ar###neck.net':80
'ar###food.net':80
'so###food.net':80
'so###shown.net':80
'so###neck.net':80
'ar###shown.net':80

TCP:

Запросы HTTP GET:

http://eq###neck.net/index.php
http://gr###neck.net/index.php
http://ta###meet.net/index.php
http://ta###food.net/index.php
http://gl###eet.net/index.php
http://eq###shown.net/index.php
http://eq###meet.net/index.php
http://gr###meet.net/index.php
http://gr###food.net/index.php
http://gr###shown.net/index.php
http://eq###food.net/index.php
http://sa###ood.net/index.php
http://sp###eet.net/index.php
http://sp###ood.net/index.php
http://sp###hown.net/index.php
http://sa###hown.net/index.php
http://sa###eet.net/index.php
http://ta###shown.net/index.php
http://gl###ood.net/index.php
http://gl###hown.net/index.php
http://gl###eck.net/index.php
http://ta###neck.net/index.php
http://wa###meet.net/index.php
http://fa###eet.net/index.php
http://fa###ood.net/index.php
http://fa###hown.net/index.php
http://wa###food.net/index.php
http://dr###neck.net/index.php
http://dr###food.net/index.php
http://th###ood.net/index.php
http://th###hown.net/index.php
http://th###eck.net/index.php
http://dr###shown.net/index.php
http://vi###shown.net/index.php
http://sp###food.net/index.php
http://sp###shown.net/index.php
http://sp###neck.net/index.php
http://vi###neck.net/index.php
http://vi###food.net/index.php
http://fa###eck.net/index.php
http://wa###shown.net/index.php
http://wa###neck.net/index.php
http://sp###meet.net/index.php
http://vi###meet.net/index.php
http://sa###eck.net/index.php
http://fa###roud.net/index.php
http://wa###raise.net/index.php
http://wa###croud.net/index.php
http://wa###price.net/index.php
http://fa###rice.net/index.php
http://fa###aise.net/index.php
http://th###rice.net/index.php
http://dr###croud.net/index.php
http://dr###price.net/index.php
http://wa###reach.net/index.php
http://fa###each.net/index.php
http://de###lxc.com/index.php
http://vi###price.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://sp###croud.net/index.php
http://sp###reach.net/index.php
http://vi###reach.net/index.php
http://vi###raise.net/index.php
http://vi###croud.net/index.php
http://sp###raise.net/index.php
http://wh###neck.net/index.php
http://up###hown.net/index.php
http://up###eck.net/index.php
http://ar###meet.net/index.php
http://so###meet.net/index.php
http://wh###shown.net/index.php
http://wh###meet.net/index.php
http://sp###eck.net/index.php
http://up###eet.net/index.php
http://up###ood.net/index.php
http://wh###food.net/index.php
http://dr###reach.net/index.php
http://th###each.net/index.php
http://th###aise.net/index.php
http://th###roud.net/index.php
http://dr###raise.net/index.php
http://ar###neck.net/index.php
http://ar###food.net/index.php
http://so###food.net/index.php
http://so###shown.net/index.php
http://so###neck.net/index.php
http://ar###shown.net/index.php

UDP:

DNS ASK ta###meet.net
DNS ASK eq###neck.net
DNS ASK gl###eet.net
DNS ASK gl###ood.net
DNS ASK ta###food.net
DNS ASK gr###neck.net
DNS ASK gr###food.net
DNS ASK eq###meet.net
DNS ASK eq###food.net
DNS ASK eq###shown.net
DNS ASK gr###shown.net
DNS ASK sp###ood.net
DNS ASK sa###ood.net
DNS ASK sa###hown.net
DNS ASK sa###eck.net
DNS ASK sp###hown.net
DNS ASK sp###eet.net
DNS ASK gl###hown.net
DNS ASK ta###shown.net
DNS ASK ta###neck.net
DNS ASK sa###eet.net
DNS ASK gl###eck.net
DNS ASK gr###meet.net
DNS ASK wa###meet.net
DNS ASK fa###eet.net
DNS ASK fa###ood.net
DNS ASK fa###hown.net
DNS ASK wa###food.net
DNS ASK dr###neck.net
DNS ASK dr###food.net
DNS ASK th###ood.net
DNS ASK th###hown.net
DNS ASK th###eck.net
DNS ASK dr###shown.net
DNS ASK vi###shown.net
DNS ASK sp###food.net
DNS ASK sp###shown.net
DNS ASK sp###neck.net
DNS ASK vi###neck.net
DNS ASK vi###food.net
DNS ASK fa###eck.net
DNS ASK wa###shown.net
DNS ASK wa###neck.net
DNS ASK sp###meet.net
DNS ASK vi###meet.net
DNS ASK fa###roud.net
DNS ASK wa###raise.net
DNS ASK wa###croud.net
DNS ASK wa###price.net
DNS ASK fa###rice.net
DNS ASK fa###aise.net
DNS ASK th###rice.net
DNS ASK dr###croud.net
DNS ASK dr###price.net
DNS ASK wa###reach.net
DNS ASK fa###each.net
DNS ASK de###lxc.com
DNS ASK vi###price.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK sp###croud.net
DNS ASK sp###reach.net
DNS ASK vi###reach.net
DNS ASK vi###raise.net
DNS ASK vi###croud.net
DNS ASK sp###raise.net
DNS ASK wh###neck.net
DNS ASK up###hown.net
DNS ASK up###eck.net
DNS ASK ar###meet.net
DNS ASK so###meet.net
DNS ASK wh###shown.net
DNS ASK wh###meet.net
DNS ASK sp###eck.net
DNS ASK up###eet.net
DNS ASK up###ood.net
DNS ASK wh###food.net
DNS ASK dr###reach.net
DNS ASK th###each.net
DNS ASK th###aise.net
DNS ASK th###roud.net
DNS ASK dr###raise.net
DNS ASK ar###neck.net
DNS ASK ar###food.net
DNS ASK so###food.net
DNS ASK so###shown.net
DNS ASK so###neck.net
DNS ASK ar###shown.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней