Trojan.DownLoader17.44216

Добавлен в вирусную базу Dr.Web: 2015-11-09

Описание добавлено: 2015-11-09

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Player Multimedia Web Portable' = '<SYSTEM32>\ddronwwxcz.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic PNRP Brightness Grouping WinHTTP CNG] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\srqvadoij.exe' "<SYSTEM32>\ddronwwxcz.exe"
'%WINDIR%\Temp\nvqcvh34isdjk.exe' -r 30633 tcp
'%TEMP%\nvqcvh2z5ndjkyevsdg.exe'
'<SYSTEM32>\ddronwwxcz.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\qtmgussm\run
<SYSTEM32>\qtmgussm\rng
%WINDIR%\Temp\nvqcvh34isdjk.exe
<SYSTEM32>\qtmgussm\cfg
<SYSTEM32>\srqvadoij.exe
%TEMP%\nvqcvh2z5ndjkyevsdg.exe
<SYSTEM32>\qtmgussm\tst
<SYSTEM32>\ddronwwxcz.exe
<SYSTEM32>\qtmgussm\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\srqvadoij.exe
<SYSTEM32>\ddronwwxcz.exe

Удаляет следующие файлы:

%WINDIR%\Temp\nvqcvh34isdjk.exe
<DRIVERS>\etc\hosts
%TEMP%\nvqcvh2z5ndjkyevsdg.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'me#####siderable.net':80
'si#####siderable.net':80
'me###est.net':80
'si###est.net':80
'cl###them.net':80
'da###hem.net':80
'me###asy.net':80
'si###asy.net':80
'si###hem.net':80
'mo###est.net':80
'su#####onsiderable.net':80
'mo###hem.net':80
'su###ybest.net':80
'mo###asy.net':80
'me###hem.net':80
'mo#####siderable.net':80
'su###yeasy.net':80
'tr###light.net':80
'mi###one.net':80
'tr###fool.net':80
'mi###ight.net':80
'du###oes.net':80
'wi###ool.net':80
'tr###gone.net':80
'wi###oes.net':80
'mi###ool.net':80
'cl#####nsiderable.net':80
'da#####siderable.net':80
'cl###best.net':80
'da###est.net':80
'mi###oes.net':80
'tr###goes.net':80
'cl###easy.net':80
'da###asy.net':80
'th###best.net':80
'si###best.net':80
'th###them.net':80
'si###them.net':80
'th###easy.net':80
'si###easy.net':80
'th#####nsiderable.net':80
'si#####nsiderable.net':80
'du###asy.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'du#####siderable.net':80
'wi###asy.net':80
'du###est.net':80
'wi#####siderable.net':80
'th###est.net':80
'qu#####nsiderable.net':80
'th###hem.net':80
'qu###best.net':80
'th###asy.net':80
'su###ythem.net':80
'th#####siderable.net':80
'qu###easy.net':80
'qu###them.net':80
'ca###est.net':80
'he###est.net':80
'ca###hem.net':80
'he###hem.net':80
'ca###asy.net':80
'he###asy.net':80
'ca#####siderable.net':80
'he#####siderable.net':80

TCP:

Запросы HTTP GET:

http://me#####siderable.net/index.php
http://si#####siderable.net/index.php
http://me###est.net/index.php
http://si###est.net/index.php
http://cl###them.net/index.php
http://da###hem.net/index.php
http://me###asy.net/index.php
http://si###asy.net/index.php
http://si###hem.net/index.php
http://mo###est.net/index.php
http://su#####onsiderable.net/index.php
http://mo###hem.net/index.php
http://su###ybest.net/index.php
http://mo###asy.net/index.php
http://me###hem.net/index.php
http://mo#####siderable.net/index.php
http://su###yeasy.net/index.php
http://tr###light.net/index.php
http://mi###one.net/index.php
http://tr###fool.net/index.php
http://mi###ight.net/index.php
http://du###oes.net/index.php
http://wi###ool.net/index.php
http://tr###gone.net/index.php
http://wi###oes.net/index.php
http://mi###ool.net/index.php
http://cl#####nsiderable.net/index.php
http://da#####siderable.net/index.php
http://cl###best.net/index.php
http://da###est.net/index.php
http://mi###oes.net/index.php
http://tr###goes.net/index.php
http://cl###easy.net/index.php
http://da###asy.net/index.php
http://th###best.net/index.php
http://si###best.net/index.php
http://th###them.net/index.php
http://si###them.net/index.php
http://th###easy.net/index.php
http://si###easy.net/index.php
http://th#####nsiderable.net/index.php
http://si#####nsiderable.net/index.php
http://du###asy.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://du#####siderable.net/index.php
http://wi###asy.net/index.php
http://du###est.net/index.php
http://wi#####siderable.net/index.php
http://th###est.net/index.php
http://qu#####nsiderable.net/index.php
http://th###hem.net/index.php
http://qu###best.net/index.php
http://th###asy.net/index.php
http://su###ythem.net/index.php
http://th#####siderable.net/index.php
http://qu###easy.net/index.php
http://qu###them.net/index.php
http://ca###est.net/index.php
http://he###est.net/index.php
http://ca###hem.net/index.php
http://he###hem.net/index.php
http://ca###asy.net/index.php
http://he###asy.net/index.php
http://ca#####siderable.net/index.php
http://he#####siderable.net/index.php

UDP:

DNS ASK me#####siderable.net
DNS ASK si#####siderable.net
DNS ASK me###est.net
DNS ASK si###est.net
DNS ASK cl###them.net
DNS ASK da###hem.net
DNS ASK me###asy.net
DNS ASK si###asy.net
DNS ASK si###hem.net
DNS ASK mo###est.net
DNS ASK su#####onsiderable.net
DNS ASK mo###hem.net
DNS ASK su###ybest.net
DNS ASK mo###asy.net
DNS ASK me###hem.net
DNS ASK mo#####siderable.net
DNS ASK su###yeasy.net
DNS ASK cl###best.net
DNS ASK mi###one.net
DNS ASK tr###gone.net
DNS ASK mi###ight.net
DNS ASK tr###light.net
DNS ASK wi###ool.net
DNS ASK du###ool.net
DNS ASK wi###oes.net
DNS ASK du###oes.net
DNS ASK tr###fool.net
DNS ASK da#####siderable.net
DNS ASK cl###easy.net
DNS ASK da###est.net
DNS ASK cl#####nsiderable.net
DNS ASK tr###goes.net
DNS ASK mi###ool.net
DNS ASK da###asy.net
DNS ASK mi###oes.net
DNS ASK th###best.net
DNS ASK si###best.net
DNS ASK th###them.net
DNS ASK si###them.net
DNS ASK th###easy.net
DNS ASK si###easy.net
DNS ASK th#####nsiderable.net
DNS ASK si#####nsiderable.net
DNS ASK du###asy.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK du#####siderable.net
DNS ASK wi###asy.net
DNS ASK du###est.net
DNS ASK wi#####siderable.net
DNS ASK th###est.net
DNS ASK qu#####nsiderable.net
DNS ASK th###hem.net
DNS ASK qu###best.net
DNS ASK th###asy.net
DNS ASK su###ythem.net
DNS ASK th#####siderable.net
DNS ASK qu###easy.net
DNS ASK qu###them.net
DNS ASK ca###est.net
DNS ASK he###est.net
DNS ASK ca###hem.net
DNS ASK he###hem.net
DNS ASK ca###asy.net
DNS ASK he###asy.net
DNS ASK ca#####siderable.net
DNS ASK he#####siderable.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней