Trojan.DownLoader18.26413

Добавлен в вирусную базу Dr.Web: 2015-12-27

Описание добавлено: 2015-12-27

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Store Link TP Transaction Acquisition' = '<SYSTEM32>\giikjdjnxxtt.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Software CNG Block BranchCache Office Time] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\lffqzhqsg.exe' "<SYSTEM32>\giikjdjnxxtt.exe"
'%WINDIR%\Temp\jnjbmsi9mxrnzqhyr.exe' -r 32709 tcp
'%TEMP%\jnjbmsi9priikshyrty73ktz.exe'
'<SYSTEM32>\giikjdjnxxtt.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\wpfsgitquzwkz\run
<SYSTEM32>\wpfsgitquzwkz\rng
%WINDIR%\Temp\jnjbmsi9mxrnzqhyr.exe
<SYSTEM32>\wpfsgitquzwkz\cfg
<SYSTEM32>\lffqzhqsg.exe
%TEMP%\jnjbmsi9priikshyrty73ktz.exe
<SYSTEM32>\wpfsgitquzwkz\tst
<SYSTEM32>\giikjdjnxxtt.exe
<SYSTEM32>\wpfsgitquzwkz\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\lffqzhqsg.exe
<SYSTEM32>\giikjdjnxxtt.exe

Удаляет следующие файлы:

%WINDIR%\Temp\jnjbmsi9mxrnzqhyr.exe
<DRIVERS>\etc\hosts
%TEMP%\jnjbmsi9priikshyrty73ktz.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ha###all.net':80
'se####berwall.net':80
'ha###ther.net':80
'se####berother.net':80
'jo###orty.net':80
'wi###orty.net':80
'jo###ree.net':80
'wi###ree.net':80
'fr###wall.net':80
'of###wall.net':80
'fr###other.net':80
'of###other.net':80
'ha###orty.net':80
'se####berforty.net':80
'ha###ree.net':80
'se####berfree.net':80
'de###all.net':80
'ro###all.net':80
'de###ther.net':80
'ro###ther.net':80
'wr###forty.net':80
'ma###orty.net':80
'wr###free.net':80
'ma###ree.net':80
'jo###all.net':80
'wi###all.net':80
'jo###ther.net':80
'wi###ther.net':80
'de###orty.net':80
'ro###orty.net':80
'de###ree.net':80
'ro###ree.net':80
'ef###tbuilt.net':80
'th###while.net':80
'of####urprise.net':80
'ri###nstorm.net':80
'ya###orty.net':80
'mu###forty.net':80
'ya###ree.net':80
'mu###free.net':80
'de####promise.net':80
'se####strong.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'ch####nother.net':80
'gw#####ynhuddleston.net':80
'si######edwerryhouse.net':80
'mo####gduring.net':80
'we###all.net':80
'sp###wall.net':80
'we###ther.net':80
'sp###other.net':80
'fr###forty.net':80
'of###forty.net':80
'fr###free.net':80
'of###free.net':80
'ya###all.net':80
'mu###wall.net':80
'ya###ther.net':80
'mu###other.net':80
'we###orty.net':80
'sp###forty.net':80
'we###ree.net':80
'sp###free.net':80

TCP:

Запросы HTTP GET:

http://ha###all.net/index.php
http://se####berwall.net/index.php
http://ha###ther.net/index.php
http://se####berother.net/index.php
http://jo###orty.net/index.php
http://wi###orty.net/index.php
http://jo###ree.net/index.php
http://wi###ree.net/index.php
http://fr###wall.net/index.php
http://of###wall.net/index.php
http://fr###other.net/index.php
http://of###other.net/index.php
http://ha###orty.net/index.php
http://se####berforty.net/index.php
http://ha###ree.net/index.php
http://se####berfree.net/index.php
http://de###all.net/index.php
http://ro###all.net/index.php
http://de###ther.net/index.php
http://ro###ther.net/index.php
http://wr###forty.net/index.php
http://ma###orty.net/index.php
http://wr###free.net/index.php
http://ma###ree.net/index.php
http://jo###all.net/index.php
http://wi###all.net/index.php
http://jo###ther.net/index.php
http://wi###ther.net/index.php
http://de###orty.net/index.php
http://ro###orty.net/index.php
http://de###ree.net/index.php
http://ro###ree.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://of####urprise.net/index.php
http://ri###nstorm.net/index.php
http://ya###orty.net/index.php
http://mu###forty.net/index.php
http://ya###ree.net/index.php
http://mu###free.net/index.php
http://de####promise.net/index.php
http://se####strong.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://ch####nother.net/index.php
http://gw#####ynhuddleston.net/index.php
http://si######edwerryhouse.net/index.php
http://mo####gduring.net/index.php
http://we###all.net/index.php
http://sp###wall.net/index.php
http://we###ther.net/index.php
http://sp###other.net/index.php
http://fr###forty.net/index.php
http://of###forty.net/index.php
http://fr###free.net/index.php
http://of###free.net/index.php
http://ya###all.net/index.php
http://mu###wall.net/index.php
http://ya###ther.net/index.php
http://mu###other.net/index.php
http://we###orty.net/index.php
http://sp###forty.net/index.php
http://we###ree.net/index.php
http://sp###free.net/index.php

UDP:

DNS ASK ha###all.net
DNS ASK se####berwall.net
DNS ASK ha###ther.net
DNS ASK se####berother.net
DNS ASK jo###orty.net
DNS ASK wi###orty.net
DNS ASK jo###ree.net
DNS ASK wi###ree.net
DNS ASK fr###wall.net
DNS ASK of###wall.net
DNS ASK fr###other.net
DNS ASK of###other.net
DNS ASK ha###orty.net
DNS ASK se####berforty.net
DNS ASK ha###ree.net
DNS ASK se####berfree.net
DNS ASK jo###ther.net
DNS ASK ro###all.net
DNS ASK wr###free.net
DNS ASK ro###ther.net
DNS ASK de###all.net
DNS ASK ma###orty.net
DNS ASK wr###other.net
DNS ASK ma###ree.net
DNS ASK wr###forty.net
DNS ASK wi###all.net
DNS ASK de###ree.net
DNS ASK wi###ther.net
DNS ASK jo###all.net
DNS ASK ro###orty.net
DNS ASK de###ther.net
DNS ASK ro###ree.net
DNS ASK de###orty.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK of####urprise.net
DNS ASK ri###nstorm.net
DNS ASK ya###orty.net
DNS ASK mu###forty.net
DNS ASK ya###ree.net
DNS ASK mu###free.net
DNS ASK de####promise.net
DNS ASK se####strong.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK ch####nother.net
DNS ASK gw#####ynhuddleston.net
DNS ASK si######edwerryhouse.net
DNS ASK mo####gduring.net
DNS ASK we###all.net
DNS ASK sp###wall.net
DNS ASK we###ther.net
DNS ASK sp###other.net
DNS ASK fr###forty.net
DNS ASK of###forty.net
DNS ASK fr###free.net
DNS ASK of###free.net
DNS ASK ya###all.net
DNS ASK mu###wall.net
DNS ASK ya###ther.net
DNS ASK mu###other.net
DNS ASK we###orty.net
DNS ASK sp###forty.net
DNS ASK we###ree.net
DNS ASK sp###free.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней