Trojan.DownLoader21.46346

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Interface Brightness Controls Input Source' = 'C:\tazfiseweowg\ljcmnodd.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Problem Portable Provider Session Notification] 'ImagePath' = 'C:\tazfiseweowg\ljcmnodd.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Problem Portable Provider Session Notification] 'Start' = '00000002'

Изменения в файловой системе:

Создает следующие файлы:

C:\tazfiseweowg\ljcmnodd.exe
C:\tazfiseweowg\oemakag.exe
C:\tazfiseweowg\bvne30g2bezclmrqva.exe
%WINDIR%\tazfiseweowg\ezmksytcvpr
C:\tazfiseweowg\ezmksytcvpr

Присваивает атрибут 'скрытый' для следующих файлов:

C:\tazfiseweowg\oemakag.exe
C:\tazfiseweowg\ljcmnodd.exe

Удаляет следующие файлы:

C:\tazfiseweowg\bvne30g2bezclmrqva.exe
%WINDIR%\tazfiseweowg\ezmksytcvpr

Подменяет следующие файлы:

%WINDIR%\tazfiseweowg\ezmksytcvpr

Сетевая активность:

Подключается к:

'fo###tshort.net':80
'in####seshort.net':80
'fo####opinion.net':80
'th####hpromise.net':80
'fo####should.net':80
'in####seshould.net':80
'in####seopinion.net':80
're####ershould.net':80
'wo###short.net':80
're####ershort.net':80
'fo####promise.net':80
'in####sepromise.net':80
'wo###should.net':80
'su####opinion.net':80
'wi####promise.net':80
'su####promise.net':80
'wi###nshort.net':80
'su###rshort.net':80
'wi####opinion.net':80
'ef####should.net':80
'ef####opinion.net':80
'th####hopinion.net':80
'ef####promise.net':80
'th####hshould.net':80
'ef###tshort.net':80
'th####hshort.net':80
'wo####pinion.net':80
'li####office.net':80
'de####yarrive.net':80
'li####arrive.net':80
'de####ydistance.net':80
'li####distance.net':80
'de####yoffice.net':80
'ri####supply.net':80
'ri####office.net':80
'be####office.net':80
'ri####arrive.net':80
'be####supply.net':80
'ri####distance.net':80
'be####distance.net':80
'jo####ysupply.net':80
'hu####dsupply.net':80
'jo####ydistance.net':80
're####eropinion.net':80
'wo####romise.net':80
're####erpromise.net':80
'hu####ddistance.net':80
'hu####darrive.net':80
'de####ysupply.net':80
'li####supply.net':80
'jo####yoffice.net':80
'hu####doffice.net':80
'jo####yarrive.net':80
'cl###letter.net':80
'th####ifferent.net':80
'cl####ifferent.net':80
'th###beside.net':80
'cl###beside.net':80
'th###letter.net':80
'jo####yshould.net':80
'jo####yopinion.net':80
'hu####dopinion.net':80
'jo####ypromise.net':80
'hu####dshould.net':80
'jo####yshort.net':80
'hu####dshort.net':80
'am####surprise.net':80
'we####rsurprise.net':80
'am####beside.net':80
'hi####yletter.net':80
'st#####different.net':80
'hi#####different.net':80
'we####rbeside.net':80
'we#####different.net':80
'th####urprise.net':80
'cl####urprise.net':80
'am####letter.net':80
'we####rletter.net':80
'am####different.net':80
'hu####dpromise.net':80
'ch###should.net':80
'th###should.net':80
'ch###short.net':80
'be####opinion.net':80
'ri####promise.net':80
'be####promise.net':80
'th###short.net':80
'th####romise.net':80
'wi####should.net':80
'su####should.net':80
'ch####pinion.net':80
'th####pinion.net':80
'ch####romise.net':80
'li###eshort.net':80
'de####yopinion.net':80
'li####opinion.net':80
'de####yshould.net':80
'li####should.net':80
'de####yshort.net':80
'de####ypromise.net':80
'ri###nshort.net':80
'be###gshort.net':80
'ri####opinion.net':80
'li####promise.net':80
'ri####should.net':80
'be####should.net':80

TCP:

Запросы HTTP GET:

http://fo###tshort.net/index.php
http://in####seshort.net/index.php
http://fo####opinion.net/index.php
http://th####hpromise.net/index.php
http://fo####should.net/index.php
http://in####seshould.net/index.php
http://in####seopinion.net/index.php
http://re####ershould.net/index.php
http://wo###short.net/index.php
http://re####ershort.net/index.php
http://fo####promise.net/index.php
http://in####sepromise.net/index.php
http://wo###should.net/index.php
http://su####opinion.net/index.php
http://wi####promise.net/index.php
http://su####promise.net/index.php
http://wi###nshort.net/index.php
http://su###rshort.net/index.php
http://wi####opinion.net/index.php
http://ef####should.net/index.php
http://ef####opinion.net/index.php
http://th####hopinion.net/index.php
http://ef####promise.net/index.php
http://th####hshould.net/index.php
http://ef###tshort.net/index.php
http://th####hshort.net/index.php
http://wo####pinion.net/index.php
http://li####office.net/index.php
http://de####yarrive.net/index.php
http://li####arrive.net/index.php
http://de####ydistance.net/index.php
http://li####distance.net/index.php
http://de####yoffice.net/index.php
http://ri####supply.net/index.php
http://ri####office.net/index.php
http://be####office.net/index.php
http://ri####arrive.net/index.php
http://be####supply.net/index.php
http://ri####distance.net/index.php
http://be####distance.net/index.php
http://jo####ysupply.net/index.php
http://hu####dsupply.net/index.php
http://jo####ydistance.net/index.php
http://re####eropinion.net/index.php
http://wo####romise.net/index.php
http://re####erpromise.net/index.php
http://hu####ddistance.net/index.php
http://hu####darrive.net/index.php
http://de####ysupply.net/index.php
http://li####supply.net/index.php
http://jo####yoffice.net/index.php
http://hu####doffice.net/index.php
http://jo####yarrive.net/index.php
http://cl###letter.net/index.php
http://th####ifferent.net/index.php
http://cl####ifferent.net/index.php
http://th###beside.net/index.php
http://cl###beside.net/index.php
http://th###letter.net/index.php
http://jo####yshould.net/index.php
http://jo####yopinion.net/index.php
http://hu####dopinion.net/index.php
http://jo####ypromise.net/index.php
http://hu####dshould.net/index.php
http://jo####yshort.net/index.php
http://hu####dshort.net/index.php
http://am####surprise.net/index.php
http://we####rsurprise.net/index.php
http://am####beside.net/index.php
http://hi####yletter.net/index.php
http://st#####different.net/index.php
http://hi#####different.net/index.php
http://we####rbeside.net/index.php
http://we#####different.net/index.php
http://th####urprise.net/index.php
http://cl####urprise.net/index.php
http://am####letter.net/index.php
http://we####rletter.net/index.php
http://am####different.net/index.php
http://hu####dpromise.net/index.php
http://ch###should.net/index.php
http://th###should.net/index.php
http://ch###short.net/index.php
http://be####opinion.net/index.php
http://ri####promise.net/index.php
http://be####promise.net/index.php
http://th###short.net/index.php
http://th####romise.net/index.php
http://wi####should.net/index.php
http://su####should.net/index.php
http://ch####pinion.net/index.php
http://th####pinion.net/index.php
http://ch####romise.net/index.php
http://li###eshort.net/index.php
http://de####yopinion.net/index.php
http://li####opinion.net/index.php
http://de####yshould.net/index.php
http://li####should.net/index.php
http://de####yshort.net/index.php
http://de####ypromise.net/index.php
http://ri###nshort.net/index.php
http://be###gshort.net/index.php
http://ri####opinion.net/index.php
http://li####promise.net/index.php
http://ri####should.net/index.php
http://be####should.net/index.php

UDP:

DNS ASK in####seshort.net
DNS ASK fo####opinion.net
DNS ASK in####seopinion.net
DNS ASK fo####should.net
DNS ASK in####seshould.net
DNS ASK fo###tshort.net
DNS ASK fo####promise.net
DNS ASK wo###short.net
DNS ASK re####ershort.net
DNS ASK wo####pinion.net
DNS ASK in####sepromise.net
DNS ASK wo###should.net
DNS ASK re####ershould.net
DNS ASK wi####promise.net
DNS ASK su####promise.net
DNS ASK ef####should.net
DNS ASK su###rshort.net
DNS ASK wi####opinion.net
DNS ASK su####opinion.net
DNS ASK th####hshould.net
DNS ASK th####hopinion.net
DNS ASK ef####promise.net
DNS ASK th####hpromise.net
DNS ASK ef###tshort.net
DNS ASK th####hshort.net
DNS ASK ef####opinion.net
DNS ASK re####eropinion.net
DNS ASK de####yarrive.net
DNS ASK li####arrive.net
DNS ASK ri####supply.net
DNS ASK li####distance.net
DNS ASK de####yoffice.net
DNS ASK li####office.net
DNS ASK be####supply.net
DNS ASK be####office.net
DNS ASK ri####arrive.net
DNS ASK be####arrive.net
DNS ASK ri####distance.net
DNS ASK be####distance.net
DNS ASK ri####office.net
DNS ASK hu####dsupply.net
DNS ASK jo####ydistance.net
DNS ASK hu####ddistance.net
DNS ASK wo####romise.net
DNS ASK re####erpromise.net
DNS ASK jo####ysupply.net
DNS ASK jo####yoffice.net
DNS ASK de####ysupply.net
DNS ASK li####supply.net
DNS ASK de####ydistance.net
DNS ASK hu####doffice.net
DNS ASK jo####yarrive.net
DNS ASK hu####darrive.net
DNS ASK wi###nshort.net
DNS ASK cl###letter.net
DNS ASK th####ifferent.net
DNS ASK cl####ifferent.net
DNS ASK th###beside.net
DNS ASK cl###beside.net
DNS ASK th###letter.net
DNS ASK jo####yshould.net
DNS ASK jo####yopinion.net
DNS ASK hu####dopinion.net
DNS ASK jo####ypromise.net
DNS ASK hu####dshould.net
DNS ASK jo####yshort.net
DNS ASK hu####dshort.net
DNS ASK am####surprise.net
DNS ASK we####rsurprise.net
DNS ASK am####beside.net
DNS ASK hi####yletter.net
DNS ASK st#####different.net
DNS ASK hi#####different.net
DNS ASK we####rbeside.net
DNS ASK we#####different.net
DNS ASK th####urprise.net
DNS ASK cl####urprise.net
DNS ASK am####letter.net
DNS ASK we####rletter.net
DNS ASK am####different.net
DNS ASK hu####dpromise.net
DNS ASK ch###should.net
DNS ASK th###should.net
DNS ASK ch###short.net
DNS ASK be####opinion.net
DNS ASK ri####promise.net
DNS ASK be####promise.net
DNS ASK th###short.net
DNS ASK th####romise.net
DNS ASK wi####should.net
DNS ASK su####should.net
DNS ASK ch####pinion.net
DNS ASK th####pinion.net
DNS ASK ch####romise.net
DNS ASK li###eshort.net
DNS ASK de####yopinion.net
DNS ASK li####opinion.net
DNS ASK de####yshould.net
DNS ASK li####should.net
DNS ASK de####yshort.net
DNS ASK de####ypromise.net
DNS ASK ri###nshort.net
DNS ASK be###gshort.net
DNS ASK ri####opinion.net
DNS ASK li####promise.net
DNS ASK ri####should.net
DNS ASK be####should.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней