Trojan.DownLoader10.62358

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\gdqk0kdvt_tsor0qpnhllnwif0qkzn_vrteeaowysigixqtdacuiqdggxgngxfpiofy0nexl0znrusuvtlxcjqk0mxxt_ynvt[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qsrafyab0diii0yeoh0ifej0ihmyjhvqsi0pvdgsy0nbvp0wgsy0clpzykacrndi0ejbi_vqvn0uudm0qtel0kbihwgkouykkof0pt[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\calajutf_ofno_ygfq_uobild0hjcrtwrpvltwyemyamof_ejhc0duipzmpplipz0pfoffrqubaks0kgbw0uupb0fqqk0rzkk0tu[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\fcgtdhxsdknqzajp0fcgtopgkoerd0zhgxvrynbc_jkau0vtdmfpdfhtna0litf0zajtuxnnnbqt0ticjiqiqsnjx0htddgk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\gjyv0xvak0uakbegnlxjig0ptybrdclohppgk0tyfv0jhxj0jvuy0gklaukblqp0yvnobtppsukyixatjx0uatega0pyplxljk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rc0zrxqehatrzpr0xtgx0tydfdmspvybfclzoblmv0temv0sila0dknn0gavqxioezovauktwvrhj0cbowxqjuoanacebatw[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\itqukqcbkydftmysglgalinnsnbajvvppzgdpywgpb_wgorlxqkqjvtfprdfvgl0runl0ofnh0yxvi0jzow0eycl0nsau0pf[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\igyhvaxlsyftxplx0stzh0wfif_uyvrzv0dfyqjharjplgtwjxbtdwpq0ejip0xixiyhfrjljxkbtyybcayxpbjg0dicu_rp[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\blcrkg0oxpydrrczrxqehdmcj0wkbh0gtejtevpusnh_jwsd_hefq0zhbttmtwzvqcex0vkyx0vlfr0ixeaelpijv0gbrgdrfa[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jheluq0fplg0snce0xczjdddhndvldh0kszo0dfmyyh0mptiddrtig0vrvpkokqnhfrlinagtjwpqdgkkig_hcxtnfglgash0[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\rqshgs0cdnbvp0hero0vnvykk0mvrt0pyru0shop0alqt0phorheejcley_nqfcbi0rojl0gdnejlejjv0fpiq0ksfmjtejabwfop0[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ms_qtusqz0ukwg0rglzlipblxrpddvniorn_xitsauwbejdmxobhjtfp0uaky0jkzn0jxmpdnuaxpdhsupbqspmgxlzrzgl[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ysglgajzqrpfxy0awrk0owgloweajutu0pyqk_jlronf0gnlx_osyb0jzakpbroprshqtrcfaatitys0oaorvnrudwmrbqfv[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\kg0oxpy0drrc0zrxq0ehat0rziios0kkbl_opzm0noba0qrzh_xili0elfm0oeuk0ysjk0dulg0xljufpjlrpcrfr0tyznvpxjkoat0pf[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\nadwwipqneyt_mxykvq0sripba0dnqzrocjnljkvpdr0usgx_bwgd_zmyv_jkyx_xvfp0wkgx0pttydwpfdmmvytcnkkyeih0cd[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zn0yjbq0rico0arzmfrqsransptxxnslmauzjnsnsamfvpypphjdmpauqrnquxldaqu0easuddpyznpqxvfcbqnfrd0cu[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zvyxpajheluqfplgsncenfllfqxqybft0xtcj0vqxs0cqou0rdrdtiybcjifpfitos0vlyj_wbfzcaxljuddvqexda0usab_[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\kgoxpydrrczrxqeh0atrz0iios0kkbl0opzmnobaqrzhxili_elfmoeukysjkdu0lgxl0jufp0jlrpcrfrtyzn0vpxjko0atpf[1].html

Сетевая активность:

Подключается к:

'cl#####ats.dns-dns.com':80
'fr#####teurssporting.us':80
'pu####countmovs.in':80

TCP:

Запросы HTTP GET:

cl#####ats.dns-dns.com/community/gdqk0kdvt_tsor0qpnhllnwif0qkzn_vrteeaowysigixqtdacuiqdggxgngxfpiofy0nexl0znrusuvtlxcjqk0mxxt_ynvt.php
pu####countmovs.in/community/qsrafyab0diii0yeoh0ifej0ihmyjhvqsi0pvdgsy0nbvp0wgsy0clpzykacrndi0ejbi_vqvn0uudm0qtel0kbihwgkouykkof0pt.php
pu####countmovs.in/forum/calajutf_ofno_ygfq_uobild0hjcrtwrpvltwyemyamof_ejhc0duipzmpplipz0pfoffrqubaks0kgbw0uupb0fqqk0rzkk0tu.php
fr#####teurssporting.us/forum/fcgtdhxsdknqzajp0fcgtopgkoerd0zhgxvrynbc_jkau0vtdmfpdfhtna0litf0zajtuxnnnbqt0ticjiqiqsnjx0htddgk.php
fr#####teurssporting.us/forum/gjyv0xvak0uakbegnlxjig0ptybrdclohppgk0tyfv0jhxj0jvuy0gklaukblqp0yvnobtppsukyixatjx0uatega0pyplxljk.php
fr#####teurssporting.us/community/rc0zrxqehatrzpr0xtgx0tydfdmspvybfclzoblmv0temv0sila0dknn0gavqxioezovauktwvrhj0cbowxqjuoanacebatw.php
cl#####ats.dns-dns.com/forums/itqukqcbkydftmysglgalinnsnbajvvppzgdpywgpb_wgorlxqkqjvtfprdfvgl0runl0ofnh0yxvi0jzow0eycl0nsau0pf.html
cl#####ats.dns-dns.com/forum/igyhvaxlsyftxplx0stzh0wfif_uyvrzv0dfyqjharjplgtwjxbtdwpq0ejip0xixiyhfrjljxkbtyybcayxpbjg0dicu_rp.php
pu####countmovs.in/forums/blcrkg0oxpydrrczrxqehdmcj0wkbh0gtejtevpusnh_jwsd_hefq0zhbttmtwzvqcex0vkyx0vlfr0ixeaelpijv0gbrgdrfa.html
cl#####ats.dns-dns.com/news/ms_qtusqz0ukwg0rglzlipblxrpddvniorn_xitsauwbejdmxobhjtfp0uaky0jkzn0jxmpdnuaxpdhsupbqspmgxlzrzgl.html
pu####countmovs.in/community/kg0oxpy0drrc0zrxq0ehat0rziios0kkbl_opzm0noba0qrzh_xili0elfm0oeuk0ysjk0dulg0xljufpjlrpcrfr0tyznvpxjkoat0pf.php
pu####countmovs.in/community/ysglgajzqrpfxy0awrk0owgloweajutu0pyqk_jlronf0gnlx_osyb0jzakpbroprshqtrcfaatitys0oaorvnrudwmrbqfv.php
fr#####teurssporting.us/forums/rqshgs0cdnbvp0hero0vnvykk0mvrt0pyru0shop0alqt0phorheejcley_nqfcbi0rojl0gdnejlejjv0fpiq0ksfmjtejabwfop0.html
fr#####teurssporting.us/community/zvyxpajheluqfplgsncenfllfqxqybft0xtcj0vqxs0cqou0rdrdtiybcjifpfitos0vlyj_wbfzcaxljuddvqexda0usab_.php
fr#####teurssporting.us/community/zn0yjbq0rico0arzmfrqsransptxxnslmauzjnsnsamfvpypphjdmpauqrnquxldaqu0easuddpyznpqxvfcbqnfrd0cu.php
cl#####ats.dns-dns.com/forums/jheluq0fplg0snce0xczjdddhndvldh0kszo0dfmyyh0mptiddrtig0vrvpkokqnhfrlinagtjwpqdgkkig_hcxtnfglgash0.html
cl#####ats.dns-dns.com/news/kgoxpydrrczrxqeh0atrz0iios0kkbl0opzmnobaqrzhxili_elfmoeukysjkdu0lgxl0jufp0jlrpcrfrtyzn0vpxjko0atpf.html
pu####countmovs.in/forum/nadwwipqneyt_mxykvq0sripba0dnqzrocjnljkvpdr0usgx_bwgd_zmyv_jkyx_xvfp0wkgx0pttydwpfdmmvytcnkkyeih0cd.php