Trojan.DownLoader10.59486

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\qtusqzukwg-rglz-lixp-uqjldinhga-dfns-vawkey-jkvn-cqacdf-phuk-uyipclfpgb-fzdixs-xstmgatwrg-ihgltu[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ytmxykvqsrznyj-bqclkfqnyngalign-fqakzajkrkll-fcrtxynndarivrey-qutf-stus-riuo-bfju-nenq-nhqs-qs[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ej-dapljvzvyxpa-jhwg-jxdw-bfmynbowiqmv-uxqk-zvus-shxqclosdffaxq-nsar-mylind-gjqk-dazm-heqp-pfgj-tw[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uk-wgrglzlipbuxmpbtznnafvgtexqkcb-nlht-ykvk-xxkdxy-ppdhiq-oxys-tybldixcte-oupfvrprio-zoxxoxne[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\jxqnjtixjx-qnjtix-bcgl-cugoalquebvaat-ightprnovkfvabioshxonhzousxt-ybea-teddxlbtjt-wiipmyfa[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ygfquobihckkrq-show-tijp-wkfpsp-egdnoa-bcys-gbgtam-nssp-qstefqrcjzbiht-nqco-riebhtxyqkwfprwgxc[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hjyqybtisddnxocqpbtuye-yxspxoyvwpnw-wguo-rnhcks-cuehnwbfoxmrwgvl-viip-phacpbrtmy-vafapp-nlxf[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\du-calajutfofnoyg-tmnapbnhyxxjexbqehsptyfvmrlzddjlqt-zhjz-iqak-xfkk-xjvrmvnniosd-lzzncgfqro-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pb-uxmp-fmgnlt-blcr-vlxlbi-owpy-twgaclegvnsrzayvrojwcnxj-jusdrgsrpq-llixoutmqn-dnjhqn-cbjztsdn[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\amrdmynsoeex-jlbw-xfyh-qjix-phtwzabqjvparcigmp-ejzj-spfc-qcsurndgamux-cjduyempgojhoekfnnyjks[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sisisisisisi-sisi-nsglnsgopb-kdco-amuqixalquvaackkdr-eaiqlgvyihxo-kdbf-oazv-dfqpawbwsppapfvy[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\gnlt-blcr-kgoxpydrau-alonmszrbl-rdqj-btos-zjstlaehbtkftixinhnhcnnqxxtu-bhtf-vaon-vaqn-sydf-cdtm-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\gx-tyeb-msqt-usqz-uksd-ygrg-nfzmgtxtoxiqxjehoxkdptcjcjsnjzcezjohdnllqsak-wkawzjxira-xyop-bcti[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\oahjyq-ybti-sddn-xosyjliiykzo-ykvn-fycl-naqjladwdhyeoysddhalalqkustuytuyqsxjytcnxignohzhcr[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rp-faauxfjwbh-eyvifzspellg-cnshzo-btyquq-cukf-nmop-bfdmyqfmvpkbdmnqfrlmdrju-bqlxfysusivqhtuy[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kg-oxpy-drrc-zrxq-ehdw-bwamiofmptyh-twjvam-baza-gxqn-ppgdcutwxo-shza-akkdlxqpns-cuoe-fqel-rabiprns[1].html

Сетевая активность:

Подключается к:

'ma#####nes.dns-dns.com':80
'me####ighting.us':80
'st###annatgp.in':80

TCP:

Запросы HTTP GET:

st###annatgp.in/community/ytmxykvqsrznyj-bqclkfqnyngalign-fqakzajkrkll-fcrtxynndarivrey-qutf-stus-riuo-bfju-nenq-nhqs-qs.php
me####ighting.us/community/hjyqybtisddnxocqpbtuye-yxspxoyvwpnw-wguo-rnhcks-cuehnwbfoxmrwgvl-viip-phacpbrtmy-vafapp-nlxf.php
me####ighting.us/forum/uk-wgrglzlipbuxmpbtznnafvgtexqkcb-nlht-ykvk-xxkdxy-ppdhiq-oxys-tybldixcte-oupfvrprio-zoxxoxne.php
ma#####nes.dns-dns.com/community/qtusqzukwg-rglz-lixp-uqjldinhga-dfns-vawkey-jkvn-cqacdf-phuk-uyipclfpgb-fzdixs-xstmgatwrg-ihgltu.php
me####ighting.us/forums/ygfquobihckkrq-show-tijp-wkfpsp-egdnoa-bcys-gbgtam-nssp-qstefqrcjzbiht-nqco-riebhtxyqkwfprwgxc.html
ma#####nes.dns-dns.com/forums/usqzuk-wgrg-lzlipb-glex-dksntendbipbftcqyk-abro-uaga-pyrneb-xlcb-pyqpyjwgganwlg-ddcl-lxfzarfcxq-.html
ma#####nes.dns-dns.com/community/du-calajutfofnoyg-tmnapbnhyxxjexbqehsptyfvmrlzddjlqt-zhjz-iqak-xfkk-xjvrmvnniosd-lzzncgfqro-.php
st###annatgp.in/community/jxqnjtixjx-qnjtix-bcgl-cugoalquebvaat-ightprnovkfvabioshxonhzousxt-ybea-teddxlbtjt-wiipmyfa.php
st###annatgp.in/forums/ej-dapljvzvyxpa-jhwg-jxdw-bfmynbowiqmv-uxqk-zvus-shxqclosdffaxq-nsar-mylind-gjqk-dazm-heqp-pfgj-tw.html
st###annatgp.in/news/sisisisisisi-sisi-nsglnsgopb-kdco-amuqixalquvaackkdr-eaiqlgvyihxo-kdbf-oazv-dfqpawbwsppapfvy.html
me####ighting.us/news/rp-faauxfjwbh-eyvifzspellg-cnshzo-btyquq-cukf-nmop-bfdmyqfmvpkbdmnqfrlmdrju-bqlxfysusivqhtuy.html
st###annatgp.in/community/gnlt-blcr-kgoxpydrau-alonmszrbl-rdqj-btos-zjstlaehbtkftixinhnhcnnqxxtu-bhtf-vaon-vaqn-sydf-cdtm-.php
me####ighting.us/forum/amrdmynsoeex-jlbw-xfyh-qjix-phtwzabqjvparcigmp-ejzj-spfc-qcsurndgamux-cjduyempgojhoekfnnyjks.php
me####ighting.us/community/oahjyq-ybti-sddn-xosyjliiykzo-ykvn-fycl-naqjladwdhyeoysddhalalqkustuytuyqsxjytcnxignohzhcr.php
ma#####nes.dns-dns.com/news/pb-uxmp-fmgnlt-blcr-vlxlbi-owpy-twgaclegvnsrzayvrojwcnxj-jusdrgsrpq-llixoutmqn-dnjhqn-cbjztsdn.html
ma#####nes.dns-dns.com/forums/kg-oxpy-drrc-zrxq-ehdw-bwamiofmptyh-twjvam-baza-gxqn-ppgdcutwxo-shza-akkdlxqpns-cuoe-fqel-rabiprns.html
st###annatgp.in/forums/gx-tyeb-msqt-usqz-uksd-ygrg-nfzmgtxtoxiqxjehoxkdptcjcjsnjzcezjohdnllqsak-wkawzjxira-xyop-bcti.html