Trojan.DownLoader17.62963

Добавлен в вирусную базу Dr.Web: 2015-11-29

Описание добавлено: 2015-11-29

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Driver Cache Modules Office ActiveX' = '<SYSTEM32>\ccmstqat.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Offline Portable Class Windows] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\phjuzfwzd.exe' "<SYSTEM32>\ccmstqat.exe"
'%WINDIR%\Temp\zkesdwcs3b8ykqpub.exe' -r 21574 tcp
'%TEMP%\zkesdwcs338rkqpublzwvbq.exe'
'<SYSTEM32>\ccmstqat.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ykpgdrocujeey\run
<SYSTEM32>\ykpgdrocujeey\rng
%WINDIR%\Temp\zkesdwcs3b8ykqpub.exe
<SYSTEM32>\ykpgdrocujeey\cfg
<SYSTEM32>\phjuzfwzd.exe
%TEMP%\zkesdwcs338rkqpublzwvbq.exe
<SYSTEM32>\ykpgdrocujeey\tst
<SYSTEM32>\ccmstqat.exe
<SYSTEM32>\ykpgdrocujeey\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\phjuzfwzd.exe
<SYSTEM32>\ccmstqat.exe

Удаляет следующие файлы:

%WINDIR%\Temp\zkesdwcs3b8ykqpub.exe
<DRIVERS>\etc\hosts
%TEMP%\zkesdwcs338rkqpublzwvbq.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'sp####ousand.net':80
'sa####ousand.net':80
'sp####turday.net':80
'sa####turday.net':80
'sp###ree.net':80
'sa###ree.net':80
'sp###oud.net':80
'sa###oud.net':80
'up####ousand.net':80
'wh####housand.net':80
'up####turday.net':80
'wh####aturday.net':80
'up###ree.net':80
'wh###tree.net':80
'up###oud.net':80
'wh###loud.net':80
'gl####turday.net':80
'gr####housand.net':80
'eq###loud.net':80
'gr####aturday.net':80
'eq####housand.net':80
'gr###tree.net':80
'sp####aturday.net':80
'gr###loud.net':80
'eq###tree.net':80
'ta####housand.net':80
'gl###oud.net':80
'ta####aturday.net':80
'gl####ousand.net':80
'ta###tree.net':80
'eq####aturday.net':80
'ta###loud.net':80
'gl###ree.net':80
'be##lxc.com':80
'wa###read.net':80
'al###being.net':80
'ri###nstorm.net':80
'fa###ile.net':80
'wa###king.net':80
'fa###ead.net':80
'wa###mile.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'ab###ell.net':80
'mo###olor.net':80
'fa###ing.net':80
'ar####housand.net':80
'so####housand.net':80
'ar####aturday.net':80
'so####aturday.net':80
'ar###tree.net':80
'so###tree.net':80
'ar###loud.net':80
'so###loud.net':80
'dr###read.net':80
'th###ead.net':80
'dr###than.net':80
'th###han.net':80
'dr###king.net':80
'th###ing.net':80
'dr###mile.net':80
'th###ile.net':80

TCP:

Запросы HTTP GET:

http://sp####ousand.net/index.php
http://sa####ousand.net/index.php
http://sp####turday.net/index.php
http://sa####turday.net/index.php
http://sp###ree.net/index.php
http://sa###ree.net/index.php
http://sp###oud.net/index.php
http://sa###oud.net/index.php
http://up####ousand.net/index.php
http://wh####housand.net/index.php
http://up####turday.net/index.php
http://wh####aturday.net/index.php
http://up###ree.net/index.php
http://wh###tree.net/index.php
http://up###oud.net/index.php
http://wh###loud.net/index.php
http://gl####turday.net/index.php
http://gr####housand.net/index.php
http://eq###loud.net/index.php
http://gr####aturday.net/index.php
http://eq####housand.net/index.php
http://gr###tree.net/index.php
http://sp####aturday.net/index.php
http://gr###loud.net/index.php
http://eq###tree.net/index.php
http://ta####housand.net/index.php
http://gl###oud.net/index.php
http://ta####aturday.net/index.php
http://gl####ousand.net/index.php
http://ta###tree.net/index.php
http://eq####aturday.net/index.php
http://ta###loud.net/index.php
http://gl###ree.net/index.php
http://be##lxc.com/index.php
http://wa###read.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://fa###ile.net/index.php
http://wa###king.net/index.php
http://fa###ead.net/index.php
http://wa###mile.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://ab###ell.net/index.php
http://mo###olor.net/index.php
http://fa###ing.net/index.php
http://ar####housand.net/index.php
http://so####housand.net/index.php
http://ar####aturday.net/index.php
http://so####aturday.net/index.php
http://ar###tree.net/index.php
http://so###tree.net/index.php
http://ar###loud.net/index.php
http://so###loud.net/index.php
http://dr###read.net/index.php
http://th###ead.net/index.php
http://dr###than.net/index.php
http://th###han.net/index.php
http://dr###king.net/index.php
http://th###ing.net/index.php
http://dr###mile.net/index.php
http://th###ile.net/index.php

UDP:

DNS ASK sa####ousand.net
DNS ASK sp###oud.net
DNS ASK sa####turday.net
DNS ASK sp####ousand.net
DNS ASK sa###ree.net
DNS ASK gl####turday.net
DNS ASK sa###oud.net
DNS ASK sp###ree.net
DNS ASK sp####turday.net
DNS ASK up####ousand.net
DNS ASK wh####housand.net
DNS ASK up####turday.net
DNS ASK wh####aturday.net
DNS ASK up###ree.net
DNS ASK wh###tree.net
DNS ASK up###oud.net
DNS ASK wh###loud.net
DNS ASK eq###loud.net
DNS ASK gr###loud.net
DNS ASK eq####housand.net
DNS ASK gr####housand.net
DNS ASK sp####aturday.net
DNS ASK vi####aturday.net
DNS ASK eq###tree.net
DNS ASK gr###tree.net
DNS ASK gr####aturday.net
DNS ASK ta####housand.net
DNS ASK gl###oud.net
DNS ASK ta####aturday.net
DNS ASK gl####ousand.net
DNS ASK ta###tree.net
DNS ASK eq####aturday.net
DNS ASK ta###loud.net
DNS ASK gl###ree.net
DNS ASK be##lxc.com
DNS ASK wa###read.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK fa###ile.net
DNS ASK wa###king.net
DNS ASK fa###ead.net
DNS ASK wa###mile.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK ab###ell.net
DNS ASK mo###olor.net
DNS ASK fa###ing.net
DNS ASK ar####housand.net
DNS ASK so####housand.net
DNS ASK ar####aturday.net
DNS ASK so####aturday.net
DNS ASK ar###tree.net
DNS ASK so###tree.net
DNS ASK ar###loud.net
DNS ASK so###loud.net
DNS ASK dr###read.net
DNS ASK th###ead.net
DNS ASK dr###than.net
DNS ASK th###han.net
DNS ASK dr###king.net
DNS ASK th###ing.net
DNS ASK dr###mile.net
DNS ASK th###ile.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней