Trojan.DownLoader25.54616

Добавлен в вирусную базу Dr.Web: 2017-11-13

Описание добавлено: 2017-11-13

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Counter Locator Card Identity Diagnostic Panel' = '<SYSTEM32>\dnehdlgdalmu.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Biometric Tools NetBIOS System] 'ImagePath' = '<SYSTEM32>\dnehdlgdalmu.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Biometric Tools NetBIOS System] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\ntstcxuno.exe' "<SYSTEM32>\dnehdlgdalmu.exe"
'%WINDIR%\Temp\x5gw5bae2tp0eegw.exe' -r 26366 tcp
'%TEMP%\x5gw5bae2juueegwih96gt.exe'
'<SYSTEM32>\dnehdlgdalmu.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\oalbnrhae\run
<SYSTEM32>\oalbnrhae\rng
%WINDIR%\Temp\x5gw5bae2tp0eegw.exe
<SYSTEM32>\oalbnrhae\cfg
<SYSTEM32>\ntstcxuno.exe
%TEMP%\x5gw5bae2juueegwih96gt.exe
<SYSTEM32>\oalbnrhae\tst
<SYSTEM32>\dnehdlgdalmu.exe
<SYSTEM32>\oalbnrhae\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\ntstcxuno.exe
<SYSTEM32>\dnehdlgdalmu.exe

Deletes the following files:

%WINDIR%\Temp\x5gw5bae2tp0eegw.exe
<DRIVERS>\etc\hosts
%TEMP%\x5gw5bae2juueegwih96gt.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'wi###ine.net':80
'du###ine.net':80
'mi####portant.net':80
'tr####mportant.net':80
'wi###lse.net':80
'du###lse.net':80
'wi###ice.net':80
'du###ice.net':80
'tr###else.net':80
'da###reak.net':80
'mi###ine.net':80
'da###rove.net':80
'cl###break.net':80
'tr###nice.net':80
'mi###lse.net':80
'tr###fine.net':80
'mi###ice.net':80
'wi####portant.net':80
'ca###ice.net':80
'he###ice.net':80
'ca###ine.net':80
'he###ine.net':80
'ca####portant.net':80
'he####portant.net':80
'ca###lse.net':80
'he###lse.net':80
'si####mportant.net':80
'si###fine.net':80
'th###nice.net':80
'du####portant.net':80
'th###fine.net':80
'si###else.net':80
'th####mportant.net':80
'si###nice.net':80
'th###else.net':80
'cl###prove.net':80
'al###being.net':80
'ri###nstorm.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'su###yslept.net':80
'mo###lept.net':80
'qu###break.net':80
'th###reak.net':80
'mo###olor.net':80
'jo####ymeasure.net':80
'cr#####onaraminta.net':80
'ef###tbuilt.net':80
'th###while.net':80
'mi###hown.net':80
'ab###ell.net':80
'le###form.net':80
'mo###ugust.net':80
'su###yhers.net':80
'me###reak.net':80
'si###reak.net':80
'me###rove.net':80
'si###rove.net':80
'cl###hers.net':80
'da###ers.net':80
'cl###slept.net':80
'da###lept.net':80
'si###ers.net':80
'mo###rove.net':80
'su###ybreak.net':80
'mo###ers.net':80
'su###yprove.net':80
'si###lept.net':80
'me###ers.net':80
'mo###reak.net':80
'me###lept.net':80

TCP:

HTTP GET requests:

http://wi###ine.net/index.php
http://du###ine.net/index.php
http://mi####portant.net/index.php
http://tr####mportant.net/index.php
http://wi###lse.net/index.php
http://du###lse.net/index.php
http://wi###ice.net/index.php
http://du###ice.net/index.php
http://tr###else.net/index.php
http://da###reak.net/index.php
http://mi###ine.net/index.php
http://da###rove.net/index.php
http://cl###break.net/index.php
http://tr###nice.net/index.php
http://mi###lse.net/index.php
http://tr###fine.net/index.php
http://mi###ice.net/index.php
http://wi####portant.net/index.php
http://ca###ice.net/index.php
http://he###ice.net/index.php
http://ca###ine.net/index.php
http://he###ine.net/index.php
http://ca####portant.net/index.php
http://he####portant.net/index.php
http://ca###lse.net/index.php
http://he###lse.net/index.php
http://si####mportant.net/index.php
http://si###fine.net/index.php
http://th###nice.net/index.php
http://du####portant.net/index.php
http://th###fine.net/index.php
http://si###else.net/index.php
http://th####mportant.net/index.php
http://si###nice.net/index.php
http://th###else.net/index.php
http://cl###prove.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://su###yslept.net/index.php
http://mo###lept.net/index.php
http://qu###break.net/index.php
http://th###reak.net/index.php
http://mo###olor.net/index.php
http://jo####ymeasure.net/index.php
http://cr#####onaraminta.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://le###form.net/index.php
http://mo###ugust.net/index.php
http://su###yhers.net/index.php
http://me###reak.net/index.php
http://si###reak.net/index.php
http://me###rove.net/index.php
http://si###rove.net/index.php
http://cl###hers.net/index.php
http://da###ers.net/index.php
http://cl###slept.net/index.php
http://da###lept.net/index.php
http://si###ers.net/index.php
http://mo###rove.net/index.php
http://su###ybreak.net/index.php
http://mo###ers.net/index.php
http://su###yprove.net/index.php
http://si###lept.net/index.php
http://me###ers.net/index.php
http://mo###reak.net/index.php
http://me###lept.net/index.php

UDP:

DNS ASK wi###ine.net
DNS ASK du###ine.net
DNS ASK mi####portant.net
DNS ASK tr####mportant.net
DNS ASK wi###ice.net
DNS ASK du###lse.net
DNS ASK wi####portant.net
DNS ASK du###ice.net
DNS ASK wi###lse.net
DNS ASK da###reak.net
DNS ASK mi###ine.net
DNS ASK da###rove.net
DNS ASK cl###break.net
DNS ASK tr###fine.net
DNS ASK mi###lse.net
DNS ASK tr###else.net
DNS ASK mi###ice.net
DNS ASK tr###nice.net
DNS ASK ca###ice.net
DNS ASK he###ice.net
DNS ASK ca###ine.net
DNS ASK he###ine.net
DNS ASK ca###lse.net
DNS ASK he####portant.net
DNS ASK qu###fine.net
DNS ASK he###lse.net
DNS ASK ca####portant.net
DNS ASK si###fine.net
DNS ASK th###nice.net
DNS ASK du####portant.net
DNS ASK th###fine.net
DNS ASK si###nice.net
DNS ASK th####mportant.net
DNS ASK si####mportant.net
DNS ASK th###else.net
DNS ASK si###else.net
DNS ASK cl###prove.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK su###yslept.net
DNS ASK mo###lept.net
DNS ASK qu###break.net
DNS ASK th###reak.net
DNS ASK mo###olor.net
DNS ASK jo####ymeasure.net
DNS ASK cr#####onaraminta.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK le###form.net
DNS ASK mo###ugust.net
DNS ASK su###yhers.net
DNS ASK me###reak.net
DNS ASK si###reak.net
DNS ASK me###rove.net
DNS ASK si###rove.net
DNS ASK cl###hers.net
DNS ASK da###ers.net
DNS ASK cl###slept.net
DNS ASK da###lept.net
DNS ASK si###ers.net
DNS ASK mo###rove.net
DNS ASK su###ybreak.net
DNS ASK mo###ers.net
DNS ASK su###yprove.net
DNS ASK si###lept.net
DNS ASK me###ers.net
DNS ASK mo###reak.net
DNS ASK me###lept.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней