Trojan.DownLoader17.37761

Добавлен в вирусную базу Dr.Web: 2015-11-02

Описание добавлено: 2015-11-02

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Helper CardSpace Panel Video System Health' = '<SYSTEM32>\ddbtheiavopw.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Connect Storage CardSpace Counter Connections] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\oxdbmsclp.exe' "<SYSTEM32>\ddbtheiavopw.exe"
'%WINDIR%\Temp\yedaqls3p3ocid.exe' -r 24001 tcp
'%TEMP%\yedaqls3ketcidmtxctk.exe'
'<SYSTEM32>\ddbtheiavopw.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\mzwjpuroy\run
<SYSTEM32>\mzwjpuroy\rng
%WINDIR%\Temp\yedaqls3p3ocid.exe
<SYSTEM32>\mzwjpuroy\cfg
<SYSTEM32>\oxdbmsclp.exe
%TEMP%\yedaqls3ketcidmtxctk.exe
<SYSTEM32>\mzwjpuroy\tst
<SYSTEM32>\ddbtheiavopw.exe
<SYSTEM32>\mzwjpuroy\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\oxdbmsclp.exe
<SYSTEM32>\ddbtheiavopw.exe

Удаляет следующие файлы:

%WINDIR%\Temp\yedaqls3p3ocid.exe
<DRIVERS>\etc\hosts
%TEMP%\yedaqls3ketcidmtxctk.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ma###ate.net':80
'hu###wing.net':80
'ma###uide.net':80
'wr###late.net':80
'ha###ing.net':80
'hu###lady.net':80
'ha###ady.net':80
'hu###past.net':80
'ha###ast.net':80
'de###ate.net':80
'ro###ate.net':80
'de###uide.net':80
'ro###uide.net':80
'wr###half.net':80
'ma###ame.net':80
'wr###guide.net':80
'ma###alf.net':80
'wr###name.net':80
'sp###wing.net':80
'we###ast.net':80
'mu###fish.net':80
'we###ing.net':80
'sp###past.net':80
'we###ish.net':80
'sp###fish.net':80
'we###ady.net':80
'sp###lady.net':80
'ya###ing.net':80
'mu###wing.net':80
'hu###fish.net':80
'ha###ish.net':80
'ya###ast.net':80
'mu###lady.net':80
'ya###ish.net':80
'mu###past.net':80
'ya###ady.net':80
'ro###ame.net':80
'fr###name.net':80
'of###name.net':80
'fr###half.net':80
'of###half.net':80
'fr###guide.net':80
'of###late.net':80
'ha###alf.net':80
'of###guide.net':80
'fr###late.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'sp###name.net':80
'we###ate.net':80
'sp###late.net':80
'we###uide.net':80
'sp###guide.net':80
'jo###uide.net':80
'wi###uide.net':80
'jo###ame.net':80
'wi###ame.net':80
'jo###ate.net':80
'ro###alf.net':80
'de###ame.net':80
'wi###ate.net':80
'de###alf.net':80
'se####bername.net':80
'ha###uide.net':80
'se####berhalf.net':80
'ha###ame.net':80
'se####berguide.net':80
'jo###alf.net':80
'wi###alf.net':80
'ha###ate.net':80
'se####berlate.net':80

TCP:

Запросы HTTP GET:

http://ma###ate.net/index.php
http://hu###wing.net/index.php
http://ma###uide.net/index.php
http://wr###late.net/index.php
http://ha###ing.net/index.php
http://hu###lady.net/index.php
http://ha###ady.net/index.php
http://hu###past.net/index.php
http://ha###ast.net/index.php
http://de###ate.net/index.php
http://ro###ate.net/index.php
http://de###uide.net/index.php
http://ro###uide.net/index.php
http://wr###half.net/index.php
http://ma###ame.net/index.php
http://wr###guide.net/index.php
http://ma###alf.net/index.php
http://wr###name.net/index.php
http://sp###wing.net/index.php
http://we###ast.net/index.php
http://mu###fish.net/index.php
http://we###ing.net/index.php
http://sp###past.net/index.php
http://we###ish.net/index.php
http://sp###fish.net/index.php
http://we###ady.net/index.php
http://sp###lady.net/index.php
http://ya###ing.net/index.php
http://mu###wing.net/index.php
http://hu###fish.net/index.php
http://ha###ish.net/index.php
http://ya###ast.net/index.php
http://mu###lady.net/index.php
http://ya###ish.net/index.php
http://mu###past.net/index.php
http://ya###ady.net/index.php
http://ro###ame.net/index.php
http://fr###name.net/index.php
http://of###name.net/index.php
http://fr###half.net/index.php
http://of###half.net/index.php
http://fr###guide.net/index.php
http://of###late.net/index.php
http://ha###alf.net/index.php
http://of###guide.net/index.php
http://fr###late.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://sp###name.net/index.php
http://we###ate.net/index.php
http://sp###late.net/index.php
http://we###uide.net/index.php
http://sp###guide.net/index.php
http://jo###uide.net/index.php
http://wi###uide.net/index.php
http://jo###ame.net/index.php
http://wi###ame.net/index.php
http://jo###ate.net/index.php
http://ro###alf.net/index.php
http://de###ame.net/index.php
http://wi###ate.net/index.php
http://de###alf.net/index.php
http://se####bername.net/index.php
http://ha###uide.net/index.php
http://se####berhalf.net/index.php
http://ha###ame.net/index.php
http://se####berguide.net/index.php
http://jo###alf.net/index.php
http://wi###alf.net/index.php
http://ha###ate.net/index.php
http://se####berlate.net/index.php

UDP:

DNS ASK ma###ate.net
DNS ASK hu###wing.net
DNS ASK ma###uide.net
DNS ASK wr###late.net
DNS ASK ha###ing.net
DNS ASK hu###lady.net
DNS ASK ha###ady.net
DNS ASK hu###past.net
DNS ASK ha###ast.net
DNS ASK de###ate.net
DNS ASK ro###ate.net
DNS ASK de###uide.net
DNS ASK ro###uide.net
DNS ASK wr###half.net
DNS ASK ma###ame.net
DNS ASK wr###guide.net
DNS ASK ma###alf.net
DNS ASK wr###name.net
DNS ASK hu###fish.net
DNS ASK we###ast.net
DNS ASK sp###past.net
DNS ASK we###ing.net
DNS ASK sp###wing.net
DNS ASK we###ady.net
DNS ASK sp###fish.net
DNS ASK fr###wing.net
DNS ASK sp###lady.net
DNS ASK we###ish.net
DNS ASK mu###wing.net
DNS ASK ya###ast.net
DNS ASK ha###ish.net
DNS ASK ya###ing.net
DNS ASK mu###past.net
DNS ASK ya###ish.net
DNS ASK mu###fish.net
DNS ASK ya###ady.net
DNS ASK mu###lady.net
DNS ASK ro###ame.net
DNS ASK fr###name.net
DNS ASK of###name.net
DNS ASK fr###half.net
DNS ASK of###half.net
DNS ASK fr###guide.net
DNS ASK of###late.net
DNS ASK ha###alf.net
DNS ASK of###guide.net
DNS ASK fr###late.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK sp###name.net
DNS ASK we###ate.net
DNS ASK sp###late.net
DNS ASK we###uide.net
DNS ASK sp###guide.net
DNS ASK jo###uide.net
DNS ASK wi###uide.net
DNS ASK jo###ame.net
DNS ASK wi###ame.net
DNS ASK jo###ate.net
DNS ASK ro###alf.net
DNS ASK de###ame.net
DNS ASK wi###ate.net
DNS ASK de###alf.net
DNS ASK se####bername.net
DNS ASK ha###uide.net
DNS ASK se####berhalf.net
DNS ASK ha###ame.net
DNS ASK se####berguide.net
DNS ASK jo###alf.net
DNS ASK wi###alf.net
DNS ASK ha###ate.net
DNS ASK se####berlate.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней