Trojan.DownLoader17.61648

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Themes Encrypting Collector Player Connectivity' = '<SYSTEM32>\ncqdljv.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Class Block Program Registry Logon Proxy] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\aqtnjwczhgdp.exe' "<SYSTEM32>\ncqdljv.exe"
'%WINDIR%\Temp\tbcetbpe3cjedqat.exe' -r 36027 tcp
'%TEMP%\tbcetbpe37vfdqatdrlqja.exe'
'<SYSTEM32>\ncqdljv.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\msqfmgk\run
<SYSTEM32>\msqfmgk\rng
%WINDIR%\Temp\tbcetbpe3cjedqat.exe
<SYSTEM32>\msqfmgk\cfg
<SYSTEM32>\aqtnjwczhgdp.exe
%TEMP%\tbcetbpe37vfdqatdrlqja.exe
<SYSTEM32>\msqfmgk\tst
<SYSTEM32>\ncqdljv.exe
<SYSTEM32>\msqfmgk\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\aqtnjwczhgdp.exe
<SYSTEM32>\ncqdljv.exe

Удаляет следующие файлы:

%WINDIR%\Temp\tbcetbpe3cjedqat.exe
<DRIVERS>\etc\hosts
%TEMP%\tbcetbpe37vfdqatdrlqja.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'wh###grave.net':80
'sp###sual.net':80
'wh###teach.net':80
'up###rave.net':80
'sa###sual.net':80
'sp###each.net':80
'sa###each.net':80
'sp###ould.net':80
'sa###ould.net':80
'up###each.net':80
'so###teach.net':80
'ar###grave.net':80
'so###could.net':80
'ar###teach.net':80
'so###grave.net':80
'up###ould.net':80
'wh###could.net':80
'up###sual.net':80
'wh###usual.net':80
'eq###could.net':80
'gr###could.net':80
'eq###usual.net':80
'gr###usual.net':80
'eq###teach.net':80
'gr###grave.net':80
'sp###usual.net':80
'gr###teach.net':80
'eq###grave.net':80
'ta###grave.net':80
'gl###sual.net':80
'ta###usual.net':80
'sp###rave.net':80
'sa###rave.net':80
'gl###ould.net':80
'ta###teach.net':80
'gl###rave.net':80
'ta###could.net':80
'gl###each.net':80
'ar###could.net':80
'sp###threw.net':80
'vi###threw.net':80
'eq###floor.net':80
'gr###floor.net':80
'sp###cross.net':80
'vi###shade.net':80
'sp###floor.net':80
'vi###cross.net':80
'sp###shade.net':80
'gr###shade.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'eq###threw.net':80
'gr###cross.net':80
'eq###shade.net':80
'gr###threw.net':80
'eq###cross.net':80
'th###ross.net':80
'dr###shade.net':80
'th###hrew.net':80
'dr###cross.net':80
'th###hade.net':80
'ar###usual.net':80
'so###usual.net':80
'dr###floor.net':80
'th###loor.net':80
'dr###threw.net':80
'fa###hrew.net':80
'wa###cross.net':80
'vi###floor.net':80
'wa###threw.net':80
'fa###ross.net':80
'wa###floor.net':80
'fa###loor.net':80
'wa###shade.net':80
'fa###hade.net':80

TCP:

Запросы HTTP GET:

http://wh###grave.net/index.php
http://sp###sual.net/index.php
http://wh###teach.net/index.php
http://up###rave.net/index.php
http://sa###sual.net/index.php
http://sp###each.net/index.php
http://sa###each.net/index.php
http://sp###ould.net/index.php
http://sa###ould.net/index.php
http://up###each.net/index.php
http://so###teach.net/index.php
http://ar###grave.net/index.php
http://so###could.net/index.php
http://ar###teach.net/index.php
http://so###grave.net/index.php
http://up###ould.net/index.php
http://wh###could.net/index.php
http://up###sual.net/index.php
http://wh###usual.net/index.php
http://eq###could.net/index.php
http://gr###could.net/index.php
http://eq###usual.net/index.php
http://gr###usual.net/index.php
http://eq###teach.net/index.php
http://gr###grave.net/index.php
http://sp###usual.net/index.php
http://gr###teach.net/index.php
http://eq###grave.net/index.php
http://ta###grave.net/index.php
http://gl###sual.net/index.php
http://ta###usual.net/index.php
http://sp###rave.net/index.php
http://sa###rave.net/index.php
http://gl###ould.net/index.php
http://ta###teach.net/index.php
http://gl###rave.net/index.php
http://ta###could.net/index.php
http://gl###each.net/index.php
http://ar###could.net/index.php
http://sp###threw.net/index.php
http://vi###threw.net/index.php
http://eq###floor.net/index.php
http://gr###floor.net/index.php
http://sp###cross.net/index.php
http://vi###shade.net/index.php
http://sp###floor.net/index.php
http://vi###cross.net/index.php
http://sp###shade.net/index.php
http://gr###shade.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://eq###threw.net/index.php
http://gr###cross.net/index.php
http://eq###shade.net/index.php
http://gr###threw.net/index.php
http://eq###cross.net/index.php
http://th###ross.net/index.php
http://dr###shade.net/index.php
http://th###hrew.net/index.php
http://dr###cross.net/index.php
http://th###hade.net/index.php
http://ar###usual.net/index.php
http://so###usual.net/index.php
http://dr###floor.net/index.php
http://th###loor.net/index.php
http://dr###threw.net/index.php
http://fa###hrew.net/index.php
http://wa###cross.net/index.php
http://vi###floor.net/index.php
http://wa###threw.net/index.php
http://fa###ross.net/index.php
http://wa###floor.net/index.php
http://fa###loor.net/index.php
http://wa###shade.net/index.php
http://fa###hade.net/index.php

UDP:

DNS ASK wh###grave.net
DNS ASK sp###sual.net
DNS ASK wh###teach.net
DNS ASK up###rave.net
DNS ASK sa###sual.net
DNS ASK sp###each.net
DNS ASK sa###each.net
DNS ASK sp###ould.net
DNS ASK sa###ould.net
DNS ASK up###each.net
DNS ASK so###teach.net
DNS ASK ar###grave.net
DNS ASK so###could.net
DNS ASK ar###teach.net
DNS ASK so###grave.net
DNS ASK up###ould.net
DNS ASK wh###could.net
DNS ASK up###sual.net
DNS ASK wh###usual.net
DNS ASK sp###rave.net
DNS ASK gr###could.net
DNS ASK eq###teach.net
DNS ASK gr###usual.net
DNS ASK eq###could.net
DNS ASK gr###teach.net
DNS ASK sp###usual.net
DNS ASK vi###usual.net
DNS ASK eq###grave.net
DNS ASK gr###grave.net
DNS ASK eq###usual.net
DNS ASK ta###usual.net
DNS ASK gl###ould.net
DNS ASK sa###rave.net
DNS ASK gl###sual.net
DNS ASK ta###could.net
DNS ASK gl###rave.net
DNS ASK ta###grave.net
DNS ASK gl###each.net
DNS ASK ta###teach.net
DNS ASK ar###could.net
DNS ASK sp###threw.net
DNS ASK vi###threw.net
DNS ASK eq###floor.net
DNS ASK gr###floor.net
DNS ASK sp###cross.net
DNS ASK vi###shade.net
DNS ASK sp###floor.net
DNS ASK vi###cross.net
DNS ASK sp###shade.net
DNS ASK gr###shade.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK eq###threw.net
DNS ASK gr###cross.net
DNS ASK eq###shade.net
DNS ASK gr###threw.net
DNS ASK eq###cross.net
DNS ASK th###ross.net
DNS ASK dr###shade.net
DNS ASK th###hrew.net
DNS ASK dr###cross.net
DNS ASK th###hade.net
DNS ASK ar###usual.net
DNS ASK so###usual.net
DNS ASK dr###floor.net
DNS ASK th###loor.net
DNS ASK dr###threw.net
DNS ASK fa###hrew.net
DNS ASK wa###cross.net
DNS ASK vi###floor.net
DNS ASK wa###threw.net
DNS ASK fa###ross.net
DNS ASK wa###floor.net
DNS ASK fa###loor.net
DNS ASK wa###shade.net
DNS ASK fa###hade.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней