Trojan.DownLoader18.14802

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Health Solutions UserMode Tablet Drive Client' = '<SYSTEM32>\onjoujpv.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Telephony Browser Peer Logon Services] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\lyewptnwgbjh.exe' "<SYSTEM32>\onjoujpv.exe"
'%WINDIR%\Temp\hshuc42s2vjrdx.exe' -r 33117 tcp
'%TEMP%\hshuc42npbjrdxwhipwdg.exe'
'<SYSTEM32>\onjoujpv.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\srxuuktjh\run
<SYSTEM32>\srxuuktjh\rng
%WINDIR%\Temp\hshuc42s2vjrdx.exe
<SYSTEM32>\srxuuktjh\cfg
<SYSTEM32>\lyewptnwgbjh.exe
%TEMP%\hshuc42npbjrdxwhipwdg.exe
<SYSTEM32>\srxuuktjh\tst
<SYSTEM32>\onjoujpv.exe
<SYSTEM32>\srxuuktjh\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\lyewptnwgbjh.exe
<SYSTEM32>\onjoujpv.exe

Удаляет следующие файлы:

%WINDIR%\Temp\hshuc42s2vjrdx.exe
<DRIVERS>\etc\hosts
%TEMP%\hshuc42npbjrdxwhipwdg.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ta###never.net':80
'gl###ine.net':80
'sa###ing.net':80
'gl###ever.net':80
'ta###nine.net':80
'gl###ing.net':80
'ta###sing.net':80
'gl###tart.net':80
'ta###start.net':80
'sp###ing.net':80
'wh###sing.net':80
'sp###ever.net':80
'wh###start.net':80
'up###ing.net':80
'sa###ever.net':80
'sp###tart.net':80
'sa###tart.net':80
'sp###ine.net':80
'sa###ine.net':80
'eq###never.net':80
'vi###start.net':80
'sp###sing.net':80
'vi###nine.net':80
'sp###start.net':80
'vi###sing.net':80
'wa###nine.net':80
'fa###ine.net':80
'wa###never.net':80
'fa###ever.net':80
'sp###nine.net':80
'gr###nine.net':80
'eq###start.net':80
'gr###never.net':80
'eq###nine.net':80
'gr###start.net':80
'sp###never.net':80
'vi###never.net':80
'eq###sing.net':80
'gr###sing.net':80
'up###tart.net':80
'fa###bout.net':80
'wa###child.net':80
'vi###place.net':80
'wa###about.net':80
'fa###hild.net':80
'wa###place.net':80
'fa###lace.net':80
'wa###into.net':80
'fa###nto.net':80
'sp###place.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'vi###about.net':80
'sp###into.net':80
'vi###into.net':80
'sp###child.net':80
'vi###child.net':80
'dr###about.net':80
'so###start.net':80
'ar###sing.net':80
'so###nine.net':80
'ar###start.net':80
'so###sing.net':80
'up###ine.net':80
'wh###nine.net':80
'up###ever.net':80
'wh###never.net':80
'ar###nine.net':80
'th###hild.net':80
'dr###into.net':80
'th###bout.net':80
'dr###child.net':80
'th###nto.net':80
'ar###never.net':80
'so###never.net':80
'dr###place.net':80
'th###lace.net':80

TCP:

Запросы HTTP GET:

http://ta###never.net/index.php
http://gl###ine.net/index.php
http://sa###ing.net/index.php
http://gl###ever.net/index.php
http://ta###nine.net/index.php
http://gl###ing.net/index.php
http://ta###sing.net/index.php
http://gl###tart.net/index.php
http://ta###start.net/index.php
http://sp###ing.net/index.php
http://wh###sing.net/index.php
http://sp###ever.net/index.php
http://wh###start.net/index.php
http://up###ing.net/index.php
http://sa###ever.net/index.php
http://sp###tart.net/index.php
http://sa###tart.net/index.php
http://sp###ine.net/index.php
http://sa###ine.net/index.php
http://eq###never.net/index.php
http://vi###start.net/index.php
http://sp###sing.net/index.php
http://vi###nine.net/index.php
http://sp###start.net/index.php
http://vi###sing.net/index.php
http://wa###nine.net/index.php
http://fa###ine.net/index.php
http://wa###never.net/index.php
http://fa###ever.net/index.php
http://sp###nine.net/index.php
http://gr###nine.net/index.php
http://eq###start.net/index.php
http://gr###never.net/index.php
http://eq###nine.net/index.php
http://gr###start.net/index.php
http://sp###never.net/index.php
http://vi###never.net/index.php
http://eq###sing.net/index.php
http://gr###sing.net/index.php
http://up###tart.net/index.php
http://fa###bout.net/index.php
http://wa###child.net/index.php
http://vi###place.net/index.php
http://wa###about.net/index.php
http://fa###hild.net/index.php
http://wa###place.net/index.php
http://fa###lace.net/index.php
http://wa###into.net/index.php
http://fa###nto.net/index.php
http://sp###place.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://vi###about.net/index.php
http://sp###into.net/index.php
http://vi###into.net/index.php
http://sp###child.net/index.php
http://vi###child.net/index.php
http://dr###about.net/index.php
http://so###start.net/index.php
http://ar###sing.net/index.php
http://so###nine.net/index.php
http://ar###start.net/index.php
http://so###sing.net/index.php
http://up###ine.net/index.php
http://wh###nine.net/index.php
http://up###ever.net/index.php
http://wh###never.net/index.php
http://ar###nine.net/index.php
http://th###hild.net/index.php
http://dr###into.net/index.php
http://th###bout.net/index.php
http://dr###child.net/index.php
http://th###nto.net/index.php
http://ar###never.net/index.php
http://so###never.net/index.php
http://dr###place.net/index.php
http://th###lace.net/index.php

UDP:

DNS ASK gl###ine.net
DNS ASK ta###nine.net
DNS ASK ta###never.net
DNS ASK sa###ing.net
DNS ASK gl###ever.net
DNS ASK ta###sing.net
DNS ASK eq###never.net
DNS ASK gl###ing.net
DNS ASK gl###tart.net
DNS ASK ta###start.net
DNS ASK sp###ever.net
DNS ASK sa###ever.net
DNS ASK wh###sing.net
DNS ASK wh###start.net
DNS ASK up###ing.net
DNS ASK sa###tart.net
DNS ASK sp###ing.net
DNS ASK sp###tart.net
DNS ASK sp###ine.net
DNS ASK sa###ine.net
DNS ASK sp###sing.net
DNS ASK vi###sing.net
DNS ASK vi###start.net
DNS ASK vi###nine.net
DNS ASK sp###start.net
DNS ASK fa###ine.net
DNS ASK wa###start.net
DNS ASK wa###nine.net
DNS ASK wa###never.net
DNS ASK fa###ever.net
DNS ASK eq###start.net
DNS ASK gr###start.net
DNS ASK gr###nine.net
DNS ASK gr###never.net
DNS ASK eq###nine.net
DNS ASK vi###never.net
DNS ASK sp###nine.net
DNS ASK sp###never.net
DNS ASK eq###sing.net
DNS ASK gr###sing.net
DNS ASK up###tart.net
DNS ASK fa###bout.net
DNS ASK wa###child.net
DNS ASK vi###place.net
DNS ASK wa###about.net
DNS ASK fa###hild.net
DNS ASK wa###place.net
DNS ASK fa###lace.net
DNS ASK wa###into.net
DNS ASK fa###nto.net
DNS ASK sp###place.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK vi###about.net
DNS ASK sp###into.net
DNS ASK vi###into.net
DNS ASK sp###child.net
DNS ASK vi###child.net
DNS ASK dr###about.net
DNS ASK so###start.net
DNS ASK ar###sing.net
DNS ASK so###nine.net
DNS ASK ar###start.net
DNS ASK so###sing.net
DNS ASK up###ine.net
DNS ASK wh###nine.net
DNS ASK up###ever.net
DNS ASK wh###never.net
DNS ASK ar###nine.net
DNS ASK th###hild.net
DNS ASK dr###into.net
DNS ASK th###bout.net
DNS ASK dr###child.net
DNS ASK th###nto.net
DNS ASK ar###never.net
DNS ASK so###never.net
DNS ASK dr###place.net
DNS ASK th###lace.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней