Trojan.DownLoader19.12049

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Locator DNS Time Portable' = '<SYSTEM32>\notrjjbevzr.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\AutoConfig Protocol VC Solutions] 'ImagePath' = '<SYSTEM32>\notrjjbevzr.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\AutoConfig Protocol VC Solutions] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\xlvdfernwv.exe' "<SYSTEM32>\notrjjbevzr.exe"
'%WINDIR%\Temp\hbsvltjf6wwjkya.exe' -r 47370 tcp
'%TEMP%\hbsvltaozi8gkyavobfwo.exe'
'<SYSTEM32>\notrjjbevzr.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\crdldoosl\run
<SYSTEM32>\crdldoosl\rng
%WINDIR%\Temp\hbsvltjf6wwjkya.exe
<SYSTEM32>\crdldoosl\cfg
%TEMP%\hbsvltaozi8gkyavobfwo.exe
<SYSTEM32>\crdldoosl\tst
<SYSTEM32>\xlvdfernwv.exe
<SYSTEM32>\notrjjbevzr.exe

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\xlvdfernwv.exe
<SYSTEM32>\notrjjbevzr.exe

Удаляет следующие файлы:

%WINDIR%\Temp\hbsvltjf6wwjkya.exe
%TEMP%\hbsvltaozi8gkyavobfwo.exe

Сетевая активность:

Подключается к:

'no###ind.net':80
'no###ear.net':80
'ca###urt.net':80
'no###old.net':80
'no###urt.net':80
'ri###ind.net':80
'fa###find.net':80
'ri###old.net':80
'fa###told.net':80
'po###told.net':80
'ca###old.net':80
'ta###hurt.net':80
'le###urt.net':80
'po###find.net':80
'ca###ear.net':80
'po###hurt.net':80
'ca###ind.net':80
'po###wear.net':80
'fi####ovember.net':80
'th###slow.net':80
'fi###help.net':80
'so####ovember.net':80
'li###low.net':80
'th###help.net':80
'li###elp.net':80
'th####ebruary.net':80
'li####bruary.net':80
'ri###urt.net':80
'fa###hurt.net':80
'ri###ear.net':80
'fa###wear.net':80
'so###slow.net':80
'fi####ebruary.net':80
'so###help.net':80
'fi###slow.net':80
'so####ebruary.net':80
'le###ear.net':80
'th###while.net':80
'fi###wear.net':80
'ri###nstorm.net':80
'ef###tbuilt.net':80
'so###hurt.net':80
'li###old.net':80
'th###find.net':80
'fi###hurt.net':80
'th###told.net':80
'de####promise.net':80
'se####strong.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'si######edwerryhouse.net':80
'gw#####ynhuddleston.net':80
'of####urprise.net':80
'mo####gduring.net':80
'ch####nother.net':80
'fe###urt.net':80
'we###urt.net':80
'fe###ear.net':80
'we###ear.net':80
'ta###told.net':80
'le###ind.net':80
'ta###wear.net':80
'le###old.net':80
'ta###find.net':80
'li###ear.net':80
'th###hurt.net':80
'li###ind.net':80
'th###wear.net':80
'li###urt.net':80
'fe###ind.net':80
'we###ind.net':80
'fe###old.net':80
'we###old.net':80

TCP:

Запросы HTTP GET:

http://no###ind.net/index.php
http://no###ear.net/index.php
http://ca###urt.net/index.php
http://no###old.net/index.php
http://no###urt.net/index.php
http://ri###ind.net/index.php
http://fa###find.net/index.php
http://ri###old.net/index.php
http://fa###told.net/index.php
http://po###told.net/index.php
http://ca###old.net/index.php
http://ta###hurt.net/index.php
http://le###urt.net/index.php
http://po###find.net/index.php
http://ca###ear.net/index.php
http://po###hurt.net/index.php
http://ca###ind.net/index.php
http://po###wear.net/index.php
http://fi####ovember.net/index.php
http://th###slow.net/index.php
http://fi###help.net/index.php
http://so####ovember.net/index.php
http://li###low.net/index.php
http://th###help.net/index.php
http://li###elp.net/index.php
http://th####ebruary.net/index.php
http://li####bruary.net/index.php
http://ri###urt.net/index.php
http://fa###hurt.net/index.php
http://ri###ear.net/index.php
http://fa###wear.net/index.php
http://so###slow.net/index.php
http://fi####ebruary.net/index.php
http://so###help.net/index.php
http://fi###slow.net/index.php
http://so####ebruary.net/index.php
http://le###ear.net/index.php
http://th###while.net/index.php
http://fi###wear.net/index.php
http://ri###nstorm.net/index.php
http://ef###tbuilt.net/index.php
http://so###hurt.net/index.php
http://li###old.net/index.php
http://th###find.net/index.php
http://fi###hurt.net/index.php
http://th###told.net/index.php
http://de####promise.net/index.php
http://se####strong.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://si######edwerryhouse.net/index.php
http://gw#####ynhuddleston.net/index.php
http://of####urprise.net/index.php
http://mo####gduring.net/index.php
http://ch####nother.net/index.php
http://fe###urt.net/index.php
http://we###urt.net/index.php
http://fe###ear.net/index.php
http://we###ear.net/index.php
http://ta###told.net/index.php
http://le###ind.net/index.php
http://ta###wear.net/index.php
http://le###old.net/index.php
http://ta###find.net/index.php
http://li###ear.net/index.php
http://th###hurt.net/index.php
http://li###ind.net/index.php
http://th###wear.net/index.php
http://li###urt.net/index.php
http://fe###ind.net/index.php
http://we###ind.net/index.php
http://fe###old.net/index.php
http://we###old.net/index.php

UDP:

DNS ASK no###ind.net
DNS ASK no###ear.net
DNS ASK ca###urt.net
DNS ASK no###old.net
DNS ASK no###urt.net
DNS ASK ri###ind.net
DNS ASK fa###find.net
DNS ASK ri###old.net
DNS ASK fa###told.net
DNS ASK po###told.net
DNS ASK ca###old.net
DNS ASK ta###hurt.net
DNS ASK le###urt.net
DNS ASK po###find.net
DNS ASK ca###ear.net
DNS ASK po###hurt.net
DNS ASK ca###ind.net
DNS ASK po###wear.net
DNS ASK ri###ear.net
DNS ASK th###slow.net
DNS ASK li###low.net
DNS ASK so####ovember.net
DNS ASK fi####ovember.net
DNS ASK th####ebruary.net
DNS ASK li###elp.net
DNS ASK th####ovember.net
DNS ASK li####bruary.net
DNS ASK th###help.net
DNS ASK fa###hurt.net
DNS ASK so###slow.net
DNS ASK fa###wear.net
DNS ASK ri###urt.net
DNS ASK fi###slow.net
DNS ASK so###help.net
DNS ASK fi###help.net
DNS ASK so####ebruary.net
DNS ASK fi####ebruary.net
DNS ASK le###ear.net
DNS ASK th###while.net
DNS ASK fi###wear.net
DNS ASK ri###nstorm.net
DNS ASK ef###tbuilt.net
DNS ASK so###hurt.net
DNS ASK li###old.net
DNS ASK th###find.net
DNS ASK fi###hurt.net
DNS ASK th###told.net
DNS ASK de####promise.net
DNS ASK se####strong.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK si######edwerryhouse.net
DNS ASK gw#####ynhuddleston.net
DNS ASK of####urprise.net
DNS ASK mo####gduring.net
DNS ASK ch####nother.net
DNS ASK fe###urt.net
DNS ASK we###urt.net
DNS ASK fe###ear.net
DNS ASK we###ear.net
DNS ASK ta###told.net
DNS ASK le###ind.net
DNS ASK ta###wear.net
DNS ASK le###old.net
DNS ASK ta###find.net
DNS ASK li###ear.net
DNS ASK th###hurt.net
DNS ASK li###ind.net
DNS ASK th###wear.net
DNS ASK li###urt.net
DNS ASK fe###ind.net
DNS ASK we###ind.net
DNS ASK fe###old.net
DNS ASK we###old.net
'23#.#55.255.250':1900

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней