Trojan.DownLoader25.13390

Добавлен в вирусную базу Dr.Web: 2017-07-27

Описание добавлено: 2017-07-27

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Base Modules Grouping Experience Now' = '<SYSTEM32>\fztuumwqhb.exe'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\ywkfohymshw.exe' "<SYSTEM32>\fztuumwqhb.exe"
'%TEMP%\qi2mjdx35xkiqxsg.exe' -r 29482 tcp
'%TEMP%\qi2mjdx3164iqxsgqlr9gs.exe'
'<SYSTEM32>\fztuumwqhb.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\mnabztosskdy\run
<SYSTEM32>\mnabztosskdy\rng
%TEMP%\qi2mjdx35xkiqxsg.exe
<SYSTEM32>\mnabztosskdy\cfg
<SYSTEM32>\ywkfohymshw.exe
%TEMP%\qi2mjdx3164iqxsgqlr9gs.exe
<SYSTEM32>\mnabztosskdy\tst
<SYSTEM32>\fztuumwqhb.exe
<SYSTEM32>\mnabztosskdy\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\ywkfohymshw.exe
<SYSTEM32>\fztuumwqhb.exe

Удаляет следующие файлы:

%TEMP%\qi2mjdx35xkiqxsg.exe
<DRIVERS>\etc\hosts
%TEMP%\qi2mjdx3164iqxsgqlr9gs.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'gl###edge.net':80
'ta###wedge.net':80
'gl####sterday.net':80
'ta####esterday.net':80
'eq###feet.net':80
'gr###each.net':80
'eq####esterday.net':80
'gr###feet.net':80
'eq###each.net':80
'ta###each.net':80
'sp####sterday.net':80
'sa####sterday.net':80
'sp###ach.net':80
'sa###ach.net':80
'sp###edge.net':80
'ta###feet.net':80
'gl###ach.net':80
'sa###edge.net':80
'gl###eet.net':80
'fa###eet.net':80
'wa###each.net':80
'vi###wedge.net':80
'wa###feet.net':80
'fa###ach.net':80
'wa###wedge.net':80
'fa###edge.net':80
'wa####esterday.net':80
'fa####sterday.net':80
'sp###wedge.net':80
'gr###wedge.net':80
'sp###feet.net':80
'gr####esterday.net':80
'eq###wedge.net':80
'vi###feet.net':80
'sp####esterday.net':80
'vi####esterday.net':80
'sp###each.net':80
'vi###each.net':80
'sa###eet.net':80
'fa###new.net':80
'dr###fifth.net':80
'be##lxc.com':80
'wa###knew.net':80
'th###ifth.net':80
'dr###done.net':80
'th###one.net':80
'dr###shine.net':80
'th###hine.net':80
'ri###nstorm.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'ab###ell.net':80
'ca####nbring.net':80
'al###being.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'up###ach.net':80
'wh###each.net':80
'up###eet.net':80
'wh###feet.net':80
'up####sterday.net':80
'wh###wedge.net':80
'sp###eet.net':80
'wh####esterday.net':80
'up###edge.net':80
'so###wedge.net':80
'ar###feet.net':80
'so###feet.net':80
'dr###knew.net':80
'th###new.net':80
'ar###each.net':80
'so####esterday.net':80
'ar###wedge.net':80
'so###each.net':80
'ar####esterday.net':80

TCP:

Запросы HTTP GET:

http://gl###edge.net/index.php
http://ta###wedge.net/index.php
http://gl####sterday.net/index.php
http://ta####esterday.net/index.php
http://eq###feet.net/index.php
http://gr###each.net/index.php
http://eq####esterday.net/index.php
http://gr###feet.net/index.php
http://eq###each.net/index.php
http://ta###each.net/index.php
http://sp####sterday.net/index.php
http://sa####sterday.net/index.php
http://sp###ach.net/index.php
http://sa###ach.net/index.php
http://sp###edge.net/index.php
http://ta###feet.net/index.php
http://gl###ach.net/index.php
http://sa###edge.net/index.php
http://gl###eet.net/index.php
http://fa###eet.net/index.php
http://wa###each.net/index.php
http://vi###wedge.net/index.php
http://wa###feet.net/index.php
http://fa###ach.net/index.php
http://wa###wedge.net/index.php
http://fa###edge.net/index.php
http://wa####esterday.net/index.php
http://fa####sterday.net/index.php
http://sp###wedge.net/index.php
http://gr###wedge.net/index.php
http://sp###feet.net/index.php
http://gr####esterday.net/index.php
http://eq###wedge.net/index.php
http://vi###feet.net/index.php
http://sp####esterday.net/index.php
http://vi####esterday.net/index.php
http://sp###each.net/index.php
http://vi###each.net/index.php
http://sa###eet.net/index.php
http://fa###new.net/index.php
http://dr###fifth.net/index.php
http://be##lxc.com/index.php
http://wa###knew.net/index.php
http://th###ifth.net/index.php
http://dr###done.net/index.php
http://th###one.net/index.php
http://dr###shine.net/index.php
http://th###hine.net/index.php
http://ri###nstorm.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://ca####nbring.net/index.php
http://al###being.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://up###ach.net/index.php
http://wh###each.net/index.php
http://up###eet.net/index.php
http://wh###feet.net/index.php
http://up####sterday.net/index.php
http://wh###wedge.net/index.php
http://sp###eet.net/index.php
http://wh####esterday.net/index.php
http://up###edge.net/index.php
http://so###wedge.net/index.php
http://ar###feet.net/index.php
http://so###feet.net/index.php
http://dr###knew.net/index.php
http://th###new.net/index.php
http://ar###each.net/index.php
http://so####esterday.net/index.php
http://ar###wedge.net/index.php
http://so###each.net/index.php
http://ar####esterday.net/index.php

UDP:

DNS ASK gl###edge.net
DNS ASK ta###wedge.net
DNS ASK gl####sterday.net
DNS ASK ta####esterday.net
DNS ASK eq###feet.net
DNS ASK gr###each.net
DNS ASK eq####esterday.net
DNS ASK gr###feet.net
DNS ASK eq###each.net
DNS ASK ta###each.net
DNS ASK sp####sterday.net
DNS ASK sa####sterday.net
DNS ASK sp###ach.net
DNS ASK sa###ach.net
DNS ASK sp###edge.net
DNS ASK ta###feet.net
DNS ASK gl###ach.net
DNS ASK sa###edge.net
DNS ASK gl###eet.net
DNS ASK gr####esterday.net
DNS ASK wa###each.net
DNS ASK fa###ach.net
DNS ASK wa###feet.net
DNS ASK fa###eet.net
DNS ASK wa####esterday.net
DNS ASK fa###edge.net
DNS ASK dr###feet.net
DNS ASK fa####sterday.net
DNS ASK wa###wedge.net
DNS ASK vi###wedge.net
DNS ASK sp###feet.net
DNS ASK vi###feet.net
DNS ASK eq###wedge.net
DNS ASK gr###wedge.net
DNS ASK sp###each.net
DNS ASK vi####esterday.net
DNS ASK sp###wedge.net
DNS ASK vi###each.net
DNS ASK sp####esterday.net
DNS ASK sa###eet.net
DNS ASK fa###new.net
DNS ASK dr###fifth.net
DNS ASK be##lxc.com
DNS ASK wa###knew.net
DNS ASK th###ifth.net
DNS ASK dr###done.net
DNS ASK th###one.net
DNS ASK dr###shine.net
DNS ASK th###hine.net
DNS ASK ri###nstorm.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK ca####nbring.net
DNS ASK al###being.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK up###ach.net
DNS ASK wh###each.net
DNS ASK up###eet.net
DNS ASK wh###feet.net
DNS ASK up####sterday.net
DNS ASK wh###wedge.net
DNS ASK sp###eet.net
DNS ASK wh####esterday.net
DNS ASK up###edge.net
DNS ASK so###wedge.net
DNS ASK ar###feet.net
DNS ASK so###feet.net
DNS ASK dr###knew.net
DNS ASK th###new.net
DNS ASK ar###each.net
DNS ASK so####esterday.net
DNS ASK ar###wedge.net
DNS ASK so###each.net
DNS ASK ar####esterday.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней