Trojan.DownLoader11.406

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cuopvkdgksbafvsu-twftvprtnsbcqj-jggxxopppmnm-wizatffrgo-teauiococo-vamv-dify-pipt-narpjk-duor[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\vnvyvlcuopvkdgksnhatnfwbxfprnmiqpzwg-ouofbcbard-ifye-xfnn-pfltmr-pffyukxscnusgx-cbbqkbwpio[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\rdmyns-oeex-jlbwip-dhbq-jlcj-fcdf-srfp-xixs-razn-dmuq-zodhpa-xykq-rpkyyjpibacj-almr-tipl-opybsdxpvp[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kbegnlxjigyhva-xlqp-xvjg-exrt-shjl-ygab-rapa-ehqjvycgxj-dnfv-fcux-qsqr-plvlbqrqqu-lmms-qpkf-nemy-cb[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\kbegnlxjigyhva-xlqp-xvjg-exrt-shjl-ygabrapaehqjvycgxjdn-fvfc-uxqs-qrpl-vlbqrqqulmmsqp-kfnemy-cb[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\xsdknqzajpfc-gtdhkojppmdwuocblz-ezty-zakkzhwkuayt-tsqk-lxjgaloezaruonvqfpouegcbyvwbce-lmdn[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ihzovrdmihzovr-dmqtorbfjlpfqr-mvon-ppop-mxox-zvxq-xtsr-viat-pieb-widgzo-yekg-pixlvifmft-kygkawnq[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ea-mvkortiouu-lmld-abjz-gksu-oeam-teohdigjvqdwlarn-qcxxrztmjzkfprjpyeohgbsycdgncoukbl-cakq-tu[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mxykvqsrzn-yjbq-rihj-nsak-nfezkq-xqmp-ddpv-usbwnhpvrgopfqdnpt-igla-cuys-fqou-fanepfgdvqnhacsyte[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ll-nwam-rdmy-nsoe-exllnecdukez-bhuubhuxcryvptjtrnjzroythtykjlyqjgrtdh-oena-xtzr-barngxgxnd-yb[1].php
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rkow-pvpz-turnndgkfr-nlqt-acuurtqtxv-dmdugt-qncdviwgrd-nnyk-hjrijz-itzm-aufpyb-ppplyjouiivnnoea[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wgrglzlipbuxmpfmpvsinm-dkdn-vldubfcorpbi-biqkyvxsejko-xqjp-wkbwyexvsiqtohphlzqrrczhkkcepl[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\kqcbky-dftm-ysglga-pbpz-nhsi-jhlg-uqsr-bhli-iggs-cayeuopyukkbcb-mrty-jpqcptofpflx-mxkqqj-llhcrgiq[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bh-eyvibfiqfzcjynfctfspbw-rctsdidisnpitipa-oaco-blii-fztfrpmvlmauco-clbwkbjhptdaxtjlwflm-ua[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\spgb-nnrpfaauxf-jwroti-mrsuouzvtiofyvsrlxfrphna-gljwua-pirgfyqrjhfzyxgx-ndrcusofvyks-jgxf-ak[1].html

Сетевая активность:

Подключается к:

'vi#####s.dns-dns.com':80
'fi####imetubefvv.in':80
'ag###poder.us':80

TCP:

Запросы HTTP GET:

fi####imetubefvv.in/blog/vnvyvlcuopvkdgksnhatnfwbxfprnmiqpzwg-ouofbcbard-ifye-xfnn-pfltmr-pffyukxscnusgx-cbbqkbwpio.php
ag###poder.us/blog/cuopvkdgksbafvsu-twftvprtnsbcqj-jggxxopppmnm-wizatffrgo-teauiococo-vamv-dify-pipt-narpjk-duor.php
vi#####s.dns-dns.com/blog/kbegnlxjigyhva-xlqp-xvjg-exrt-shjl-ygab-rapa-ehqjvycgxj-dnfv-fcux-qsqr-plvlbqrqqu-lmms-qpkf-nemy-cb.php
vi#####s.dns-dns.com/main/ihzovrdmihzovr-dmqtorbfjlpfqr-mvon-ppop-mxox-zvxq-xtsr-viat-pieb-widgzo-yekg-pixlvifmft-kygkawnq.html
vi#####s.dns-dns.com/main/xsdknqzajpfc-gtdhkojppmdwuocblz-ezty-zakkzhwkuayt-tsqk-lxjgaloezaruonvqfpouegcbyvwbce-lmdn.html
fi####imetubefvv.in/main/kbegnlxjigyhva-xlqp-xvjg-exrt-shjl-ygabrapaehqjvycgxjdn-fvfc-uxqs-qrpl-vlbqrqqulmmsqp-kfnemy-cb.html
ag###poder.us/main/ea-mvkortiouu-lmld-abjz-gksu-oeam-teohdigjvqdwlarn-qcxxrztmjzkfprjpyeohgbsycdgncoukbl-cakq-tu.html
fi####imetubefvv.in/blog/rdmyns-oeex-jlbwip-dhbq-jlcj-fcdf-srfp-xixs-razn-dmuq-zodhpa-xykq-rpkyyjpibacj-almr-tipl-opybsdxpvp.php
vi#####s.dns-dns.com/blog/ll-nwam-rdmy-nsoe-exllnecdukez-bhuubhuxcryvptjtrnjzroythtykjlyqjgrtdh-oena-xtzr-barngxgxnd-yb.php
fi####imetubefvv.in/blog/mxykvqsrzn-yjbq-rihj-nsak-nfezkq-xqmp-ddpv-usbwnhpvrgopfqdnpt-igla-cuys-fqou-fanepfgdvqnhacsyte.php
ag###poder.us/main/rkow-pvpz-turnndgkfr-nlqt-acuurtqtxv-dmdugt-qncdviwgrd-nnyk-hjrijz-itzm-aufpyb-ppplyjouiivnnoea.html
ag###poder.us/blog/bh-eyvibfiqfzcjynfctfspbw-rctsdidisnpitipa-oaco-blii-fztfrpmvlmauco-clbwkbjhptdaxtjlwflm-ua.php
ag###poder.us/main/kqcbky-dftm-ysglga-pbpz-nhsi-jhlg-uqsr-bhli-iggs-cayeuopyukkbcb-mrty-jpqcptofpflx-mxkqqj-llhcrgiq.html
vi#####s.dns-dns.com/blog/wgrglzlipbuxmpfmpvsinm-dkdn-vldubfcorpbi-biqkyvxsejko-xqjp-wkbwyexvsiqtohphlzqrrczhkkcepl.php
fi####imetubefvv.in/main/spgb-nnrpfaauxf-jwroti-mrsuouzvtiofyvsrlxfrphna-gljwua-pirgfyqrjhfzyxgx-ndrcusofvyks-jgxf-ak.html