Trojan.DownLoader21.64485

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Receiver Key Reporting Secure Font' = 'C:\ccwcggcsh\fqnjjgbop.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Biometric Assistant Locator Socket Management] 'ImagePath' = 'C:\ccwcggcsh\fqnjjgbop.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Biometric Assistant Locator Socket Management] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\ccwcggcsh\rzsmsoj.exe' "c:\ccwcggcsh\fqnjjgbop.exe"
'C:\ccwcggcsh\fqnjjgbop.exe'
'C:\ccwcggcsh\efet2ovuuuqpzruk871.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\ccwcggcsh\fqnjjgbop.exe
C:\ccwcggcsh\rzsmsoj.exe
C:\ccwcggcsh\efet2ovuuuqpzruk871.exe
%WINDIR%\ccwcggcsh\hmmjmfytg
C:\ccwcggcsh\hmmjmfytg

Присваивает атрибут 'скрытый' для следующих файлов:

C:\ccwcggcsh\rzsmsoj.exe
C:\ccwcggcsh\fqnjjgbop.exe

Удаляет следующие файлы:

C:\ccwcggcsh\efet2ovuuuqpzruk871.exe
%WINDIR%\ccwcggcsh\hmmjmfytg

Подменяет следующие файлы:

%WINDIR%\ccwcggcsh\hmmjmfytg

Сетевая активность:

Подключается к:

'he####action.net':80
'le####direct.net':80
'le####action.net':80
'le####method.net':80
'he####method.net':80
'ge####method.net':80
'ge####action.net':80
'he####brought.net':80
'he####direct.net':80
'le####brought.net':80
're####ebrought.net':80
'or###method.net':80
're####emethod.net':80
'ne#####rybrought.net':80
'ne####arydirect.net':80
'pl####ntbrought.net':80
're####edirect.net':80
'or####rought.net':80
'or###direct.net':80
'or###action.net':80
're####eaction.net':80
'ge####direct.net':80
'fo####dwrite.net':80
'de####oclock.net':80
'de###ewrite.net':80
'de###eniece.net':80
'fo####dniece.net':80
'an###rniece.net':80
'gl###niece.net':80
'gl###speak.net':80
'fo####doclock.net':80
'an###rspeak.net':80
'fo####dspeak.net':80
'va####saction.net':80
're####action.net':80
're####method.net':80
'ge####brought.net':80
'va####smethod.net':80
're####brought.net':80
'de###espeak.net':80
'va####sbrought.net':80
'va####sdirect.net':80
're####direct.net':80
'pl####ntdirect.net':80
're###nworth.net':80
'de####method.net':80
'va####sworth.net':80
'va####slikely.net':80
're####likely.net':80
'de####direct.net':80
'fo####ddirect.net':80
'fo####daction.net':80
'fo####dmethod.net':80
'de####action.net':80
're####glossary.net':80
'he###likely.net':80
'ge####likely.net':80
'ge####glossary.net':80
'ge###eround.net':80
'he####lossary.net':80
're###nround.net':80
'va####sglossary.net':80
'va####sround.net':80
'he###worth.net':80
'ge###eworth.net':80
'de####brought.net':80
'he###direct.net':80
'di#####ltbrought.net':80
'di####ultdirect.net':80
'di####ultaction.net':80
'he###action.net':80
'pl####ntaction.net':80
'ne####aryaction.net':80
'ne####arymethod.net':80
'he####rought.net':80
'pl####ntmethod.net':80
'he###method.net':80
'an####action.net':80
'gl###action.net':80
'gl###method.net':80
'fo####dbrought.net':80
'an####method.net':80
'gl####rought.net':80
'di####ultmethod.net':80
'an####brought.net':80
'an####direct.net':80
'gl###direct.net':80

TCP:

Запросы HTTP GET:

http://he####action.net/index.php
http://le####direct.net/index.php
http://le####action.net/index.php
http://le####method.net/index.php
http://he####method.net/index.php
http://ge####method.net/index.php
http://ge####action.net/index.php
http://he####brought.net/index.php
http://he####direct.net/index.php
http://le####brought.net/index.php
http://re####ebrought.net/index.php
http://or###method.net/index.php
http://re####emethod.net/index.php
http://ne#####rybrought.net/index.php
http://ne####arydirect.net/index.php
http://pl####ntbrought.net/index.php
http://re####edirect.net/index.php
http://or####rought.net/index.php
http://or###direct.net/index.php
http://or###action.net/index.php
http://re####eaction.net/index.php
http://ge####direct.net/index.php
http://fo####dwrite.net/index.php
http://de####oclock.net/index.php
http://de###ewrite.net/index.php
http://de###eniece.net/index.php
http://fo####dniece.net/index.php
http://an###rniece.net/index.php
http://gl###niece.net/index.php
http://gl###speak.net/index.php
http://fo####doclock.net/index.php
http://an###rspeak.net/index.php
http://fo####dspeak.net/index.php
http://va####saction.net/index.php
http://re####action.net/index.php
http://re####method.net/index.php
http://ge####brought.net/index.php
http://va####smethod.net/index.php
http://re####brought.net/index.php
http://de###espeak.net/index.php
http://va####sbrought.net/index.php
http://va####sdirect.net/index.php
http://re####direct.net/index.php
http://pl####ntdirect.net/index.php
http://re###nworth.net/index.php
http://de####method.net/index.php
http://va####sworth.net/index.php
http://va####slikely.net/index.php
http://re####likely.net/index.php
http://de####direct.net/index.php
http://fo####ddirect.net/index.php
http://fo####daction.net/index.php
http://fo####dmethod.net/index.php
http://de####action.net/index.php
http://re####glossary.net/index.php
http://he###likely.net/index.php
http://ge####likely.net/index.php
http://ge####glossary.net/index.php
http://ge###eround.net/index.php
http://he####lossary.net/index.php
http://re###nround.net/index.php
http://va####sglossary.net/index.php
http://va####sround.net/index.php
http://he###worth.net/index.php
http://ge###eworth.net/index.php
http://de####brought.net/index.php
http://he###direct.net/index.php
http://di#####ltbrought.net/index.php
http://di####ultdirect.net/index.php
http://di####ultaction.net/index.php
http://he###action.net/index.php
http://pl####ntaction.net/index.php
http://ne####aryaction.net/index.php
http://ne####arymethod.net/index.php
http://he####rought.net/index.php
http://pl####ntmethod.net/index.php
http://he###method.net/index.php
http://an####action.net/index.php
http://gl###action.net/index.php
http://gl###method.net/index.php
http://fo####dbrought.net/index.php
http://an####method.net/index.php
http://gl####rought.net/index.php
http://di####ultmethod.net/index.php
http://an####brought.net/index.php
http://an####direct.net/index.php
http://gl###direct.net/index.php

UDP:

DNS ASK he####action.net
DNS ASK le####direct.net
DNS ASK le####action.net
DNS ASK le####method.net
DNS ASK he####method.net
DNS ASK he####direct.net
DNS ASK ge####action.net
DNS ASK ge####direct.net
DNS ASK ge####method.net
DNS ASK le####brought.net
DNS ASK he####brought.net
DNS ASK or###method.net
DNS ASK re####emethod.net
DNS ASK ne#####rybrought.net
DNS ASK ne####arydirect.net
DNS ASK pl####ntbrought.net
DNS ASK or###action.net
DNS ASK or####rought.net
DNS ASK re####ebrought.net
DNS ASK re####edirect.net
DNS ASK re####eaction.net
DNS ASK or###direct.net
DNS ASK fo####dwrite.net
DNS ASK de####oclock.net
DNS ASK de###ewrite.net
DNS ASK de###eniece.net
DNS ASK fo####dniece.net
DNS ASK fo####doclock.net
DNS ASK gl###niece.net
DNS ASK an###rwrite.net
DNS ASK an###rniece.net
DNS ASK an###rspeak.net
DNS ASK gl###speak.net
DNS ASK va####saction.net
DNS ASK re####action.net
DNS ASK re####method.net
DNS ASK ge####brought.net
DNS ASK va####smethod.net
DNS ASK va####sdirect.net
DNS ASK de###espeak.net
DNS ASK fo####dspeak.net
DNS ASK re####brought.net
DNS ASK re####direct.net
DNS ASK va####sbrought.net
DNS ASK re###nworth.net
DNS ASK de####method.net
DNS ASK va####sworth.net
DNS ASK va####slikely.net
DNS ASK re####likely.net
DNS ASK fo####dmethod.net
DNS ASK fo####ddirect.net
DNS ASK de####brought.net
DNS ASK de####direct.net
DNS ASK de####action.net
DNS ASK fo####daction.net
DNS ASK he###likely.net
DNS ASK ge####likely.net
DNS ASK ge####glossary.net
DNS ASK ge###eround.net
DNS ASK he####lossary.net
DNS ASK he###worth.net
DNS ASK va####sglossary.net
DNS ASK re####glossary.net
DNS ASK re###nround.net
DNS ASK ge###eworth.net
DNS ASK va####sround.net
DNS ASK he###direct.net
DNS ASK di#####ltbrought.net
DNS ASK di####ultdirect.net
DNS ASK di####ultaction.net
DNS ASK he###action.net
DNS ASK he####rought.net
DNS ASK ne####aryaction.net
DNS ASK pl####ntdirect.net
DNS ASK pl####ntaction.net
DNS ASK pl####ntmethod.net
DNS ASK ne####arymethod.net
DNS ASK an####action.net
DNS ASK gl###action.net
DNS ASK gl###method.net
DNS ASK fo####dbrought.net
DNS ASK an####method.net
DNS ASK an####direct.net
DNS ASK di####ultmethod.net
DNS ASK he###method.net
DNS ASK gl####rought.net
DNS ASK gl###direct.net
DNS ASK an####brought.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней