Trojan.DownLoader19.15665

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Performance IP Player IKE Identity iSCSI' = '<SYSTEM32>\metumxzn.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Adapter Config List Procedure Office] 'ImagePath' = '<SYSTEM32>\metumxzn.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Adapter Config List Procedure Office] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\amxqnitn.exe' "<SYSTEM32>\metumxzn.exe"
'%WINDIR%\Temp\whijgc2zq1rop5.exe' -r 29428 tcp
'%TEMP%\whijgc2t9erop5ndd4m26.exe'
'<SYSTEM32>\metumxzn.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\oijmkkuhnigrnh\run
<SYSTEM32>\oijmkkuhnigrnh\rng
%WINDIR%\Temp\whijgc2zq1rop5.exe
<SYSTEM32>\oijmkkuhnigrnh\cfg
<SYSTEM32>\amxqnitn.exe
%TEMP%\whijgc2t9erop5ndd4m26.exe
<SYSTEM32>\oijmkkuhnigrnh\tst
<SYSTEM32>\metumxzn.exe
<SYSTEM32>\oijmkkuhnigrnh\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\amxqnitn.exe
<SYSTEM32>\metumxzn.exe

Удаляет следующие файлы:

%WINDIR%\Temp\whijgc2zq1rop5.exe
<DRIVERS>\etc\hosts
%TEMP%\whijgc2t9erop5ndd4m26.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'fr###ysome.net':80
'pu###even.net':80
'pu###ome.net':80
'sh###such.net':80
'de###uch.net':80
'fr###yseven.net':80
'fr###ysuch.net':80
'al###some.net':80
'pu###uch.net':80
'pu###oday.net':80
'fr###ytoday.net':80
'de###oday.net':80
'ti###oday.net':80
'mo###such.net':80
'mo###today.net':80
'mo###seven.net':80
'ti###even.net':80
'ti###uch.net':80
'de###even.net':80
'sh###today.net':80
'sh###seven.net':80
'sh###some.net':80
'de###ome.net':80
'wh###dare.net':80
'sa###are.net':80
'so###ell.net':80
'so###ody.net':80
'lo###ell.net':80
'wh###dance.net':80
'wh###tell.net':80
'sa###ell.net':80
'sa###ody.net':80
'sa###ance.net':80
'wh###body.net':80
'lo###ody.net':80
'al###today.net':80
'de####ertoday.net':80
'de####erseven.net':80
'de####ersome.net':80
'al###seven.net':80
'al###such.net':80
'lo###ance.net':80
'so###ance.net':80
'so###are.net':80
'de####ersuch.net':80
'lo###are.net':80
'ti###ome.net':80
'lo###even.net':80
'so###even.net':80
'so###ome.net':80
'ri###nstorm.net':80
'lo###ome.net':80
'lo###oday.net':80
'wh###some.net':80
'sa###ome.net':80
'so###uch.net':80
'so###oday.net':80
'lo###uch.net':80
'al###being.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'jo####ymeasure.net':80
'ef###tbuilt.net':80
'th###while.net':80
'mo###ugust.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'mo###olor.net':80
'mi###hown.net':80
'ab###ell.net':80
'li###ome.net':80
'en###seven.net':80
'en###some.net':80
'st###such.net':80
'ba###uch.net':80
'li###even.net':80
'li###uch.net':80
'mo###some.net':80
'en###such.net':80
'en###today.net':80
'li###oday.net':80
'ba###oday.net':80
'sa###oday.net':80
'wh###such.net':80
'wh###today.net':80
'wh###seven.net':80
'sa###even.net':80
'sa###uch.net':80
'ba###even.net':80
'st###today.net':80
'st###seven.net':80
'st###some.net':80
'ba###ome.net':80

TCP:

Запросы HTTP GET:

http://fr###ysome.net/index.php
http://pu###even.net/index.php
http://pu###ome.net/index.php
http://sh###such.net/index.php
http://de###uch.net/index.php
http://fr###yseven.net/index.php
http://fr###ysuch.net/index.php
http://al###some.net/index.php
http://pu###uch.net/index.php
http://pu###oday.net/index.php
http://fr###ytoday.net/index.php
http://de###oday.net/index.php
http://ti###oday.net/index.php
http://mo###such.net/index.php
http://mo###today.net/index.php
http://mo###seven.net/index.php
http://ti###even.net/index.php
http://ti###uch.net/index.php
http://de###even.net/index.php
http://sh###today.net/index.php
http://sh###seven.net/index.php
http://sh###some.net/index.php
http://de###ome.net/index.php
http://wh###dare.net/index.php
http://sa###are.net/index.php
http://so###ell.net/index.php
http://so###ody.net/index.php
http://lo###ell.net/index.php
http://wh###dance.net/index.php
http://wh###tell.net/index.php
http://sa###ell.net/index.php
http://sa###ody.net/index.php
http://sa###ance.net/index.php
http://wh###body.net/index.php
http://lo###ody.net/index.php
http://al###today.net/index.php
http://de####ertoday.net/index.php
http://de####erseven.net/index.php
http://de####ersome.net/index.php
http://al###seven.net/index.php
http://al###such.net/index.php
http://lo###ance.net/index.php
http://so###ance.net/index.php
http://so###are.net/index.php
http://de####ersuch.net/index.php
http://lo###are.net/index.php
http://ti###ome.net/index.php
http://lo###even.net/index.php
http://so###even.net/index.php
http://so###ome.net/index.php
http://ri###nstorm.net/index.php
http://lo###ome.net/index.php
http://lo###oday.net/index.php
http://wh###some.net/index.php
http://sa###ome.net/index.php
http://so###uch.net/index.php
http://so###oday.net/index.php
http://lo###uch.net/index.php
http://al###being.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://jo####ymeasure.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://mo###ugust.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://mo###olor.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://li###ome.net/index.php
http://en###seven.net/index.php
http://en###some.net/index.php
http://st###such.net/index.php
http://ba###uch.net/index.php
http://li###even.net/index.php
http://li###uch.net/index.php
http://mo###some.net/index.php
http://en###such.net/index.php
http://en###today.net/index.php
http://li###oday.net/index.php
http://ba###oday.net/index.php
http://sa###oday.net/index.php
http://wh###such.net/index.php
http://wh###today.net/index.php
http://wh###seven.net/index.php
http://sa###even.net/index.php
http://sa###uch.net/index.php
http://ba###even.net/index.php
http://st###today.net/index.php
http://st###seven.net/index.php
http://st###some.net/index.php
http://ba###ome.net/index.php

UDP:

DNS ASK fr###ysome.net
DNS ASK pu###even.net
DNS ASK pu###ome.net
DNS ASK sh###such.net
DNS ASK de###uch.net
DNS ASK fr###yseven.net
DNS ASK fr###ysuch.net
DNS ASK al###some.net
DNS ASK pu###uch.net
DNS ASK pu###oday.net
DNS ASK fr###ytoday.net
DNS ASK de###oday.net
DNS ASK ti###oday.net
DNS ASK mo###such.net
DNS ASK mo###today.net
DNS ASK mo###seven.net
DNS ASK ti###even.net
DNS ASK ti###uch.net
DNS ASK de###even.net
DNS ASK sh###today.net
DNS ASK sh###seven.net
DNS ASK sh###some.net
DNS ASK de###ome.net
DNS ASK de####ersome.net
DNS ASK sa###are.net
DNS ASK wh###dance.net
DNS ASK wh###dare.net
DNS ASK lo###ell.net
DNS ASK so###ell.net
DNS ASK sa###ance.net
DNS ASK sa###ell.net
DNS ASK st###dare.net
DNS ASK wh###tell.net
DNS ASK wh###body.net
DNS ASK sa###ody.net
DNS ASK so###ody.net
DNS ASK de####ertoday.net
DNS ASK al###such.net
DNS ASK al###today.net
DNS ASK al###seven.net
DNS ASK de####erseven.net
DNS ASK de####ersuch.net
DNS ASK so###ance.net
DNS ASK lo###ody.net
DNS ASK lo###ance.net
DNS ASK lo###are.net
DNS ASK so###are.net
DNS ASK ti###ome.net
DNS ASK lo###even.net
DNS ASK so###even.net
DNS ASK so###ome.net
DNS ASK ri###nstorm.net
DNS ASK lo###ome.net
DNS ASK lo###oday.net
DNS ASK wh###some.net
DNS ASK sa###ome.net
DNS ASK so###uch.net
DNS ASK so###oday.net
DNS ASK lo###uch.net
DNS ASK al###being.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK jo####ymeasure.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK mo###ugust.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK mo###olor.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK li###ome.net
DNS ASK en###seven.net
DNS ASK en###some.net
DNS ASK st###such.net
DNS ASK ba###uch.net
DNS ASK li###even.net
DNS ASK li###uch.net
DNS ASK mo###some.net
DNS ASK en###such.net
DNS ASK en###today.net
DNS ASK li###oday.net
DNS ASK ba###oday.net
DNS ASK sa###oday.net
DNS ASK wh###such.net
DNS ASK wh###today.net
DNS ASK wh###seven.net
DNS ASK sa###even.net
DNS ASK sa###uch.net
DNS ASK ba###even.net
DNS ASK st###today.net
DNS ASK st###seven.net
DNS ASK st###some.net
DNS ASK ba###ome.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней