Trojan.DownLoader22.38436

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Offline Ordering Sharing Group Search CNG' = 'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Identity Connections] 'ImagePath' = 'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Identity Connections] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\qffesdbxzahe\ugs1zyqbze.exe' "c:\qffesdbxzahe\hyoquvz0j0wpj.exe"
'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'
'C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\qffesdbxzahe\hyoquvz0j0wpj.exe
C:\qffesdbxzahe\ugs1zyqbze.exe
C:\qffesdbxzahe\bmjaaazv
%WINDIR%\qffesdbxzahe\kltt78j
C:\qffesdbxzahe\kltt78j
C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe

Присваивает атрибут 'скрытый' для следующих файлов:

C:\qffesdbxzahe\ugs1zyqbze.exe
C:\qffesdbxzahe\hyoquvz0j0wpj.exe

Удаляет следующие файлы:

C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe
%WINDIR%\qffesdbxzahe\kltt78j

Подменяет следующие файлы:

%WINDIR%\qffesdbxzahe\kltt78j

Сетевая активность:

Подключается к:

'ma######asummerfield.net':80
'al######asummerfield.net':80
'al#####rawinchester.net':80
'al######amottershead.net':80
'ma#####nawinchester.net':80
'ce######emottershead.net':80
'am#####newinchester.net':80
'am######emottershead.net':80
'ma#####nachristison.net':80
'al#####rachristison.net':80
'ka#####newinchester.net':80
'al#####erwinchester.net':80
'al######rmottershead.net':80
'ch#####anautenberry.net':80
'ka######emottershead.net':80
'al#####erchristison.net':80
'ma######amottershead.net':80
'ka#####nechristison.net':80
'ka######esummerfield.net':80
'al######rsummerfield.net':80
'ce#####newinchester.net':80
'za######hmottershead.net':80
'ar#####ldwinchester.net':80
'ar######dmottershead.net':80
'ch#####nechristison.net':80
'sh#####lechristison.net':80
'ar#####ldchristison.net':80
'za#####ahchristison.net':80
'za######hsummerfield.net':80
'za#####ahwinchester.net':80
'ar######dsummerfield.net':80
'ce#####nechristison.net':80
'ch######emottershead.net':80
'am#####nechristison.net':80
'am######esummerfield.net':80
'ce######esummerfield.net':80
'ch######esummerfield.net':80
'sh######esummerfield.net':80
'sh#####lewinchester.net':80
'sh######emottershead.net':80
'ch#####newinchester.net':80
'za######hchristianson.net':80
'ar#####ldmichaelson.net':80
'ar######dchristianson.net':80
'ch#####neautenberry.net':80
'sh#####leautenberry.net':80
'ar#####ldautenberry.net':80
'za#####ahautenberry.net':80
'za######hpaternoster.net':80
'za#####ahmichaelson.net':80
'ar######dpaternoster.net':80
'ce#####neautenberry.net':80
'ch######echristianson.net':80
'am#####neautenberry.net':80
'am######epaternoster.net':80
'ce######epaternoster.net':80
'ch######epaternoster.net':80
'sh######epaternoster.net':80
'sh#####lemichaelson.net':80
'sh######echristianson.net':80
'ch#####nemichaelson.net':80
'ge######achristianson.net':80
'gw######echristianson.net':80
'ch######nchristianson.net':80
'gu#####enautenberry.net':80
'gu######npaternoster.net':80
'an#####leautenberry.net':80
'ch######npaternoster.net':80
'gw#####reautenberry.net':80
'gw######epaternoster.net':80
'gw#####remichaelson.net':80
'ch#####anmichaelson.net':80
'ge#####naautenberry.net':80
'ch#####leautenberry.net':80
'ge######apaternoster.net':80
'ge#####namichaelson.net':80
'ch#####lemichaelson.net':80
'gu#####enmichaelson.net':80
'an######epaternoster.net':80
'an#####lemichaelson.net':80
'an######echristianson.net':80
'gu######nchristianson.net':80

TCP:

Запросы HTTP GET:

http://ma######asummerfield.net/index.php
http://al######asummerfield.net/index.php
http://al#####rawinchester.net/index.php
http://al######amottershead.net/index.php
http://ma#####nawinchester.net/index.php
http://ce######emottershead.net/index.php
http://am#####newinchester.net/index.php
http://am######emottershead.net/index.php
http://ma#####nachristison.net/index.php
http://al#####rachristison.net/index.php
http://ka#####newinchester.net/index.php
http://al#####erwinchester.net/index.php
http://al######rmottershead.net/index.php
http://ch#####anautenberry.net/index.php
http://ka######emottershead.net/index.php
http://al#####erchristison.net/index.php
http://ma######amottershead.net/index.php
http://ka#####nechristison.net/index.php
http://ka######esummerfield.net/index.php
http://al######rsummerfield.net/index.php
http://ce#####newinchester.net/index.php
http://za######hmottershead.net/index.php
http://ar#####ldwinchester.net/index.php
http://ar######dmottershead.net/index.php
http://ch#####nechristison.net/index.php
http://sh#####lechristison.net/index.php
http://ar#####ldchristison.net/index.php
http://za#####ahchristison.net/index.php
http://za######hsummerfield.net/index.php
http://za#####ahwinchester.net/index.php
http://ar######dsummerfield.net/index.php
http://ce#####nechristison.net/index.php
http://ch######emottershead.net/index.php
http://am#####nechristison.net/index.php
http://am######esummerfield.net/index.php
http://ce######esummerfield.net/index.php
http://ch######esummerfield.net/index.php
http://sh######esummerfield.net/index.php
http://sh#####lewinchester.net/index.php
http://sh######emottershead.net/index.php
http://ch#####newinchester.net/index.php
http://za######hchristianson.net/index.php
http://ar#####ldmichaelson.net/index.php
http://ar######dchristianson.net/index.php
http://ch#####neautenberry.net/index.php
http://sh#####leautenberry.net/index.php
http://ar#####ldautenberry.net/index.php
http://za#####ahautenberry.net/index.php
http://za######hpaternoster.net/index.php
http://za#####ahmichaelson.net/index.php
http://ar######dpaternoster.net/index.php
http://ce#####neautenberry.net/index.php
http://ch######echristianson.net/index.php
http://am#####neautenberry.net/index.php
http://am######epaternoster.net/index.php
http://ce######epaternoster.net/index.php
http://ch######epaternoster.net/index.php
http://sh######epaternoster.net/index.php
http://sh#####lemichaelson.net/index.php
http://sh######echristianson.net/index.php
http://ch#####nemichaelson.net/index.php
http://ge######achristianson.net/index.php
http://gw######echristianson.net/index.php
http://ch######nchristianson.net/index.php
http://gu#####enautenberry.net/index.php
http://gu######npaternoster.net/index.php
http://an#####leautenberry.net/index.php
http://ch######npaternoster.net/index.php
http://gw#####reautenberry.net/index.php
http://gw######epaternoster.net/index.php
http://gw#####remichaelson.net/index.php
http://ch#####anmichaelson.net/index.php
http://ge#####naautenberry.net/index.php
http://ch#####leautenberry.net/index.php
http://ge######apaternoster.net/index.php
http://ge#####namichaelson.net/index.php
http://ch#####lemichaelson.net/index.php
http://gu#####enmichaelson.net/index.php
http://an######epaternoster.net/index.php
http://an#####lemichaelson.net/index.php
http://an######echristianson.net/index.php
http://gu######nchristianson.net/index.php

UDP:

DNS ASK al######asummerfield.net
DNS ASK ma#####nachristison.net
DNS ASK ma######asummerfield.net
DNS ASK ma#####nawinchester.net
DNS ASK al#####rawinchester.net
DNS ASK am#####newinchester.net
DNS ASK ce#####newinchester.net
DNS ASK ce######emottershead.net
DNS ASK al#####rachristison.net
DNS ASK am######emottershead.net
DNS ASK al#####erwinchester.net
DNS ASK ka######esummerfield.net
DNS ASK ka#####newinchester.net
DNS ASK ka######emottershead.net
DNS ASK al######rmottershead.net
DNS ASK ma######amottershead.net
DNS ASK al######amottershead.net
DNS ASK al#####erchristison.net
DNS ASK al######rsummerfield.net
DNS ASK ka#####nechristison.net
DNS ASK am######esummerfield.net
DNS ASK ar#####ldwinchester.net
DNS ASK za#####ahwinchester.net
DNS ASK za######hmottershead.net
DNS ASK sh#####lechristison.net
DNS ASK ar######dmottershead.net
DNS ASK za#####ahchristison.net
DNS ASK ge######amottershead.net
DNS ASK ar#####ldchristison.net
DNS ASK ar######dsummerfield.net
DNS ASK za######hsummerfield.net
DNS ASK ch######emottershead.net
DNS ASK sh######emottershead.net
DNS ASK ce#####nechristison.net
DNS ASK ce######esummerfield.net
DNS ASK am#####nechristison.net
DNS ASK sh######esummerfield.net
DNS ASK ch#####nechristison.net
DNS ASK ch######esummerfield.net
DNS ASK ch#####newinchester.net
DNS ASK sh#####lewinchester.net
DNS ASK ch#####anautenberry.net
DNS ASK za######hchristianson.net
DNS ASK ar#####ldmichaelson.net
DNS ASK ar######dchristianson.net
DNS ASK ch#####neautenberry.net
DNS ASK sh#####leautenberry.net
DNS ASK ar#####ldautenberry.net
DNS ASK za#####ahautenberry.net
DNS ASK za######hpaternoster.net
DNS ASK za#####ahmichaelson.net
DNS ASK ar######dpaternoster.net
DNS ASK ce#####neautenberry.net
DNS ASK ch######echristianson.net
DNS ASK am#####neautenberry.net
DNS ASK am######epaternoster.net
DNS ASK ce######epaternoster.net
DNS ASK ch######epaternoster.net
DNS ASK sh######epaternoster.net
DNS ASK sh#####lemichaelson.net
DNS ASK sh######echristianson.net
DNS ASK ch#####nemichaelson.net
DNS ASK ge######achristianson.net
DNS ASK gw######echristianson.net
DNS ASK ch######nchristianson.net
DNS ASK gu#####enautenberry.net
DNS ASK gu######npaternoster.net
DNS ASK an#####leautenberry.net
DNS ASK ch######npaternoster.net
DNS ASK gw#####reautenberry.net
DNS ASK gw######epaternoster.net
DNS ASK gw#####remichaelson.net
DNS ASK ch#####anmichaelson.net
DNS ASK ge#####naautenberry.net
DNS ASK ch#####leautenberry.net
DNS ASK ge######apaternoster.net
DNS ASK ge#####namichaelson.net
DNS ASK ch#####lemichaelson.net
DNS ASK gu#####enmichaelson.net
DNS ASK an######epaternoster.net
DNS ASK an#####lemichaelson.net
DNS ASK an######echristianson.net
DNS ASK gu######nchristianson.net

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней