Trojan.Encoder.2619

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\ec525f4.exe
C:\ec525f4\ec525f4.exe

Сетевая активность:

Подключается к:

'sa#####faototamir.com':80
'mo####kechar.com':80
'fo####nnecting.com':80
'vi####anservisi.com':80
'in####llions.com':80
'os####mobilien.com':80
'vd##58.ru':80
'ag####etcorp.com':80
'sl#.it':80
'sp####stache.com':80
'mo####fromspain.com':80
'al######gasurvivalgear.com':80
'be######osting-smart.com':80
'co###hep.com':80
'ts###dal.com':80
'st##ena.ru':80
'st####arbrand.co':80
've#####cipesworld.com':80
'un###uified.com':80
'pa###aina.ru':80
'gu####ekorasyon.com':80
'my####rnalip.com':80
'ip##ddr.es':80
'ni####evolved.com':80
'cu###yip.com':80
'we######ngnursesource.com':80
'th####meindex.com':80
'ho#########cocainestayinyoursystem.org':80
'no#####ltipropiedad.com':80
'mo###ser.com':80
'sw###babes.ru':80
'sh###ingcm.com':80
'bi####tgiveaway.com':80
'be###urs.com':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://vi####anservisi.com/wp-content/themes/perspectivewp/functions/pagebuilder/functions/metaboxes/js/2.php?k=############
http://fo####nnecting.com/wp-content/plugins/easy-contact-forms/js/tinymce/themes/advanced/skins/4.php?u=############
http://sl#.it/wp-content/upgrade/wp-maintenance-mode.tmp/wp-maintenance-mode/assets/images/.X1-unix/de1/4.php?y=############
http://sa#####faototamir.com/wp-content/plugins/simple-tags/assets/js/lib/jquery.autocomplete/4.php?w=############
http://ag####etcorp.com/components/com_phocaguestbook/assets/library/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/2.php?z=############
http://vd##58.ru/phpshop/admpanel/editor3/scripts/moz/icons/russian/5.php?p=############
http://mo####kechar.com/fichiers/apps/files_pdfviewer/vendor/pdfjs/web/locale/my/4.php?y=############
http://ts###dal.com/wp-content/themes/skylab/option-tree/assets/images/layout/2.php?n=############
http://sp####stache.com/wp-content/uploads/gravity_forms/1-7a320e64883203f22a4e76de83776fc3/tmp/2.php?k=############
http://be######osting-smart.com/wp-content/themes/blogolife/functions/be/images/icons/4.php?g=############
http://al######gasurvivalgear.com/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/css/4.php?k=############
http://mo####fromspain.com/wp-content/themes/diva-final/assets/bootstrap-master/docs/examples/starter-template/4.php?a=############
http://co###hep.com/articles/_thumbs/Images/2/3.php?s=############
http://st####arbrand.co/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/5.php?g=############
http://st##ena.ru/wp-content/plugins/fusion-core/admin/page-builder/assets/fonts/fonts/5.php?k=############
http://in####llions.com/wp-content/uploads/js_composer/.X1-unix/03a/2.php?c=############
http://pa###aina.ru/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/4.php?i=############
http://we######ngnursesource.com/wp-content/themes/epic/inc/ReduxFramework/ReduxCore/assets/css/5.php?s=############
http://sh###ingcm.com/wp-content/plugins/contact-form-lite/inc/css/formbuilder/vendor/fonts/3.php?s=############
http://gu####ekorasyon.com/wp-content/themes/rttheme18/js/lightbox/img/graphics/retina/5.php?r=############
http://ni####evolved.com/wp-content/plugins/easyblogging/themes/stripes_orange/assets/icons/theme_icons/5.php?i=############
http://un###uified.com/wp-content/themes/flexform/includes/page-builder/composer/lib/shortcodes/3.php?k=############
http://ve#####cipesworld.com/wp-content/plugins/ultimate-product-catalogue/PHPExcel/Classes/PHPExcel/locale/de/5.php?m=############
http://sw###babes.ru/catalog/view/theme/beamstore/skins/store_default/Watches/js/5.php?m=############
http://mo###ser.com/wp-content/plugins/wordpress-backup-to-dropbox/Dropbox/Dropbox/OAuth/Consumer/5.php?e=############
http://no#####ltipropiedad.com/wp-content/plugins/security-ninja-core-scanner-addon/documentation/assets/blueprint-css/plugins/fancy-type/3.php?x=############
http://os####mobilien.com/wp-content/themes/manchester/blueprint/extensions/options-framework/images/colorpicker/5.php?r=############
http://th####meindex.com/wp-content/themes/ublog/options/ReduxCore/inc/validation/preg_replace/2.php?a=############
http://be###urs.com/it/wp-content/plugins/js_composer/include/templates/params/column_offset/3.php?a=############
http://bi####tgiveaway.com/wp-content/plugins/js_composer/inline/assets/vc/social/tw/3.php?z=############
http://ho#########cocainestayinyoursystem.org/wp-content/plugins/backupbuddy/destinations/sftp/lib/phpseclib/File/3.php?p=############