Trojan.DownLoader16.50243

Добавлен в вирусную базу Dr.Web: 2015-09-29

Описание добавлено: 2015-09-29

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Counter Presentation Media Offline iSCSI Socket' = '<SYSTEM32>\guohbykr.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Profile Discovery Access UserMode Filtering] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\dyswyjgcjaqx.exe' "<SYSTEM32>\guohbykr.exe"
'%WINDIR%\Temp\kt8qwiv3mgmv5.exe' -r 30046 tcp
'%TEMP%\kt8qwiv3gucv5f0echl.exe'
'<SYSTEM32>\guohbykr.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\tzshpyyxef\run
<SYSTEM32>\tzshpyyxef\rng
%WINDIR%\Temp\kt8qwiv3mgmv5.exe
<SYSTEM32>\tzshpyyxef\cfg
<SYSTEM32>\dyswyjgcjaqx.exe
%TEMP%\kt8qwiv3gucv5f0echl.exe
<SYSTEM32>\tzshpyyxef\tst
<SYSTEM32>\guohbykr.exe
<SYSTEM32>\tzshpyyxef\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\dyswyjgcjaqx.exe
<SYSTEM32>\guohbykr.exe

Удаляет следующие файлы:

%WINDIR%\Temp\kt8qwiv3mgmv5.exe
<DRIVERS>\etc\hosts
%TEMP%\kt8qwiv3gucv5f0echl.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'th###house.net':80
'si###house.net':80
'wi###eace.net':80
'du###eace.net':80
'th###gift.net':80
'si####uesday.net':80
'th###peace.net':80
'si###gift.net':80
'th####uesday.net':80
'tr###peace.net':80
'wi###ouse.net':80
'tr####uesday.net':80
'mi###eace.net':80
'du###ouse.net':80
'wi###uesday.net':80
'du###uesday.net':80
'wi###ift.net':80
'du###ift.net':80
'qu###gift.net':80
'th###ift.net':80
'qu###house.net':80
'th###ouse.net':80
'qu####uesday.net':80
'th###eace.net':80
'su###yhouse.net':80
'th###uesday.net':80
'qu###peace.net':80
'he###ouse.net':80
'ca###ift.net':80
'si###peace.net':80
'ca###ouse.net':80
'he###ift.net':80
'ca###eace.net':80
'he###eace.net':80
'ca###uesday.net':80
'he###uesday.net':80
'mi###uesday.net':80
'mo###ine.net':80
'su###ylive.net':80
'mo###ello.net':80
'su###ymine.net':80
'mo###ive.net':80
'me###ello.net':80
'si###ello.net':80
'su###yserve.net':80
'mo###erve.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'qu###live.net':80
'th###erve.net':80
'su###yhello.net':80
'th###ive.net':80
'qu###serve.net':80
'da###ive.net':80
'cl###serve.net':80
'da###ine.net':80
'cl###live.net':80
'da###erve.net':80
'mi###ift.net':80
'tr###gift.net':80
'mi###ouse.net':80
'tr###house.net':80
'me###ive.net':80
'si###ive.net':80
'me###ine.net':80
'si###ine.net':80
'me###erve.net':80
'da###ello.net':80
'cl###mine.net':80
'si###erve.net':80
'cl###hello.net':80

TCP:

Запросы HTTP GET:

http://th###house.net/index.php
http://si###house.net/index.php
http://wi###eace.net/index.php
http://du###eace.net/index.php
http://th###gift.net/index.php
http://si####uesday.net/index.php
http://th###peace.net/index.php
http://si###gift.net/index.php
http://th####uesday.net/index.php
http://tr###peace.net/index.php
http://wi###ouse.net/index.php
http://tr####uesday.net/index.php
http://mi###eace.net/index.php
http://du###ouse.net/index.php
http://wi###uesday.net/index.php
http://du###uesday.net/index.php
http://wi###ift.net/index.php
http://du###ift.net/index.php
http://qu###gift.net/index.php
http://th###ift.net/index.php
http://qu###house.net/index.php
http://th###ouse.net/index.php
http://qu####uesday.net/index.php
http://th###eace.net/index.php
http://su###yhouse.net/index.php
http://th###uesday.net/index.php
http://qu###peace.net/index.php
http://he###ouse.net/index.php
http://ca###ift.net/index.php
http://si###peace.net/index.php
http://ca###ouse.net/index.php
http://he###ift.net/index.php
http://ca###eace.net/index.php
http://he###eace.net/index.php
http://ca###uesday.net/index.php
http://he###uesday.net/index.php
http://mi###uesday.net/index.php
http://mo###ine.net/index.php
http://su###ylive.net/index.php
http://mo###ello.net/index.php
http://su###ymine.net/index.php
http://mo###ive.net/index.php
http://me###ello.net/index.php
http://si###ello.net/index.php
http://su###yserve.net/index.php
http://mo###erve.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://qu###live.net/index.php
http://th###erve.net/index.php
http://su###yhello.net/index.php
http://th###ive.net/index.php
http://qu###serve.net/index.php
http://da###ive.net/index.php
http://cl###serve.net/index.php
http://da###ine.net/index.php
http://cl###live.net/index.php
http://da###erve.net/index.php
http://mi###ift.net/index.php
http://tr###gift.net/index.php
http://mi###ouse.net/index.php
http://tr###house.net/index.php
http://me###ive.net/index.php
http://si###ive.net/index.php
http://me###ine.net/index.php
http://si###ine.net/index.php
http://me###erve.net/index.php
http://da###ello.net/index.php
http://cl###mine.net/index.php
http://si###erve.net/index.php
http://cl###hello.net/index.php

UDP:

DNS ASK th###house.net
DNS ASK si###house.net
DNS ASK wi###eace.net
DNS ASK du###eace.net
DNS ASK th###gift.net
DNS ASK si####uesday.net
DNS ASK th###peace.net
DNS ASK si###gift.net
DNS ASK th####uesday.net
DNS ASK tr###peace.net
DNS ASK wi###ouse.net
DNS ASK tr####uesday.net
DNS ASK mi###eace.net
DNS ASK du###ouse.net
DNS ASK wi###uesday.net
DNS ASK du###uesday.net
DNS ASK wi###ift.net
DNS ASK du###ift.net
DNS ASK si###peace.net
DNS ASK th###ift.net
DNS ASK qu####uesday.net
DNS ASK th###ouse.net
DNS ASK qu###gift.net
DNS ASK th###uesday.net
DNS ASK su###yhouse.net
DNS ASK mo###ouse.net
DNS ASK qu###peace.net
DNS ASK th###eace.net
DNS ASK ca###ift.net
DNS ASK he###ift.net
DNS ASK ca###ouse.net
DNS ASK he###ouse.net
DNS ASK ca###uesday.net
DNS ASK he###eace.net
DNS ASK qu###house.net
DNS ASK he###uesday.net
DNS ASK ca###eace.net
DNS ASK mi###uesday.net
DNS ASK mo###ine.net
DNS ASK su###ylive.net
DNS ASK mo###ello.net
DNS ASK su###ymine.net
DNS ASK mo###ive.net
DNS ASK me###ello.net
DNS ASK si###ello.net
DNS ASK su###yserve.net
DNS ASK mo###erve.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK qu###live.net
DNS ASK th###erve.net
DNS ASK su###yhello.net
DNS ASK th###ive.net
DNS ASK qu###serve.net
DNS ASK da###ive.net
DNS ASK cl###serve.net
DNS ASK da###ine.net
DNS ASK cl###live.net
DNS ASK da###erve.net
DNS ASK mi###ift.net
DNS ASK tr###gift.net
DNS ASK mi###ouse.net
DNS ASK tr###house.net
DNS ASK me###ive.net
DNS ASK si###ive.net
DNS ASK me###ine.net
DNS ASK si###ine.net
DNS ASK me###erve.net
DNS ASK da###ello.net
DNS ASK cl###mine.net
DNS ASK si###erve.net
DNS ASK cl###hello.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней