Trojan.DownLoader23.44288

Добавлен в вирусную базу Dr.Web: 2017-01-11

Описание добавлено: 2017-01-11

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Server Config Isolation Print BranchCache' = '<SYSTEM32>\altdqxg.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Card Networking Counter Level] 'ImagePath' = '<SYSTEM32>\altdqxg.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Card Networking Counter Level] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\jzepekahrs.exe' "<SYSTEM32>\altdqxg.exe"
'%WINDIR%\Temp\ojfkbn7jl2rrzjy.exe' -r 43677 tcp
'%TEMP%\ojfkbn3hb6elzjyhu3jlyk.exe'
'<SYSTEM32>\altdqxg.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ewzuxojgaeiqnh\run
<SYSTEM32>\ewzuxojgaeiqnh\rng
%WINDIR%\Temp\ojfkbn7jl2rrzjy.exe
<SYSTEM32>\ewzuxojgaeiqnh\cfg
%TEMP%\ojfkbn3hb6elzjyhu3jlyk.exe
<SYSTEM32>\ewzuxojgaeiqnh\tst
<SYSTEM32>\jzepekahrs.exe
<SYSTEM32>\altdqxg.exe

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\jzepekahrs.exe
<SYSTEM32>\altdqxg.exe

Удаляет следующие файлы:

%WINDIR%\Temp\ojfkbn7jl2rrzjy.exe
%TEMP%\ojfkbn3hb6elzjyhu3jlyk.exe

Сетевая активность:

Подключается к:

'ma###hild.net':80
'wr###into.net':80
'ma###bout.net':80
'wr###child.net':80
'ma###nto.net':80
'hu###never.net':80
'ha###ever.net':80
'wr###place.net':80
'ma###lace.net':80
'de###hild.net':80
'ro###hild.net':80
'de###bout.net':80
'ro###bout.net':80
'de###nto.net':80
'ro###lace.net':80
'wr###about.net':80
'ro###nto.net':80
'de###lace.net':80
'mu###start.net':80
'ya###ing.net':80
'mu###nine.net':80
'ya###tart.net':80
'mu###sing.net':80
'we###ine.net':80
'sp###nine.net':80
'we###ever.net':80
'sp###never.net':80
'hu###start.net':80
'ha###tart.net':80
'hu###nine.net':80
'ha###ine.net':80
'hu###sing.net':80
'mu###never.net':80
'ya###ine.net':80
'ha###ing.net':80
'ya###ever.net':80
'wi###lace.net':80
'si######edwerryhouse.net':80
'se####strong.net':80
'ge###eangry.net':80
'gw#####ynhuddleston.net':80
'of####urprise.net':80
'wi###bout.net':80
'ca###tep.net':80
'ch####nother.net':80
'mo####gduring.net':80
'mi####pecial.net':80
'ri###nstorm.net':80
'do####object.net':80
'br###nthird.net':80
'du#####llamartinson.net':80
'de####between.net':80
'al####eighbor.net':80
'ma#####llabotwright.net':80
'si#####tesherisse.net':80
'se####berplace.net':80
'jo###bout.net':80
'se####berinto.net':80
'ha###lace.net':80
'jo###hild.net':80
'wi###nto.net':80
'jo###lace.net':80
'wi###hild.net':80
'jo###nto.net':80
'fr###place.net':80
'of###place.net':80
'fr###into.net':80
'of###into.net':80
'ha###bout.net':80
'se####berchild.net':80
'ha###nto.net':80
'se####berabout.net':80
'ha###hild.net':80

TCP:

Запросы HTTP GET:

http://ma###hild.net/index.php
http://wr###into.net/index.php
http://ma###bout.net/index.php
http://wr###child.net/index.php
http://ma###nto.net/index.php
http://hu###never.net/index.php
http://ha###ever.net/index.php
http://wr###place.net/index.php
http://ma###lace.net/index.php
http://de###hild.net/index.php
http://ro###hild.net/index.php
http://de###bout.net/index.php
http://ro###bout.net/index.php
http://de###nto.net/index.php
http://ro###lace.net/index.php
http://wr###about.net/index.php
http://ro###nto.net/index.php
http://de###lace.net/index.php
http://mu###start.net/index.php
http://ya###ing.net/index.php
http://mu###nine.net/index.php
http://ya###tart.net/index.php
http://mu###sing.net/index.php
http://we###ine.net/index.php
http://sp###nine.net/index.php
http://we###ever.net/index.php
http://sp###never.net/index.php
http://hu###start.net/index.php
http://ha###tart.net/index.php
http://hu###nine.net/index.php
http://ha###ine.net/index.php
http://hu###sing.net/index.php
http://mu###never.net/index.php
http://ya###ine.net/index.php
http://ha###ing.net/index.php
http://ya###ever.net/index.php
http://wi###lace.net/index.php
http://si######edwerryhouse.net/index.php
http://se####strong.net/index.php
http://ge###eangry.net/index.php
http://gw#####ynhuddleston.net/index.php
http://of####urprise.net/index.php
http://wi###bout.net/index.php
http://ca###tep.net/index.php
http://ch####nother.net/index.php
http://mo####gduring.net/index.php
http://mi####pecial.net/index.php
http://ri###nstorm.net/index.php
http://do####object.net/index.php
http://br###nthird.net/index.php
http://du#####llamartinson.net/index.php
http://de####between.net/index.php
http://al####eighbor.net/index.php
http://ma#####llabotwright.net/index.php
http://si#####tesherisse.net/index.php
http://se####berplace.net/index.php
http://jo###bout.net/index.php
http://se####berinto.net/index.php
http://ha###lace.net/index.php
http://jo###hild.net/index.php
http://wi###nto.net/index.php
http://jo###lace.net/index.php
http://wi###hild.net/index.php
http://jo###nto.net/index.php
http://fr###place.net/index.php
http://of###place.net/index.php
http://fr###into.net/index.php
http://of###into.net/index.php
http://ha###bout.net/index.php
http://se####berchild.net/index.php
http://ha###nto.net/index.php
http://se####berabout.net/index.php
http://ha###hild.net/index.php

UDP:

DNS ASK ma###hild.net
DNS ASK wr###into.net
DNS ASK ma###bout.net
DNS ASK wr###child.net
DNS ASK ma###nto.net
DNS ASK hu###never.net
DNS ASK ha###ever.net
DNS ASK wr###place.net
DNS ASK ma###lace.net
DNS ASK de###hild.net
DNS ASK ro###hild.net
DNS ASK de###bout.net
DNS ASK ro###bout.net
DNS ASK de###nto.net
DNS ASK ro###lace.net
DNS ASK wr###about.net
DNS ASK ro###nto.net
DNS ASK de###lace.net
DNS ASK hu###nine.net
DNS ASK ya###ing.net
DNS ASK mu###sing.net
DNS ASK ya###tart.net
DNS ASK mu###start.net
DNS ASK we###ever.net
DNS ASK sp###nine.net
DNS ASK we###tart.net
DNS ASK sp###never.net
DNS ASK we###ine.net
DNS ASK ha###tart.net
DNS ASK hu###sing.net
DNS ASK ha###ine.net
DNS ASK hu###start.net
DNS ASK ha###ing.net
DNS ASK ya###ine.net
DNS ASK mu###nine.net
DNS ASK ya###ever.net
DNS ASK mu###never.net
DNS ASK wi###lace.net
DNS ASK si######edwerryhouse.net
DNS ASK se####strong.net
DNS ASK ge###eangry.net
DNS ASK gw#####ynhuddleston.net
DNS ASK of####urprise.net
DNS ASK wi###bout.net
DNS ASK ca###tep.net
DNS ASK ch####nother.net
DNS ASK mo####gduring.net
DNS ASK mi####pecial.net
DNS ASK ri###nstorm.net
DNS ASK do####object.net
DNS ASK br###nthird.net
DNS ASK du#####llamartinson.net
DNS ASK de####between.net
DNS ASK al####eighbor.net
DNS ASK ma#####llabotwright.net
DNS ASK si#####tesherisse.net
DNS ASK se####berplace.net
DNS ASK jo###bout.net
DNS ASK se####berinto.net
DNS ASK ha###lace.net
DNS ASK jo###hild.net
DNS ASK wi###nto.net
DNS ASK jo###lace.net
DNS ASK wi###hild.net
DNS ASK jo###nto.net
DNS ASK fr###place.net
DNS ASK of###place.net
DNS ASK fr###into.net
DNS ASK of###into.net
DNS ASK ha###bout.net
DNS ASK se####berchild.net
DNS ASK ha###nto.net
DNS ASK se####berabout.net
DNS ASK ha###hild.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней