Trojan.MulDrop7.19191

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Time NGEN Class Endpoint Plug TPM Server' = 'C:\wiy6duqbimmaf\uuerpocx.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth PNRP Information System] 'ImagePath' = 'C:\wiy6duqbimmaf\uuerpocx.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth PNRP Information System] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\wiy6duqbimmaf\whrklxj.exe' "c:\wiy6duqbimmaf\uuerpocx.exe"
'C:\wiy6duqbimmaf\uuerpocx.exe'
'C:\wiy6duqbimmaf\jec5bcj42spvmyyycowbqwv.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\wiy6duqbimmaf\uuerpocx.exe
C:\wiy6duqbimmaf\whrklxj.exe
C:\wiy6duqbimmaf\gtvpzgv
%WINDIR%\wiy6duqbimmaf\dngnpeamvbz8
C:\wiy6duqbimmaf\dngnpeamvbz8
C:\wiy6duqbimmaf\jec5bcj42spvmyyycowbqwv.exe

Присваивает атрибут 'скрытый' для следующих файлов:

C:\wiy6duqbimmaf\whrklxj.exe
C:\wiy6duqbimmaf\uuerpocx.exe

Удаляет следующие файлы:

C:\wiy6duqbimmaf\jec5bcj42spvmyyycowbqwv.exe
%WINDIR%\wiy6duqbimmaf\dngnpeamvbz8

Подменяет следующие файлы:

%WINDIR%\wiy6duqbimmaf\dngnpeamvbz8

Сетевая активность:

Подключается к:

'ge#####naeccleston.net':80
'ch#####lepickering.net':80
'ge#####napickering.net':80
'ch#####leeccleston.net':80
'ge#####nagrenville.net':80
'ch#####legeorgeson.net':80
'ge#####nageorgeson.net':80
'za#####ahgrenville.net':80
'ar#####ldeccleston.net':80
'za#####ahpickering.net':80
'ar#####ldpickering.net':80
'za#####aheccleston.net':80
'ar#####ldgrenville.net':80
'za#####ahgeorgeson.net':80
'ar#####ldgeorgeson.net':80
'ch#####legrenville.net':80
'gw#####reeccleston.net':80
'ch#####anpickering.net':80
'gw#####repickering.net':80
'ch#####aneccleston.net':80
'gw#####regrenville.net':80
'ch#####angeorgeson.net':80
'gw#####regeorgeson.net':80
'gu#####engrenville.net':80
'an#####leeccleston.net':80
'gu#####enpickering.net':80
'an#####lepickering.net':80
'gu#####eneccleston.net':80
'an#####legrenville.net':80
'gu#####engeorgeson.net':80
'an#####legeorgeson.net':80
'al#####raeccleston.net':80
'ma#####naeccleston.net':80
'al#####rapickering.net':80
'ma#####nageorgeson.net':80
'al#####ragrenville.net':80
'ma#####nagrenville.net':80
'al#####rageorgeson.net':80
'ma#####napickering.net':80
'al#####ereccleston.net':80
'ka#####neeccleston.net':80
'al#####erpickering.net':80
'ka#####negeorgeson.net':80
'al#####ergrenville.net':80
'ka#####negrenville.net':80
'al#####ergeorgeson.net':80
'am#####nepickering.net':80
'sh#####leeccleston.net':80
'ch#####neeccleston.net':80
'sh#####lepickering.net':80
'ch#####negeorgeson.net':80
'sh#####legrenville.net':80
'ch#####negrenville.net':80
'sh#####legeorgeson.net':80
'ch#####nepickering.net':80
'ce#####neeccleston.net':80
'am#####neeccleston.net':80
'ce#####nepickering.net':80
'am#####negeorgeson.net':80
'ce#####negrenville.net':80
'am#####negrenville.net':80
'ce#####negeorgeson.net':80

TCP:

Запросы HTTP GET:

http://ge#####naeccleston.net/index.php
http://ch#####lepickering.net/index.php
http://ge#####napickering.net/index.php
http://ch#####leeccleston.net/index.php
http://ge#####nagrenville.net/index.php
http://ch#####legeorgeson.net/index.php
http://ge#####nageorgeson.net/index.php
http://za#####ahgrenville.net/index.php
http://ar#####ldeccleston.net/index.php
http://za#####ahpickering.net/index.php
http://ar#####ldpickering.net/index.php
http://za#####aheccleston.net/index.php
http://ar#####ldgrenville.net/index.php
http://za#####ahgeorgeson.net/index.php
http://ar#####ldgeorgeson.net/index.php
http://ch#####legrenville.net/index.php
http://gw#####reeccleston.net/index.php
http://ch#####anpickering.net/index.php
http://gw#####repickering.net/index.php
http://ch#####aneccleston.net/index.php
http://gw#####regrenville.net/index.php
http://ch#####angeorgeson.net/index.php
http://gw#####regeorgeson.net/index.php
http://gu#####engrenville.net/index.php
http://an#####leeccleston.net/index.php
http://gu#####enpickering.net/index.php
http://an#####lepickering.net/index.php
http://gu#####eneccleston.net/index.php
http://an#####legrenville.net/index.php
http://gu#####engeorgeson.net/index.php
http://an#####legeorgeson.net/index.php
http://al#####raeccleston.net/index.php
http://ma#####naeccleston.net/index.php
http://al#####rapickering.net/index.php
http://ma#####nageorgeson.net/index.php
http://al#####ragrenville.net/index.php
http://ma#####nagrenville.net/index.php
http://al#####rageorgeson.net/index.php
http://ma#####napickering.net/index.php
http://al#####ereccleston.net/index.php
http://ka#####neeccleston.net/index.php
http://al#####erpickering.net/index.php
http://ka#####negeorgeson.net/index.php
http://al#####ergrenville.net/index.php
http://ka#####negrenville.net/index.php
http://al#####ergeorgeson.net/index.php
http://am#####nepickering.net/index.php
http://sh#####leeccleston.net/index.php
http://ch#####neeccleston.net/index.php
http://sh#####lepickering.net/index.php
http://ch#####negeorgeson.net/index.php
http://sh#####legrenville.net/index.php
http://ch#####negrenville.net/index.php
http://sh#####legeorgeson.net/index.php
http://ch#####nepickering.net/index.php
http://ce#####neeccleston.net/index.php
http://am#####neeccleston.net/index.php
http://ce#####nepickering.net/index.php
http://am#####negeorgeson.net/index.php
http://ce#####negrenville.net/index.php
http://am#####negrenville.net/index.php
http://ce#####negeorgeson.net/index.php

UDP:

DNS ASK ge#####naeccleston.net
DNS ASK ch#####lepickering.net
DNS ASK ge#####napickering.net
DNS ASK ch#####leeccleston.net
DNS ASK ge#####nagrenville.net
DNS ASK ch#####legeorgeson.net
DNS ASK ge#####nageorgeson.net
DNS ASK za#####ahgrenville.net
DNS ASK ar#####ldeccleston.net
DNS ASK za#####ahpickering.net
DNS ASK ar#####ldpickering.net
DNS ASK za#####aheccleston.net
DNS ASK ar#####ldgrenville.net
DNS ASK za#####ahgeorgeson.net
DNS ASK ar#####ldgeorgeson.net
DNS ASK ch#####legrenville.net
DNS ASK gw#####reeccleston.net
DNS ASK ch#####anpickering.net
DNS ASK gw#####repickering.net
DNS ASK ch#####aneccleston.net
DNS ASK gw#####regrenville.net
DNS ASK ch#####angeorgeson.net
DNS ASK gw#####regeorgeson.net
DNS ASK gu#####engrenville.net
DNS ASK an#####leeccleston.net
DNS ASK gu#####enpickering.net
DNS ASK an#####lepickering.net
DNS ASK gu#####eneccleston.net
DNS ASK an#####legrenville.net
DNS ASK gu#####engeorgeson.net
DNS ASK an#####legeorgeson.net
DNS ASK al#####raeccleston.net
DNS ASK ma#####naeccleston.net
DNS ASK al#####rapickering.net
DNS ASK ma#####nageorgeson.net
DNS ASK al#####ragrenville.net
DNS ASK ma#####nagrenville.net
DNS ASK al#####rageorgeson.net
DNS ASK ma#####napickering.net
DNS ASK al#####ereccleston.net
DNS ASK ka#####neeccleston.net
DNS ASK al#####erpickering.net
DNS ASK ka#####negeorgeson.net
DNS ASK al#####ergrenville.net
DNS ASK ka#####negrenville.net
DNS ASK al#####ergeorgeson.net
DNS ASK am#####nepickering.net
DNS ASK sh#####leeccleston.net
DNS ASK ch#####neeccleston.net
DNS ASK sh#####lepickering.net
DNS ASK ch#####negeorgeson.net
DNS ASK sh#####legrenville.net
DNS ASK ch#####negrenville.net
DNS ASK sh#####legeorgeson.net
DNS ASK ch#####nepickering.net
DNS ASK ce#####neeccleston.net
DNS ASK am#####neeccleston.net
DNS ASK ce#####nepickering.net
DNS ASK am#####negeorgeson.net
DNS ASK ce#####negrenville.net
DNS ASK am#####negrenville.net
DNS ASK ce#####negeorgeson.net

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней