Trojan.DownLoader24.7428

Добавлен в вирусную базу Dr.Web: 2017-03-17

Описание добавлено: 2017-03-17

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Layer Link Manager Ordering Secondary Time' = '<SYSTEM32>\ngwreei.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Call Storage Identity Reports Protocol] 'ImagePath' = '<SYSTEM32>\ngwreei.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Call Storage Identity Reports Protocol] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\ezepjxhq.exe' "<SYSTEM32>\ngwreei.exe"
'%WINDIR%\Temp\f4etgyl35leztrp.exe' -r 27082 tcp
'%TEMP%\f4etgyl30xvztrpaxj9gm.exe'
'<SYSTEM32>\ngwreei.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\foiimayep\run
<SYSTEM32>\foiimayep\rng
%WINDIR%\Temp\f4etgyl35leztrp.exe
<SYSTEM32>\foiimayep\cfg
<SYSTEM32>\ezepjxhq.exe
%TEMP%\f4etgyl30xvztrpaxj9gm.exe
<SYSTEM32>\foiimayep\tst
<SYSTEM32>\ngwreei.exe
<SYSTEM32>\foiimayep\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\ezepjxhq.exe
<SYSTEM32>\ngwreei.exe

Удаляет следующие файлы:

%WINDIR%\Temp\f4etgyl35leztrp.exe
<DRIVERS>\etc\hosts
%TEMP%\f4etgyl30xvztrpaxj9gm.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'pl###pull.net':80
'fi###ull.net':80
'pl###noise.net':80
'fi###oise.net':80
'se###fruit.net':80
'le###rise.net':80
'se###noise.net':80
'le###fruit.net':80
'se###rise.net':80
'fi###ise.net':80
'lr###noise.net':80
'vi###oise.net':80
'lr###rise.net':80
'vi###ise.net':80
'lr###pull.net':80
'fi###ruit.net':80
'pl###rise.net':80
'vi###ull.net':80
'pl###fruit.net':80
've###ruit.net':80
'we###ise.net':80
'fa###ull.net':80
'we###ruit.net':80
've###ise.net':80
'we###ull.net':80
've###ull.net':80
'we###oise.net':80
've###oise.net':80
'to###ull.net':80
'le###pull.net':80
'to###ruit.net':80
'le###noise.net':80
'se###pull.net':80
'fa###ruit.net':80
'to###oise.net':80
'fa###oise.net':80
'to###ise.net':80
'fa###ise.net':80
'vi###ruit.net':80
'no###ire.net':80
'li###ire.net':80
'be##lxc.com':80
'li###one.net':80
'we###old.net':80
'no###rote.net':80
'we###one.net':80
'no###old.net':80
'we###rote.net':80
'ri###nstorm.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'ab###ell.net':80
'ca####nbring.net':80
'al###being.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'tr###rise.net':80
'yo###ise.net':80
'tr###fruit.net':80
'yo###ruit.net':80
'tr###noise.net':80
'yo###ull.net':80
'lr###fruit.net':80
'yo###oise.net':80
'tr###pull.net':80
'fa###fire.net':80
'ri###old.net':80
'fa###cold.net':80
'no###one.net':80
'we###ire.net':80
'ri###rote.net':80
'fa###bone.net':80
'ri###ire.net':80
'fa###wrote.net':80
'ri###one.net':80

TCP:

Запросы HTTP GET:

http://pl###pull.net/index.php
http://fi###ull.net/index.php
http://pl###noise.net/index.php
http://fi###oise.net/index.php
http://se###fruit.net/index.php
http://le###rise.net/index.php
http://se###noise.net/index.php
http://le###fruit.net/index.php
http://se###rise.net/index.php
http://fi###ise.net/index.php
http://lr###noise.net/index.php
http://vi###oise.net/index.php
http://lr###rise.net/index.php
http://vi###ise.net/index.php
http://lr###pull.net/index.php
http://fi###ruit.net/index.php
http://pl###rise.net/index.php
http://vi###ull.net/index.php
http://pl###fruit.net/index.php
http://ve###ruit.net/index.php
http://we###ise.net/index.php
http://fa###ull.net/index.php
http://we###ruit.net/index.php
http://ve###ise.net/index.php
http://we###ull.net/index.php
http://ve###ull.net/index.php
http://we###oise.net/index.php
http://ve###oise.net/index.php
http://to###ull.net/index.php
http://le###pull.net/index.php
http://to###ruit.net/index.php
http://le###noise.net/index.php
http://se###pull.net/index.php
http://fa###ruit.net/index.php
http://to###oise.net/index.php
http://fa###oise.net/index.php
http://to###ise.net/index.php
http://fa###ise.net/index.php
http://vi###ruit.net/index.php
http://no###ire.net/index.php
http://li###ire.net/index.php
http://be##lxc.com/index.php
http://li###one.net/index.php
http://we###old.net/index.php
http://no###rote.net/index.php
http://we###one.net/index.php
http://no###old.net/index.php
http://we###rote.net/index.php
http://ri###nstorm.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://ca####nbring.net/index.php
http://al###being.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://tr###rise.net/index.php
http://yo###ise.net/index.php
http://tr###fruit.net/index.php
http://yo###ruit.net/index.php
http://tr###noise.net/index.php
http://yo###ull.net/index.php
http://lr###fruit.net/index.php
http://yo###oise.net/index.php
http://tr###pull.net/index.php
http://fa###fire.net/index.php
http://ri###old.net/index.php
http://fa###cold.net/index.php
http://no###one.net/index.php
http://we###ire.net/index.php
http://ri###rote.net/index.php
http://fa###bone.net/index.php
http://ri###ire.net/index.php
http://fa###wrote.net/index.php
http://ri###one.net/index.php

UDP:

DNS ASK pl###pull.net
DNS ASK fi###ull.net
DNS ASK pl###noise.net
DNS ASK fi###oise.net
DNS ASK se###fruit.net
DNS ASK le###rise.net
DNS ASK se###noise.net
DNS ASK le###fruit.net
DNS ASK se###rise.net
DNS ASK fi###ise.net
DNS ASK lr###noise.net
DNS ASK vi###oise.net
DNS ASK lr###rise.net
DNS ASK vi###ise.net
DNS ASK lr###pull.net
DNS ASK fi###ruit.net
DNS ASK pl###rise.net
DNS ASK vi###ull.net
DNS ASK pl###fruit.net
DNS ASK le###noise.net
DNS ASK we###ise.net
DNS ASK ve###ise.net
DNS ASK we###ruit.net
DNS ASK ve###ruit.net
DNS ASK we###oise.net
DNS ASK ve###ull.net
DNS ASK pi###fruit.net
DNS ASK ve###oise.net
DNS ASK we###ull.net
DNS ASK fa###ull.net
DNS ASK to###ruit.net
DNS ASK fa###ruit.net
DNS ASK se###pull.net
DNS ASK le###pull.net
DNS ASK to###ise.net
DNS ASK fa###oise.net
DNS ASK to###ull.net
DNS ASK fa###ise.net
DNS ASK to###oise.net
DNS ASK vi###ruit.net
DNS ASK no###ire.net
DNS ASK li###ire.net
DNS ASK be##lxc.com
DNS ASK li###one.net
DNS ASK we###old.net
DNS ASK no###rote.net
DNS ASK we###one.net
DNS ASK no###old.net
DNS ASK we###rote.net
DNS ASK ri###nstorm.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK ca####nbring.net
DNS ASK al###being.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK tr###rise.net
DNS ASK yo###ise.net
DNS ASK tr###fruit.net
DNS ASK yo###ruit.net
DNS ASK tr###noise.net
DNS ASK yo###ull.net
DNS ASK lr###fruit.net
DNS ASK yo###oise.net
DNS ASK tr###pull.net
DNS ASK fa###fire.net
DNS ASK ri###old.net
DNS ASK fa###cold.net
DNS ASK no###one.net
DNS ASK we###ire.net
DNS ASK ri###rote.net
DNS ASK fa###bone.net
DNS ASK ri###ire.net
DNS ASK fa###wrote.net
DNS ASK ri###one.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней