Trojan.DownLoader24.39959

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protection Parental HomeGroup' = 'C:\wesutpfoixa\ltjxpgaxw.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Access Acquisition Block] 'ImagePath' = 'C:\wesutpfoixa\ltjxpgaxw.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Access Acquisition Block] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\wesutpfoixa\xmqctdmfrk.exe' "c:\wesutpfoixa\ltjxpgaxw.exe"
'C:\wesutpfoixa\ltjxpgaxw.exe'
'C:\wesutpfoixa\ws3133qirplpbhjjk.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\wesutpfoixa\ltjxpgaxw.exe
C:\wesutpfoixa\xmqctdmfrk.exe
C:\wesutpfoixa\ws3133qirplpbhjjk.exe
%WINDIR%\wesutpfoixa\j9kqamm
C:\wesutpfoixa\j9kqamm

Присваивает атрибут 'скрытый' для следующих файлов:

C:\wesutpfoixa\xmqctdmfrk.exe
C:\wesutpfoixa\ltjxpgaxw.exe

Удаляет следующие файлы:

C:\wesutpfoixa\ws3133qirplpbhjjk.exe
%WINDIR%\wesutpfoixa\j9kqamm

Подменяет следующие файлы:

%WINDIR%\wesutpfoixa\j9kqamm

Сетевая активность:

Подключается к:

'be#####ectricity.net':80
'kn#####ectricity.net':80
'be###train.net':80
'kn###train.net':80
'be####elight.net':80
'cr###borrow.net':80
'su###rtrain.net':80
'kn####elight.net':80
'su####borrow.net':80
'kn###borrow.net':80
'fo###wtrain.net':80
'me###rtrain.net':80
'fo####borrow.net':80
'me####borrow.net':80
'fo#####lectricity.net':80
'me####delight.net':80
'be###borrow.net':80
'me#####lectricity.net':80
'fo####delight.net':80
'cr###train.net':80
'wo###borrow.net':80
'sm###borrow.net':80
'th####tdelight.net':80
'wa####elight.net':80
'wo###train.net':80
'sm#####ectricity.net':80
'wo####elight.net':80
'sm###train.net':80
'wo#####ectricity.net':80
'wa#####ectricity.net':80
'su####delight.net':80
'cr####elight.net':80
'su#####lectricity.net':80
'cr#####ectricity.net':80
'th####tborrow.net':80
'wa###train.net':80
'th#####electricity.net':80
'wa###borrow.net':80
'th####ttrain.net':80
'sm###twenty.net':80
'wo####nderstood.net':80
'sm####eeting.net':80
'wo###twenty.net':80
'sm####nderstood.net':80
'pa####eeting.net':80
'fi####eeting.net':80
'pa###chance.net':80
'fi###chance.net':80
'wo####eeting.net':80
'wa####eeting.net':80
'th####ttwenty.net':80
'wa###chance.net':80
'th####tmeeting.net':80
'wa###twenty.net':80
'wo###chance.net':80
'sm###chance.net':80
'th#####understood.net':80
'wa####nderstood.net':80
'pa###twenty.net':80
'al####yborrow.net':80
'ge####mantrain.net':80
'ex#####ncedelight.net':80
'ge####manborrow.net':80
'al####ytrain.net':80
'ge#####andelight.net':80
'al####ydelight.net':80
'ge######nelectricity.net':80
'al#####electricity.net':80
'fr####elight.net':80
'fi####nderstood.net':80
'fr###borrow.net':80
'fi###twenty.net':80
'pa####nderstood.net':80
'ex#####nceborrow.net':80
'fr#####ectricity.net':80
'ex######ceelectricity.net':80
'fr###train.net':80
'ex####encetrain.net':80

TCP:

Запросы HTTP GET:

http://be#####ectricity.net/index.php
http://kn#####ectricity.net/index.php
http://be###train.net/index.php
http://kn###train.net/index.php
http://be####elight.net/index.php
http://cr###borrow.net/index.php
http://su###rtrain.net/index.php
http://kn####elight.net/index.php
http://su####borrow.net/index.php
http://kn###borrow.net/index.php
http://fo###wtrain.net/index.php
http://me###rtrain.net/index.php
http://fo####borrow.net/index.php
http://me####borrow.net/index.php
http://fo#####lectricity.net/index.php
http://me####delight.net/index.php
http://be###borrow.net/index.php
http://me#####lectricity.net/index.php
http://fo####delight.net/index.php
http://cr###train.net/index.php
http://wo###borrow.net/index.php
http://sm###borrow.net/index.php
http://th####tdelight.net/index.php
http://wa####elight.net/index.php
http://wo###train.net/index.php
http://sm#####ectricity.net/index.php
http://wo####elight.net/index.php
http://sm###train.net/index.php
http://wo#####ectricity.net/index.php
http://wa#####ectricity.net/index.php
http://su####delight.net/index.php
http://cr####elight.net/index.php
http://su#####lectricity.net/index.php
http://cr#####ectricity.net/index.php
http://th####tborrow.net/index.php
http://wa###train.net/index.php
http://th#####electricity.net/index.php
http://wa###borrow.net/index.php
http://th####ttrain.net/index.php
http://sm###twenty.net/index.php
http://wo####nderstood.net/index.php
http://sm####eeting.net/index.php
http://wo###twenty.net/index.php
http://sm####nderstood.net/index.php
http://pa####eeting.net/index.php
http://fi####eeting.net/index.php
http://pa###chance.net/index.php
http://fi###chance.net/index.php
http://wo####eeting.net/index.php
http://wa####eeting.net/index.php
http://th####ttwenty.net/index.php
http://wa###chance.net/index.php
http://th####tmeeting.net/index.php
http://wa###twenty.net/index.php
http://wo###chance.net/index.php
http://sm###chance.net/index.php
http://th#####understood.net/index.php
http://wa####nderstood.net/index.php
http://pa###twenty.net/index.php
http://al####yborrow.net/index.php
http://ge####mantrain.net/index.php
http://ex#####ncedelight.net/index.php
http://ge####manborrow.net/index.php
http://al####ytrain.net/index.php
http://ge#####andelight.net/index.php
http://al####ydelight.net/index.php
http://ge######nelectricity.net/index.php
http://al#####electricity.net/index.php
http://fr####elight.net/index.php
http://fi####nderstood.net/index.php
http://fr###borrow.net/index.php
http://fi###twenty.net/index.php
http://pa####nderstood.net/index.php
http://ex#####nceborrow.net/index.php
http://fr#####ectricity.net/index.php
http://ex######ceelectricity.net/index.php
http://fr###train.net/index.php
http://ex####encetrain.net/index.php

UDP:

DNS ASK kn#####ectricity.net
DNS ASK be####elight.net
DNS ASK kn###train.net
DNS ASK be#####ectricity.net
DNS ASK kn####elight.net
DNS ASK su###rtrain.net
DNS ASK cr###train.net
DNS ASK su####borrow.net
DNS ASK cr###borrow.net
DNS ASK be###train.net
DNS ASK me###rtrain.net
DNS ASK fo#####lectricity.net
DNS ASK me####borrow.net
DNS ASK fo###wtrain.net
DNS ASK me#####lectricity.net
DNS ASK be###borrow.net
DNS ASK kn###borrow.net
DNS ASK fo####delight.net
DNS ASK me####delight.net
DNS ASK su#####lectricity.net
DNS ASK sm###borrow.net
DNS ASK wo###train.net
DNS ASK wa####elight.net
DNS ASK wo###borrow.net
DNS ASK sm###train.net
DNS ASK wo####elight.net
DNS ASK sm####elight.net
DNS ASK wo#####ectricity.net
DNS ASK sm#####ectricity.net
DNS ASK th####tdelight.net
DNS ASK cr####elight.net
DNS ASK th####tborrow.net
DNS ASK cr#####ectricity.net
DNS ASK su####delight.net
DNS ASK wa###borrow.net
DNS ASK th#####electricity.net
DNS ASK wa#####ectricity.net
DNS ASK th####ttrain.net
DNS ASK wa###train.net
DNS ASK fo####borrow.net
DNS ASK sm###twenty.net
DNS ASK wo####nderstood.net
DNS ASK sm####eeting.net
DNS ASK wo###twenty.net
DNS ASK sm####nderstood.net
DNS ASK pa####eeting.net
DNS ASK fi####eeting.net
DNS ASK pa###chance.net
DNS ASK fi###chance.net
DNS ASK wo####eeting.net
DNS ASK wa####eeting.net
DNS ASK th####ttwenty.net
DNS ASK wa###chance.net
DNS ASK th####tmeeting.net
DNS ASK wa###twenty.net
DNS ASK wo###chance.net
DNS ASK sm###chance.net
DNS ASK th#####understood.net
DNS ASK wa####nderstood.net
DNS ASK pa###twenty.net
DNS ASK al####yborrow.net
DNS ASK ge####mantrain.net
DNS ASK ex#####ncedelight.net
DNS ASK ge####manborrow.net
DNS ASK al####ytrain.net
DNS ASK ge#####andelight.net
DNS ASK al####ydelight.net
DNS ASK ge######nelectricity.net
DNS ASK al#####electricity.net
DNS ASK fr####elight.net
DNS ASK fi####nderstood.net
DNS ASK fr###borrow.net
DNS ASK fi###twenty.net
DNS ASK pa####nderstood.net
DNS ASK ex#####nceborrow.net
DNS ASK fr#####ectricity.net
DNS ASK ex######ceelectricity.net
DNS ASK fr###train.net
DNS ASK ex####encetrain.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней