Trojan.DownLoader25.45449

Добавлен в вирусную базу Dr.Web: 2017-10-13

Описание добавлено: 2017-10-12

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Telephony System Shadow SPP Remote' = '<SYSTEM32>\sepfzik.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Extender Acquisition Collector Modules Builder] 'ImagePath' = '<SYSTEM32>\sepfzik.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Extender Acquisition Collector Modules Builder] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\bnhnrvhvorhw.exe' "<SYSTEM32>\sepfzik.exe"
'%WINDIR%\Temp\ptkdwova2qnnqo.exe' -r 30649 tcp
'%TEMP%\ptkdwova2m0zqojodvbaxd.exe'
'<SYSTEM32>\sepfzik.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\capuhxewugp\run
<SYSTEM32>\capuhxewugp\rng
%WINDIR%\Temp\ptkdwova2qnnqo.exe
<SYSTEM32>\capuhxewugp\cfg
<SYSTEM32>\bnhnrvhvorhw.exe
%TEMP%\ptkdwova2m0zqojodvbaxd.exe
<SYSTEM32>\capuhxewugp\tst
<SYSTEM32>\sepfzik.exe
<SYSTEM32>\capuhxewugp\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\bnhnrvhvorhw.exe
<SYSTEM32>\sepfzik.exe

Удаляет следующие файлы:

%WINDIR%\Temp\ptkdwova2qnnqo.exe
<DRIVERS>\etc\hosts
%TEMP%\ptkdwova2m0zqojodvbaxd.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'so###second.net':80
'fi###second.net':80
'so###hold.net':80
'fi###hold.net':80
'so###ocean.net':80
'fi###have.net':80
'th###hold.net':80
'fi###ocean.net':80
'so###have.net':80
'fa###full.net':80
'ri###lood.net':80
'fa###blood.net':80
'no###ose.net':80
'no###ull.net':80
'ri###aily.net':80
'fa###lose.net':80
'ri###ull.net':80
'fa###daily.net':80
'ri###ose.net':80
'we###cean.net':80
'fe###ave.net':80
'we###econd.net':80
'fe###cean.net':80
'we###ave.net':80
'ta###second.net':80
'le###econd.net':80
'ta###hold.net':80
'le###old.net':80
'fe###econd.net':80
'li###econd.net':80
'th###ocean.net':80
'li###old.net':80
'th###second.net':80
'li###cean.net':80
'fe###old.net':80
'we###old.net':80
'th###have.net':80
'li###ave.net':80
'no###aily.net':80
'li###ull.net':80
'fe###lood.net':80
'li###ose.net':80
'th###full.net':80
'we###lood.net':80
'fe###ose.net':80
'we###ose.net':80
'fe###aily.net':80
'we###aily.net':80
'th###lose.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'fi###full.net':80
'th###daily.net':80
'li###aily.net':80
'th###blood.net':80
'li###lood.net':80
'po###daily.net':80
'ca###aily.net':80
'po###blood.net':80
'ca###lood.net':80
'po###lose.net':80
'ca###ull.net':80
'no###lood.net':80
'ca###ose.net':80
'po###full.net':80
'le###ull.net':80
'ta###blood.net':80
'le###lood.net':80
'fe###ull.net':80
'we###ull.net':80
'ta###daily.net':80
'le###ose.net':80
'ta###full.net':80
'le###aily.net':80
'ta###lose.net':80

TCP:

Запросы HTTP GET:

http://so###second.net/index.php
http://fi###second.net/index.php
http://so###hold.net/index.php
http://fi###hold.net/index.php
http://so###ocean.net/index.php
http://fi###have.net/index.php
http://th###hold.net/index.php
http://fi###ocean.net/index.php
http://so###have.net/index.php
http://fa###full.net/index.php
http://ri###lood.net/index.php
http://fa###blood.net/index.php
http://no###ose.net/index.php
http://no###ull.net/index.php
http://ri###aily.net/index.php
http://fa###lose.net/index.php
http://ri###ull.net/index.php
http://fa###daily.net/index.php
http://ri###ose.net/index.php
http://we###cean.net/index.php
http://fe###ave.net/index.php
http://we###econd.net/index.php
http://fe###cean.net/index.php
http://we###ave.net/index.php
http://ta###second.net/index.php
http://le###econd.net/index.php
http://ta###hold.net/index.php
http://le###old.net/index.php
http://fe###econd.net/index.php
http://li###econd.net/index.php
http://th###ocean.net/index.php
http://li###old.net/index.php
http://th###second.net/index.php
http://li###cean.net/index.php
http://fe###old.net/index.php
http://we###old.net/index.php
http://th###have.net/index.php
http://li###ave.net/index.php
http://no###aily.net/index.php
http://li###ull.net/index.php
http://fe###lood.net/index.php
http://li###ose.net/index.php
http://th###full.net/index.php
http://we###lood.net/index.php
http://fe###ose.net/index.php
http://we###ose.net/index.php
http://fe###aily.net/index.php
http://we###aily.net/index.php
http://th###lose.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://fi###full.net/index.php
http://th###daily.net/index.php
http://li###aily.net/index.php
http://th###blood.net/index.php
http://li###lood.net/index.php
http://po###daily.net/index.php
http://ca###aily.net/index.php
http://po###blood.net/index.php
http://ca###lood.net/index.php
http://po###lose.net/index.php
http://ca###ull.net/index.php
http://no###lood.net/index.php
http://ca###ose.net/index.php
http://po###full.net/index.php
http://le###ull.net/index.php
http://ta###blood.net/index.php
http://le###lood.net/index.php
http://fe###ull.net/index.php
http://we###ull.net/index.php
http://ta###daily.net/index.php
http://le###ose.net/index.php
http://ta###full.net/index.php
http://le###aily.net/index.php
http://ta###lose.net/index.php

UDP:

DNS ASK fi###hold.net
DNS ASK so###second.net
DNS ASK fa###full.net
DNS ASK so###hold.net
DNS ASK fi###second.net
DNS ASK so###have.net
DNS ASK fi###have.net
DNS ASK so###ocean.net
DNS ASK fi###ocean.net
DNS ASK ri###ull.net
DNS ASK no###ull.net
DNS ASK ri###lood.net
DNS ASK no###aily.net
DNS ASK no###ose.net
DNS ASK fa###blood.net
DNS ASK ri###ose.net
DNS ASK fa###lose.net
DNS ASK ri###aily.net
DNS ASK fa###daily.net
DNS ASK th###hold.net
DNS ASK we###cean.net
DNS ASK fe###ave.net
DNS ASK we###econd.net
DNS ASK fe###cean.net
DNS ASK we###ave.net
DNS ASK ta###second.net
DNS ASK le###econd.net
DNS ASK ta###hold.net
DNS ASK le###old.net
DNS ASK fe###econd.net
DNS ASK li###econd.net
DNS ASK th###ocean.net
DNS ASK li###old.net
DNS ASK th###second.net
DNS ASK li###cean.net
DNS ASK fe###old.net
DNS ASK we###old.net
DNS ASK th###have.net
DNS ASK li###ave.net
DNS ASK li###ull.net
DNS ASK fe###lood.net
DNS ASK li###ose.net
DNS ASK th###full.net
DNS ASK we###lood.net
DNS ASK fe###ose.net
DNS ASK we###ose.net
DNS ASK fe###aily.net
DNS ASK we###aily.net
DNS ASK th###lose.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK fi###full.net
DNS ASK th###daily.net
DNS ASK li###aily.net
DNS ASK th###blood.net
DNS ASK li###lood.net
DNS ASK po###daily.net
DNS ASK ca###aily.net
DNS ASK po###blood.net
DNS ASK ca###lood.net
DNS ASK po###lose.net
DNS ASK ca###ull.net
DNS ASK no###lood.net
DNS ASK ca###ose.net
DNS ASK po###full.net
DNS ASK le###ull.net
DNS ASK ta###blood.net
DNS ASK le###lood.net
DNS ASK fe###ull.net
DNS ASK we###ull.net
DNS ASK ta###daily.net
DNS ASK le###ose.net
DNS ASK ta###full.net
DNS ASK le###aily.net
DNS ASK ta###lose.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней