Trojan.DownLoader26.19337

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'multiplicationrestrains' = '"%ProgramFiles%\chevrons\drops.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'restrainsmultiplication' = '"%ProgramFiles%\chevrons\drops.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'multiplication' = '"%ProgramFiles%\Reassign\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'restrainsrestrains' = '"%ProgramFiles%\Marigold\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'oxcart' = '"%ProgramFiles%\Reassign\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'eichorn' = '"%ProgramFiles%\hargraves\eichorn.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'multiplicationmultiplication' = '"%ProgramFiles%\Marigold\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'anatomicallyovergrowth' = '"%ProgramFiles%\chevrons\drops.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'overgrowth' = '"%ProgramFiles%\Reassign\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'anatomically' = '"%ProgramFiles%\Reassign\brennan.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'overgrowthanatomically' = '"%ProgramFiles%\chevrons\drops.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'restrains' = '"%ProgramFiles%\Reassign\brennan.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'overgrowthovergrowth' = '"%ProgramFiles%\Marigold\brennan.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'anatomicallyanatomically' = '"%ProgramFiles%\Marigold\brennan.exe"'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\volkvolk.lnk
%HOMEPATH%\Start Menu\Programs\Startup\volk.lnk

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[1].asp
%TEMP%\nsmC.tmp\nsD.tmp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[1].asp
%TEMP%\nsmC.tmp\nsExec.dll
%WINDIR%\anthropomorphism.exe
%ProgramFiles%\hargraves\eichorn.exe
%TEMP%\nsgB.tmp\ShellLink.dll
%TEMP%\nst8.tmp\AccessControl.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[6].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[5].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[8].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[7].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[4].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[3].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu[2].asp
%ProgramFiles%\hoisting\hoisting.exe
%TEMP%\nsw2.tmp\Microsoft.Win32.TaskScheduler.dll
%TEMP%\nsw2.tmp\NMgunter.exe
%ProgramFiles%\Reassign\Reassign.exe
%TEMP%\nsw2.tmp\113672.exe
%TEMP%\nsw2.tmp\134986.exe
%TEMP%\nsw2.tmp\43385.exe
%TEMP%\nsw2.tmp\25141.exe
%TEMP%\nsw2.tmp\96062.exe
%TEMP%\nsw2.tmp\61962.exe
%ProgramFiles%\Reassign\brennan.dll
%TEMP%\nsz5.tmp\SimpleFC.dll
<LS_APPDATA>\drops.exe
%ProgramFiles%\Marigold\drops.exe
%ProgramFiles%\Marigold\brennan.exe
<LS_APPDATA>\brennan.exe
%ProgramFiles%\chevrons\chevrons.exe
%ProgramFiles%\Reassign\brennan.exe
%ProgramFiles%\chevrons\drops.exe
%ProgramFiles%\chevrons\drops.dll

Удаляет следующие файлы:

%TEMP%\nsgB.tmp\ShellLink.dll
%TEMP%\nst8.tmp\AccessControl.dll
%TEMP%\nsz5.tmp\SimpleFC.dll

Сетевая активность:

Подключается к:

'cy####aralyze.pw':80
'localhost':1047
'localhost':1041
'localhost':1037
'localhost':1038

TCP:

Запросы HTTP GET:

http://www.cy####aralyze.pw/aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu.asp?1q################### via cy####aralyze.pw
http://www.cy####aralyze.pw/aaiybl2cu0cu1cu8cu0pya2pya1aaiybl6aaiyblcu.asp?1q################## via cy####aralyze.pw

UDP:

DNS ASK www.cy####aralyze.pw

Другое:

Ищет следующие окна:

ClassName: 'Chrome_WidgetWin_0' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\nsw2.tmp\NMgunter.exe' "%ProgramFiles%\hoisting\hoisting.exe" "disable"
'%TEMP%\nsw2.tmp\113672.exe'
'%TEMP%\nsw2.tmp\NMgunter.exe' "%ProgramFiles%\Marigold\brennan.exe" "annals_sumi"
'%TEMP%\nsw2.tmp\NMgunter.exe' "%ProgramFiles%\Marigold\drops.exe" "izzard predecessor"
'%TEMP%\nsw2.tmp\96062.exe'
'%TEMP%\nsmC.tmp\nsD.tmp' taskkill /im chrome.exe
'%ProgramFiles%\hargraves\eichorn.exe'
'%TEMP%\nsw2.tmp\61962.exe'
'%ProgramFiles%\Marigold\drops.exe'
'%TEMP%\nsw2.tmp\134986.exe'
'%ProgramFiles%\Reassign\brennan.exe'
'%TEMP%\nsw2.tmp\NMgunter.exe' "%ProgramFiles%\Reassign\brennan.exe" "inequities"
'%TEMP%\nsw2.tmp\NMgunter.exe' "%ProgramFiles%\chevrons\drops.exe" "glace-affiliating"
'%TEMP%\nsw2.tmp\NMgunter.exe' "<LS_APPDATA>\drops.exe" "comprehend_paredes"
'%ProgramFiles%\Marigold\brennan.exe'
'%TEMP%\nsw2.tmp\43385.exe'
'%TEMP%\nsw2.tmp\NMgunter.exe' "<LS_APPDATA>\brennan.exe" "footfalls stockyard barkers"