Trojan.Hosts.44744

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'camouflaging' = '"%ProgramFiles%\olathe\camouflaging.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'louvered' = '"%ProgramFiles%\Parler\rasheed.exe"'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\landis.lnk

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\14128.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[2].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[3].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[4].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[5].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[6].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[7].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[8].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[9].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[10].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[11].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[12].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[13].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[14].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[15].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[16].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[17].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[18].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[19].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[20].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[21].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[22].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[1].html
%TEMP%\nsmD.tmp\nsF.tmp
%TEMP%\nsp2.tmp\43938.exe
%TEMP%\nsp2.tmp\65855.exe
%TEMP%\nsp2.tmp\76324.exe
%TEMP%\nsp2.tmp\107768.exe
%TEMP%\nsp2.tmp\121532.exe
%TEMP%\nsp2.tmp\NMmoneypenny.exe
%TEMP%\nsp2.tmp\Microsoft.Win32.TaskScheduler.dll
%TEMP%\nsp2.tmp\115689.exe
%ProgramFiles%\Parler\Parler.exe
%ProgramFiles%\Parler\rasheed.dll
%ProgramFiles%\Parler\rasheed.exe
<LS_APPDATA>\rasheed.exe
%TEMP%\nsb4.tmp\AccessControl.dll
%ProgramFiles%\Essayist\rasheed.exe
%TEMP%\nsy7.tmp\SimpleFC.dll
%ProgramFiles%\faucet\faucet.exe
%ProgramFiles%\olathe\camouflaging.exe
%TEMP%\nsl9.tmp\AccessControl.dll
%WINDIR%\passageways.exe
%TEMP%\nsmD.tmp\nsExec.dll
%TEMP%\nscE.tmp\ShellLink.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[1].html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY[23].html

Удаляет следующие файлы:

%TEMP%\nsb4.tmp\AccessControl.dll
%TEMP%\nsy7.tmp\SimpleFC.dll
%TEMP%\nscE.tmp\ShellLink.dll
%TEMP%\nsl9.tmp\AccessControl.dll

Изменяет файл HOSTS.

Сетевая активность:

Подключается к:

'localhost':1036
'localhost':1038
'sa####sgrafted.pw':80
'ww##.##piensgrafted.pw':80
'localhost':1044

TCP:

Запросы HTTP GET:

http://www.sa####sgrafted.pw/fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY.html?fi########################################## via sa####sgrafted.pw
http://ww##.##piensgrafted.pw/fSugk2GfpY0GfpY1GfpY71RPZEqF01fSugk4GfpY.html?fi##########################################

UDP:

DNS ASK www.sa####sgrafted.pw
DNS ASK ww##.##piensgrafted.pw

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Chrome_WidgetWin_0' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\nsp2.tmp\76324.exe'
'%TEMP%\nsp2.tmp\NMmoneypenny.exe' "%ProgramFiles%\Parler\rasheed.exe" "79483690"
'%TEMP%\nsp2.tmp\121532.exe'
'%ProgramFiles%\Parler\rasheed.exe'
'%TEMP%\nsp2.tmp\43938.exe'
'%TEMP%\nsp2.tmp\NMmoneypenny.exe' "<LS_APPDATA>\rasheed.exe" "10629446"
'%ProgramFiles%\Essayist\rasheed.exe'
'%TEMP%\nsp2.tmp\NMmoneypenny.exe' "%ProgramFiles%\Essayist\rasheed.exe" "65533315"
'%TEMP%\nsp2.tmp\NMmoneypenny.exe' "%ProgramFiles%\faucet\faucet.exe" "k65533315"
'%TEMP%\nsp2.tmp\115689.exe'
'%ProgramFiles%\olathe\camouflaging.exe'
'%TEMP%\nsp2.tmp\65855.exe'
'%TEMP%\nsp2.tmp\107768.exe'
'%TEMP%\nsmD.tmp\nsF.tmp' taskkill /im chrome.exe