Trojan.DownLoader26.55325

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lantern' = '"%APPDATA%\Lantern\lantern.exe" -clear-proxy-settings'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lantern' = '"%APPDATA%\Lantern\lantern.exe" -startup'

Вредоносные функции:

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:1067'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
[<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\lantern-installer.exe
%APPDATA%\Lantern\settings.yaml
%APPDATA%\byteexec\sysproxy-cmd.exe
%TEMP%\Tencentdl.exe
%APPDATA%\systray\systray386.dll
%APPDATA%\Lantern\logs\lantern.log
%APPDATA%\byteexec\certimporter.exe
%TEMP%\nsh2.tmp\ShellExecAsUser.dll
%HOMEPATH%\Desktop\Lantern.lnk
%HOMEPATH%\Start Menu\Programs\Lantern\Uninstall Lantern.lnk
%HOMEPATH%\Start Menu\Programs\Lantern\Lantern.lnk
%APPDATA%\Lantern\uninstall.exe
%APPDATA%\Lantern\lantern.yaml
%APPDATA%\Lantern\.packaged-lantern.yaml
%APPDATA%\Lantern\lantern.ico
%APPDATA%\Lantern\lantern.exe
%TEMP%\notifu-notifier673178803\notifu.exe
%APPDATA%\Lantern\proxystats.csv.tmp

Удаляет следующие файлы:

%TEMP%\nsh2.tmp\ShellExecAsUser.dll
<Полный путь к файлу>

Перемещает следующие файлы:

%APPDATA%\Lantern\proxystats.csv.tmp в %APPDATA%\Lantern\proxystats.csv

Подменяет следующие файлы:

%APPDATA%\Lantern\proxystats.csv.tmp

Сетевая активность:

Подключается к:

'12#.#25.114.144':80
'54.##0.0.193':443
'13.#2.4.205':443
'54.##0.0.249':443
'13.#2.4.227':443
'13.#2.4.92':443
'52.##.10.102':443
'54.##2.20.58':443
'54.##0.15.11':443
'52.##.10.144':443
'52.##2.132.210':443
'54.##2.20.134':443
'54.##0.15.239':443
'54.##0.15.224':443
'52.##2.132.118':443
'52.##.10.114':443
'13.##.16.167':443
'54.##0.15.29':443
'54.##2.20.153':443
'52.#4.7.16':443
'52.#4.7.50':443
'13.##.20.145':443
'52.##2.132.72':443
'52.##2.136.120':443
'13.##.20.228':443
'13.#2.4.200':443
'52.##2.132.83':443
'54.#92.22.7':443
'54.##2.22.41':443
'52.##.10.109':443
'54.##0.15.102':443
'54.##0.7.248':443
'13.#2.4.161':443
'54.#82.2.96':443
'52.##2.132.141':443
'52.#4.7.226':443
'54.##0.7.229':443
'54.#82.2.47':443
'52.#4.10.62':443
'52.##2.136.92':443
'52.#4.10.71':443
'54.##2.20.20':443
'54.##0.15.13':443
'54.##0.15.235':443
'54.#82.2.79':443
'54.##0.7.108':443
'52.##2.132.6':443
'54.##2.2.193':443
'52.##2.132.106':443
'52.##2.132.221':443
'52.##2.136.252':443
'54.##2.22.104':443
'13.#2.20.7':443
'54.##2.20.213':443
'54.##0.0.200':443
'52.##.10.123':443
'54.#30.7.75':443
'54.##0.15.110':443
'52.#4.7.134':443
'52.##2.132.160':443
'54.##2.2.228':443
'54.#30.0.20':443
'13.#2.20.78':443
'13.#2.4.34':443
'52.##2.136.7':443
'54.##2.20.45':443
'13.#2.4.174':443
'52.##2.132.196':443
'52.##2.136.199':443
'54.##0.7.215':443
'54.##2.22.151':443
'54.##0.0.239':443
'52.#4.10.8':443
'54.##2.2.132':443
'52.#4.10.41':443
'13.##.16.200':443
'54.##0.7.208':443
'52.##2.132.131':443
'54.##2.2.237':443
'13.#2.20.20':443
'13.#2.4.102':443
'13.##.16.121':443
'54.##0.0.244':443
'52.#4.7.154':443
'52.##.10.129':443
'54.##0.7.218':443
'13.##.16.196':443
'13.##.20.243':443
'52.##.10.184':443
'13.##.20.193':443
'52.#4.7.17':443
'54.##0.0.149':443
'52.##2.136.164':443
'54.##2.20.219':443
'13.#2.4.14':443
'13.#2.4.86':443
'54.##2.22.11':443
'52.##2.136.160':443
'54.##2.22.23':443
'52.##2.132.199':443
'13.#2.4.198':443
'54.##2.2.196':443
'52.#4.10.81':443
'52.##2.132.37':443
'54.##2.2.155':443
'54.##0.0.164':443
'54.##0.7.109':443
'54.##2.22.177':443
'54.#82.2.17':443
'54.##2.2.204':443
'54.#30.7.26':443
'54.##2.22.253':443
'13.##.16.141':443
'52.##2.132.132':443
'52.##2.136.159':443
'13.##.20.247':443
'54.##2.20.13':443
'54.##2.22.113':443
'52.##2.132.229':443
'54.#92.20.9':443
'54.##0.15.145':443
'54.##2.20.100':443
'54.##0.0.219':443
'54.##2.22.148':443
'54.##2.20.41':443
'54.##0.0.163':443
'54.##2.2.195':443
'54.##2.22.101':443
'54.##2.2.112':443
'20#.#51.251.180':443
'13.#2.20.25':443
'52.##.10.166':443
'13.##.16.214':443
'13.#2.16.25':443
'54.##2.2.179':443
'54.##2.20.126':443
'52.#4.7.91':443
'54.##0.0.235':443
'13.##.20.168':443
'52.#4.10.66':443
'13.#2.4.62':443
'52.##2.136.176':443
'52.##2.132.23':443
'13.#2.20.39':443
'54.##2.20.140':443
'54.##2.20.162':443
'54.#82.2.36':443
'13.#2.4.146':443
'52.#4.7.118':443
'54.##2.22.216':443
'54.#82.2.13':443
'52.##.10.165':443
'54.##2.2.248':443
'52.##.10.214':443
'54.##0.0.111':443
'52.##2.132.174':443
'52.##2.132.12':443
'13.#2.4.144':443
'54.##2.22.161':443
'13.##.16.250':443
'52.#4.7.237':443
'52.##2.132.50':443
'13.##.20.105':443
'54.#30.0.91':443
'54.##2.5.199':443
'13.##.16.112':443
'54.##2.22.159':443
'54.##0.0.224':443
'13.##.20.132':443
'13.##.20.119':443
'52.##.10.218':443
'54.##2.20.164':443
'13.#2.4.116':443
'13.#2.20.50':443
'54.##2.22.51':443
'54.##2.20.212':443
'54.##2.20.101':443
'54.##2.20.185':443
'54.##2.2.197':443
'52.#4.10.95':443
'52.#4.10.89':443
'54.##2.22.117':443
'52.##2.136.116':443
'52.##2.132.230':443
'54.##2.20.91':443
'52.#4.7.191':443
'54.##2.20.235':443
'52.##.10.223':443
'52.##2.132.73':443
'13.##.16.249':443
'54.##2.20.155':443
'54.##0.15.61':443
'52.##2.132.142':443
'54.##0.0.167':443
'54.##0.0.100':443
'54.##2.22.190':443
'13.##.20.177':443
'54.##0.15.73':443
'13.##.20.223':443
'54.##0.0.229':443
'13.##.16.140':443
'54.##0.15.185':443
'52.##.10.151':443
'52.#4.7.69':443
'52.##2.136.82':443
'54.##0.0.143':443
'54.##0.7.138':443
'52.##.10.196':443
'52.##.10.108':443
'54.##2.2.130':443
'13.#2.4.213':443
'54.##0.15.221':443
'10#.#1.223.217':13730
'ra#.####ubusercontent.com':443
'54.#30.0.19':443
'13.#2.16.44':443
'52.##2.132.36':443
'13.##.16.148':443
'54.##2.20.28':443
'54.##2.2.214':443
'52.##2.136.72':443
'54.##2.2.110':443
'13.#2.4.239':443
'54.##2.22.62':443
'52.##2.136.198':443
'45.##.178.100':13332
'54.##2.20.39':443
'54.##2.22.139':443
'52.##2.136.80':443
'13.#2.20.99':443
'52.#4.7.113':443
'54.##0.0.178':443
'54.#30.0.10':443
'54.##2.2.227':443
'54.##0.0.127':443
'13.#2.16.39':443
'13.#2.4.201':443
'52.##2.132.253':443
'54.##2.20.92':443
'52.##2.136.236':443
'52.##2.136.151':443
'13.#2.16.50':443
'54.##2.20.136':443
'13.##.20.188':443
'52.##2.136.215':443
'54.##0.0.113':443
'52.##2.132.55':443
'54.#30.0.65':443
'13.#2.4.186':443
'54.##0.15.94':443
'13.##.20.171':443
'52.##2.136.185':443
'45.##.44.161':10489
'52.##2.132.108':443
'13.##.16.230':443
'13.#2.16.42':443
'52.##2.132.241':443
'54.##0.0.222':443
'13.##.20.151':443
'52.##2.132.40':443
'54.##2.22.156':443
'54.##0.0.128':443
'13.#2.4.143':443
'52.##2.136.201':443
'54.#82.2.72':443
'54.#30.7.82':443
'54.##2.2.177':443
'54.##2.22.95':443
'ea########ownloads.adblockplus.org':443
'52.##2.132.155':443
'45.##.201.147':443
'54.##2.22.90':443
'54.##2.20.122':443
'54.##0.7.222':443
'54.##2.2.208':443
'52.##2.132.79':443
'52.##2.136.95':443
'13.##.20.107':443
'54.##2.22.168':443
'52.##2.136.145':443
'54.##2.2.176':443
'54.##2.22.98':443
'pa#.abn.cc':443
'54.#82.2.90':443
'13.##.20.235':443
'52.##.10.175':443
'13.#2.4.30':443
'52.##2.136.77':443
'54.##0.7.153':443
'54.##0.0.252':443
'52.#4.10.17':443
'45.#7.133.5':443
'52.##2.132.16':443
'13.#2.4.107':443
's3.###zonaws.com':443
'54.##0.15.113':443
'13.##.16.164':443
'13.##.20.197':443
'52.#4.7.206':443
'52.##.10.199':443
'52.##2.132.140':443
'54.##2.20.60':443
'13.#2.4.176':443
'52.##.10.187':443
'52.##2.132.107':443
'54.##0.0.202':443
'45.##.155.211':12983
'54.##0.15.76':443
'localhost':1067
'54.##2.22.91':443
'54.##2.22.252':443
'13.#2.16.99':443
'13.#2.16.59':443
'54.##0.15.30':443
'54.##2.22.61':443
'13.##.20.154':443
'13.#2.4.130':443
'54.#82.2.30':443
'54.##2.22.86':443
'54.##0.7.150':443
'54.##2.22.224':443
'54.##0.7.196':443
'13.#2.4.212':443
'54.#30.0.35':443
'13.##.20.207':443
'13.#2.4.159':443
'52.#4.10.19':443
'13.#2.16.93':443
'54.##2.22.19':443
'52.##2.132.226':443
'13.##.20.124':443
'52.##2.136.128':443
'52.#4.7.201':443
'54.##0.15.121':443
'52.##.10.170':443
'52.##2.132.202':443
'54.##0.15.209':443
'52.##2.132.145':443
'54.##0.7.209':443
'54.##2.22.50':443
'13.#2.4.29':443
'13.#2.20.49':443
'54.##0.15.173':443
'52.#4.7.98':443
'52.##.10.155':443
'13.##.16.245':443
'13.#2.4.96':443
'13.#2.4.28':443
'52.##.10.154':443
'54.##2.2.223':443
'52.##2.136.59':443
'54.##2.20.172':443
'54.##0.15.168':443
'52.##2.132.5':443
'54.##0.15.226':443
'54.##0.0.199':443
'54.##0.0.221':443
'52.##.10.208':443
'52.##2.132.201':443
'13.#2.4.202':443
'54.##0.0.251':443
'13.#2.4.197':443
'52.##2.136.5':443
'13.#2.4.9':443
'13.#2.4.27':443
'54.#30.0.67':443
'54.##0.7.180':443
'54.##2.2.121':443
'52.##.10.222':443
'13.#2.4.240':443
'54.##2.22.112':443
'52.##2.136.202':443
'52.##2.132.117':443
'52.##.10.172':443
'52.#4.10.12':443
'54.##2.20.193':443
'54.##2.22.236':443
'13.#2.4.77':443
'54.##2.2.201':443
'54.#30.0.26':443
'13.#2.4.220':443
'13.#2.20.54':443
'52.#4.7.89':443
'54.##2.20.232':443
'13.##.20.172':443
'54.##0.7.159':443
'52.#4.7.19':443
'13.#2.16.6':443
'54.##0.7.238':443
'54.##2.22.70':443
'13.#2.16.71':443
'52.##.10.197':443
'52.##2.132.95':443
'54.##2.22.183':443
'54.##2.20.197':443
'54.##0.15.169':443
'13.#2.4.222':443
'13.#2.16.87':443
'54.##0.7.243':443
'54.##0.0.187':443
'54.##2.2.210':443
'54.##0.0.112':443
'52.##.10.163':443
'54.##2.2.151':443
'54.##2.20.69':443
'54.##0.15.152':443
'13.#2.4.245':443
'54.##0.15.114':443
'13.#2.16.48':443
'52.##2.136.117':443
'52.##2.132.129':443
'52.#4.7.250':443
'52.##2.136.103':443
'54.##2.2.231':443
'13.#2.20.17':443

TCP:

Запросы HTTP GET:

http://www.ba##u.com/ via 12#.#25.114.144
http://co####.getiantem.org/proxies.yaml.gz via localhost
http://ge#.##tiantem.org/lookup/ via localhost

UDP:

DNS ASK www.ba##u.com
DNS ASK pa#.abn.cc
DNS ASK ea########ownloads.adblockplus.org
DNS ASK s3.###zonaws.com
DNS ASK ra#.####ubusercontent.com

Другое:

Создает и запускает на исполнение:

'%TEMP%\lantern-installer.exe'
'%APPDATA%\Lantern\lantern.exe'
'%APPDATA%\byteexec\sysproxy-cmd.exe' on 127.0.0.1 1067
'%APPDATA%\byteexec\sysproxy-cmd.exe' wait-and-cleanup 127.0.0.1 1067
'%APPDATA%\byteexec\sysproxy-cmd.exe' show

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c del "<Полный путь к файлу>"
'<SYSTEM32>\cmd.exe' ver

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней