Trojan.DnsAmp.35

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\Distribuaav] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Distribuaav] 'ImagePath' = '<SYSTEM32>\duzjuc.exe'

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\lpk.dll

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /t

Изменения в файловой системе

Создает следующие файлы

%TEMP%\hrl25f8.tmp
%ProgramFiles%\bdsurvey\lpk.dll
%ProgramFiles%\bdswitch\lpk.dll
%ProgramFiles%\bdwizreg\lpk.dll
%ProgramFiles%\blackd\lpk.dll
%ProgramFiles%\blackice\lpk.dll
%ProgramFiles%\blindman\lpk.dll
%ProgramFiles%\btini\lpk.dll
%ProgramFiles%\btinint\lpk.dll
%ProgramFiles%\cabalmain\lpk.dll
%ProgramFiles%\cafix\lpk.dll
%ProgramFiles%\cavapp\lpk.dll
%ProgramFiles%\cavasm\lpk.dll
%ProgramFiles%\cavaud\lpk.dll
%ProgramFiles%\cavemsrv\lpk.dll
%ProgramFiles%\cavmr\lpk.dll
%ProgramFiles%\bdsubmitwiz\lpk.dll
%ProgramFiles%\avgvv\lpk.dll
%ProgramFiles%\bdsubmit\lpk.dll
%ProgramFiles%\bdoesrv\lpk.dll
%ProgramFiles%\avgwizfw\lpk.dll
%ProgramFiles%\avinitnt\lpk.dll
%ProgramFiles%\avkserv\lpk.dll
%ProgramFiles%\avkservice\lpk.dll
%ProgramFiles%\avkwctl\lpk.dll
%ProgramFiles%\avnotify\lpk.dll
%ProgramFiles%\avpcc\lpk.dll
%ProgramFiles%\avpm\lpk.dll
%ProgramFiles%\avscan\lpk.dll
%ProgramFiles%\avsynmgr\lpk.dll
%ProgramFiles%\b2\lpk.dll
%ProgramFiles%\backweb-4476822\lpk.dll
%ProgramFiles%\bdagent\lpk.dll
%ProgramFiles%\bdmcon\lpk.dll
%ProgramFiles%\bdnews\lpk.dll
%ProgramFiles%\bdss\lpk.dll
%ProgramFiles%\avgw\lpk.dll
%ProgramFiles%\cavmud\lpk.dll
%ProgramFiles%\cavse\lpk.dll
%ProgramFiles%\cleaner\lpk.dll
%ProgramFiles%\cleaner3\lpk.dll
%ProgramFiles%\clisvc\lpk.dll
%ProgramFiles%\clrcche\lpk.dll
%ProgramFiles%\cmain\lpk.dll
%ProgramFiles%\cmgrdian\lpk.dll
%ProgramFiles%\ashsimp2\lpk.dll
%CommonProgramFiles%\microsoft shared\dw\lpk.dll
%CommonProgramFiles%\microsoft shared\ink\lpk.dll
%CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
%CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
%ProgramFiles%\claw95\lpk.dll
%ProgramFiles%\claw95cf\lpk.dll
%ProgramFiles%\cavq\lpk.dll
%ProgramFiles%\cavoar\lpk.dll
%ProgramFiles%\clamscan\lpk.dll
%ProgramFiles%\cavsn\lpk.dll
%ProgramFiles%\cavsub\lpk.dll
%ProgramFiles%\cavsubmit\lpk.dll
%ProgramFiles%\cavumas\lpk.dll
%ProgramFiles%\cavuserupd\lpk.dll
%ProgramFiles%\cavvl\lpk.dll
%ProgramFiles%\ccapp\lpk.dll
%ProgramFiles%\ccevtmgr\lpk.dll
%ProgramFiles%\ccleaner\lpk.dll
%ProgramFiles%\ccproxy\lpk.dll
%ProgramFiles%\ccsetmgr\lpk.dll
%ProgramFiles%\cemrep\lpk.dll
%ProgramFiles%\chrome\lpk.dll
%ProgramFiles%\clamtray\lpk.dll
%ProgramFiles%\cavscons\lpk.dll
%ProgramFiles%\clamwin\lpk.dll
%ProgramFiles%\avgupsvc\lpk.dll
%ProgramFiles%\avgupden\lpk.dll
%ProgramFiles%\avgscan\lpk.dll
%ProgramFiles%\ageofconan\lpk.dll
%ProgramFiles%\ahnsd\lpk.dll
%ProgramFiles%\aim6\lpk.dll
%ProgramFiles%\aimpro\lpk.dll
%ProgramFiles%\airdefense\lpk.dll
%ProgramFiles%\almon\lpk.dll
%ProgramFiles%\alsvc\lpk.dll
%ProgramFiles%\amon\lpk.dll
%ProgramFiles%\amsn\lpk.dll
%ProgramFiles%\anti-trojan\lpk.dll
%ProgramFiles%\antivirus\lpk.dll
%ProgramFiles%\aoltbserver\lpk.dll
%ProgramFiles%\armor2net\lpk.dll
%ProgramFiles%\armorsurf\lpk.dll
%ProgramFiles%\admunch\lpk.dll
%ProgramFiles%\ash\lpk.dll
%ProgramFiles%\ackwin32\lpk.dll
%ProgramFiles%\aavshield\lpk.dll
%WINDIR%\syswow64\duzjuc.exe
%WINDIR%\syswow64\hra33.dll
C:\rcx2c51.tmp
C:\far2\lpk.dll
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
%ProgramFiles%\360tray\lpk.dll
%ProgramFiles%\a2cmd\lpk.dll
%ProgramFiles%\a2guard\lpk.dll
%ProgramFiles%\a2hijackfree\lpk.dll
%ProgramFiles%\a2scan\lpk.dll
%ProgramFiles%\a2service\lpk.dll
%ProgramFiles%\a2start\lpk.dll
%ProgramFiles%\a2upd\lpk.dll
%ProgramFiles%\a2wizard\lpk.dll
%ProgramFiles%\about\lpk.dll
%ProgramFiles%\ashavast\lpk.dll
%ProgramFiles%\agb5\lpk.dll
%ProgramFiles%\ashavsrv\lpk.dll
%ProgramFiles%\avadmin\lpk.dll
%ProgramFiles%\avciman\lpk.dll
%ProgramFiles%\avcmd\lpk.dll
%ProgramFiles%\avconfig\lpk.dll
%ProgramFiles%\avconsol\lpk.dll
%ProgramFiles%\avgamsvr\lpk.dll
%ProgramFiles%\avgcc\lpk.dll
%ProgramFiles%\avgdiag\lpk.dll
%ProgramFiles%\avgemc\lpk.dll
%ProgramFiles%\avgfwsrv\lpk.dll
%ProgramFiles%\avginet\lpk.dll
%ProgramFiles%\avgnpdln\lpk.dll
%ProgramFiles%\avgnpsvc\lpk.dll
%ProgramFiles%\avgrssvc\lpk.dll
%ProgramFiles%\autotrace\lpk.dll
%ProgramFiles%\autodown\lpk.dll
%ProgramFiles%\avcenter\lpk.dll
%ProgramFiles%\autostartexplorer\lpk.dll
%ProgramFiles%\aswupdsv\lpk.dll
%ProgramFiles%\ashchest\lpk.dll
%ProgramFiles%\ashdug\lpk.dll
%ProgramFiles%\ashenhcd\lpk.dll
%ProgramFiles%\ashlogv\lpk.dll
%ProgramFiles%\ashmaisv\lpk.dll
%ProgramFiles%\ashpopwz\lpk.dll
%ProgramFiles%\ashquick\lpk.dll
%CommonProgramFiles%\microsoft shared\source engine\lpk.dll
%CommonProgramFiles%\microsoft shared\equation\lpk.dll
%ProgramFiles%\ashserv\lpk.dll
%ProgramFiles%\ashskpcc\lpk.dll
%ProgramFiles%\ashskpck\lpk.dll
%ProgramFiles%\ashupd\lpk.dll
%ProgramFiles%\ashwebsv\lpk.dll
%ProgramFiles%\ash_updatemediator\lpk.dll
%ProgramFiles%\aswregsvr\lpk.dll
%ProgramFiles%\ashdisp\lpk.dll
%ProgramFiles%\ashsimpl\lpk.dll
%CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll

Присваивает атрибут 'скрытый' для следующих файлов

<Имя диска съемного носителя>:\lpk.dll
%ProgramFiles%\bdswitch\lpk.dll
%ProgramFiles%\bdwizreg\lpk.dll
%ProgramFiles%\blackd\lpk.dll
%ProgramFiles%\blackice\lpk.dll
%ProgramFiles%\blindman\lpk.dll
%ProgramFiles%\bdsubmitwiz\lpk.dll
%ProgramFiles%\bdsurvey\lpk.dll
%ProgramFiles%\btini\lpk.dll
%ProgramFiles%\cafix\lpk.dll
%ProgramFiles%\cavapp\lpk.dll
%ProgramFiles%\cavasm\lpk.dll
%ProgramFiles%\cavaud\lpk.dll
%ProgramFiles%\cavemsrv\lpk.dll
%ProgramFiles%\btinint\lpk.dll
%ProgramFiles%\cabalmain\lpk.dll
%ProgramFiles%\bdsubmit\lpk.dll
%ProgramFiles%\bdss\lpk.dll
%ProgramFiles%\bdoesrv\lpk.dll
%ProgramFiles%\avinitnt\lpk.dll
%ProgramFiles%\avkserv\lpk.dll
%ProgramFiles%\avkservice\lpk.dll
%ProgramFiles%\avkwctl\lpk.dll
%ProgramFiles%\avnotify\lpk.dll
%ProgramFiles%\avpcc\lpk.dll
%ProgramFiles%\avgwizfw\lpk.dll
%ProgramFiles%\avpm\lpk.dll
%ProgramFiles%\avsynmgr\lpk.dll
%ProgramFiles%\b2\lpk.dll
%ProgramFiles%\backweb-4476822\lpk.dll
%ProgramFiles%\bdagent\lpk.dll
%ProgramFiles%\bdmcon\lpk.dll
%ProgramFiles%\bdnews\lpk.dll
%ProgramFiles%\avscan\lpk.dll
%ProgramFiles%\cavmr\lpk.dll
%ProgramFiles%\cavmud\lpk.dll
%ProgramFiles%\cavoar\lpk.dll
%ProgramFiles%\cavq\lpk.dll
%ProgramFiles%\claw95cf\lpk.dll
%ProgramFiles%\cleaner\lpk.dll
%ProgramFiles%\cleaner3\lpk.dll
%ProgramFiles%\clisvc\lpk.dll
%ProgramFiles%\clrcche\lpk.dll
%ProgramFiles%\cmain\lpk.dll
%ProgramFiles%\cmgrdian\lpk.dll
%CommonProgramFiles%\microsoft shared\dw\lpk.dll
%CommonProgramFiles%\microsoft shared\equation\lpk.dll
%CommonProgramFiles%\microsoft shared\ink\lpk.dll
%CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
%CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
%ProgramFiles%\claw95\lpk.dll
%ProgramFiles%\clamtray\lpk.dll
%ProgramFiles%\clamwin\lpk.dll
%ProgramFiles%\clamscan\lpk.dll
%ProgramFiles%\cavscons\lpk.dll
%ProgramFiles%\cavse\lpk.dll
%ProgramFiles%\cavsn\lpk.dll
%ProgramFiles%\cavsub\lpk.dll
%ProgramFiles%\cavsubmit\lpk.dll
%ProgramFiles%\cavumas\lpk.dll
%ProgramFiles%\cavuserupd\lpk.dll
%ProgramFiles%\cavvl\lpk.dll
%ProgramFiles%\ccapp\lpk.dll
%ProgramFiles%\ccevtmgr\lpk.dll
%ProgramFiles%\ccleaner\lpk.dll
%ProgramFiles%\ccproxy\lpk.dll
%ProgramFiles%\ccsetmgr\lpk.dll
%ProgramFiles%\cemrep\lpk.dll
%ProgramFiles%\chrome\lpk.dll
%CommonProgramFiles%\microsoft shared\source engine\lpk.dll
%ProgramFiles%\avgw\lpk.dll
%ProgramFiles%\avgvv\lpk.dll
%ProgramFiles%\avgupsvc\lpk.dll
%ProgramFiles%\aimpro\lpk.dll
%ProgramFiles%\airdefense\lpk.dll
%ProgramFiles%\almon\lpk.dll
%ProgramFiles%\alsvc\lpk.dll
%ProgramFiles%\amon\lpk.dll
%ProgramFiles%\ahnsd\lpk.dll
%ProgramFiles%\aim6\lpk.dll
%ProgramFiles%\amsn\lpk.dll
%ProgramFiles%\aoltbserver\lpk.dll
%ProgramFiles%\armor2net\lpk.dll
%ProgramFiles%\armorsurf\lpk.dll
%ProgramFiles%\ash\lpk.dll
%ProgramFiles%\ashavast\lpk.dll
%ProgramFiles%\anti-trojan\lpk.dll
%ProgramFiles%\antivirus\lpk.dll
%ProgramFiles%\ageofconan\lpk.dll
%ProgramFiles%\agb5\lpk.dll
%ProgramFiles%\admunch\lpk.dll
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
%ProgramFiles%\360tray\lpk.dll
%ProgramFiles%\a2cmd\lpk.dll
%ProgramFiles%\a2guard\lpk.dll
%ProgramFiles%\a2hijackfree\lpk.dll
C:\far2\lpk.dll
%ProgramFiles%\a2scan\lpk.dll
%ProgramFiles%\a2start\lpk.dll
%ProgramFiles%\a2upd\lpk.dll
%ProgramFiles%\a2wizard\lpk.dll
%ProgramFiles%\aavshield\lpk.dll
%ProgramFiles%\about\lpk.dll
%ProgramFiles%\ackwin32\lpk.dll
%ProgramFiles%\a2service\lpk.dll
%ProgramFiles%\ashavsrv\lpk.dll
%ProgramFiles%\ashchest\lpk.dll
%ProgramFiles%\ashdisp\lpk.dll
%ProgramFiles%\ashdug\lpk.dll
%ProgramFiles%\avcenter\lpk.dll
%ProgramFiles%\avciman\lpk.dll
%ProgramFiles%\avcmd\lpk.dll
%ProgramFiles%\avconfig\lpk.dll
%ProgramFiles%\avconsol\lpk.dll
%ProgramFiles%\avgamsvr\lpk.dll
%ProgramFiles%\avgcc\lpk.dll
%ProgramFiles%\avgdiag\lpk.dll
%ProgramFiles%\avgemc\lpk.dll
%ProgramFiles%\avgfwsrv\lpk.dll
%ProgramFiles%\avginet\lpk.dll
%ProgramFiles%\avgnpdln\lpk.dll
%ProgramFiles%\avgnpsvc\lpk.dll
%ProgramFiles%\avgrssvc\lpk.dll
%ProgramFiles%\avgscan\lpk.dll
%ProgramFiles%\avadmin\lpk.dll
%ProgramFiles%\autostartexplorer\lpk.dll
%ProgramFiles%\autotrace\lpk.dll
%ProgramFiles%\autodown\lpk.dll
%ProgramFiles%\ashenhcd\lpk.dll
%ProgramFiles%\ashlogv\lpk.dll
%ProgramFiles%\ashmaisv\lpk.dll
%ProgramFiles%\ashpopwz\lpk.dll
%ProgramFiles%\ashquick\lpk.dll
%ProgramFiles%\ashserv\lpk.dll
%ProgramFiles%\ashsimp2\lpk.dll
%ProgramFiles%\ashsimpl\lpk.dll
%ProgramFiles%\ashskpcc\lpk.dll
%ProgramFiles%\ashskpck\lpk.dll
%ProgramFiles%\ashupd\lpk.dll
%ProgramFiles%\ashwebsv\lpk.dll
%ProgramFiles%\ash_updatemediator\lpk.dll
%ProgramFiles%\aswregsvr\lpk.dll
%ProgramFiles%\aswupdsv\lpk.dll
%ProgramFiles%\avgupden\lpk.dll
%CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll

Перемещает следующие файлы

%TEMP%\hrl25f8.tmp в %TEMP%\software.log
C:\rcx2c51.tmp в %WINDIR%\syswow64\hra33.dll

Сетевая активность

UDP

DNS ASK do####6.3322.org

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\hrl25f8.tmp'
'%WINDIR%\syswow64\duzjuc.exe'
'%TEMP%\hrl25f8.tmp' ' (со скрытым окном)
'%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /t' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Имя диска съемного носителя>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"' (со скрытым окном)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Имя диска съемного носителя>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"' (со скрытым окном)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Имя диска съемного носителя>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA9A8.tmp"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Имя диска съемного носителя>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"' (со скрытым окном)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Имя диска съемного носителя>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"' (со скрытым окном)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Имя диска съемного носителя>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Имя диска съемного носителя>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Имя диска съемного носителя>:\calculatorworksheet.zip" lpk.dll
'%WINDIR%\syswow64\find.exe' /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' x "<Имя диска съемного носителя>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Имя диска съемного носителя>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"
'%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA9A8.tmp"
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Имя диска съемного носителя>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Имя диска съемного носителя>:\removedtitles_records.zip" lpk.dll
'%ProgramFiles%\WinRAR\Rar.exe' x "<Имя диска съемного носителя>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Имя диска съемного носителя>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней