Trojan.KillFiles.64416

Техническая информация

Для обеспечения автозапуска и распространения

Изменяет следующие исполняемые системные файлы

<SYSTEM32>\comctl32.ocx
<SYSTEM32>\comdlg32.ocx
<SYSTEM32>\msinet.ocx

Изменения в файловой системе

Создает следующие файлы

<DRIVERS>\etc\hosts.ics

Удаляет следующие файлы

<DRIVERS>\etc\hosts

Подменяет файл HOSTS.

Сетевая активность

Подключается к

'ss#####q6bib.s.adsco.re':443

TCP

Запросы HTTP GET

http://ci#####iss.blogspot.com/
http://4.##.#logspot.com/-B1N0s6e1Y90/WaUvFDHMc7I/AAAAAAAADuo/5L4qayXHNiAWVAgZhTRhJ7S2VSAL-E-3QCK4BGAYYCw/s400/128%2B%25281%2529.jpg
http://do##hen.com/fac.php
http://4.##.#logspot.com/-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png
http://3.##.#logspot.com/-3ypydr9U3DI/U9DHOBQy-vI/AAAAAAAAAbs/hvhfDPIpevI/s1600/share.png
http://3.##.#logspot.com/-3UcLXxRcetg/WaTYDnjaJbI/AAAAAAAADt0/LL7OaZTjsE4hTzpKkm-Jj55c8JI4SZBhQCK4BGAYYCw/s1600/head-back.jpg
http://4.##.#logspot.com/-U2FiDOW13h8/WaUuGbhbUpI/AAAAAAAADuQ/-tZACcQo3hYxUbXIe30RUfEMtIInpeiHACK4BGAYYCw/s1600/header-mask.png
http://4.##.#logspot.com/-Tev2WNGyFs8/WaUuh31ZVRI/AAAAAAAADuY/5D9_uZ3rgrY9cVKC46DXxPMlXlxCOmB4gCK4BGAYYCw/s1600/sg-back.jpg
http://my.##mark.net/img.gif?f=#############################################
http://fo###.gstatic.com/s/righteous/v8/1cXxaUPXBpj2rGoU7C9WiHGD.woff
http://www.ci###atis.com/js/cookienotice.js
http://fo###.gstatic.com/s/montserrat/v14/JTUSjIg1_i6t8kCHKm459WlhzQ.woff
http://fo###.gstatic.com/s/playfairdisplay/v15/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYhg.woff
http://fo###.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_dJE3gnD-A.woff
http://fo###.gstatic.com/s/playfairdisplay/v15/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lW4e4A.woff
http://fo###.gstatic.com/s/playfairdisplay/v15/nuFkD-vYSZviVYUb_rj3ij__anPXDTnogkk9.woff
http://pe#######n-cits.blogspot.com/2015/09/undefined
http://www.bl##ger.com/comment-iframe.g?bl############################################################################
http://c1.##pads.net/pop.js
http://www.bl##ger.com/comment-iframe.g?bl###################################################################################
http://c.##sco.re/
http://1.##.#logspot.com/-lS8BCMfild4/WaUv1I0ZzxI/AAAAAAAADvI/TRbkU8DD6qAMXTEciXxlZXakbMGB29xWQCK4BGAYYCw/s1600/team_2.jpg
http://3.##.#logspot.com/-NN3Axwd3gjc/WaUv1CODCDI/AAAAAAAADvE/vyiHmT0rl98F-ZTqYB0xmst60IHuVFmxQCK4BGAYYCw/s1600/team_3.jpg
http://1.##.#logspot.com/-P1UCUBWGCMU/WaUv1CxF6kI/AAAAAAAADvM/aOSCRX-UHAwKF8EFs20fqryoqDNa3DJQwCK4BGAYYCw/s1600/team_1.jpg
http://1.##.#logspot.com/--AljITWu1is/WaUvSgSDbEI/AAAAAAAADuw/5FZ7WobSdtAVINLVQT3qpCSktRNlDA23gCK4BGAYYCw/s400/128.jpg
http://1.##.#logspot.com/-zjRQwZusQuA/WaUu4AM9p_I/AAAAAAAADug/68l5-04iSWoVMAkpi8iQGM430fUYKAzdACK4BGAYYCw/s400/128.jpg
http://pe#######n-cits.blogspot.com/2015/09/error-file.html
http://www.ci###atis.com/
http://www.ci####alongan.com/
http://ma####.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
http://pe#######n-cits.blogspot.com/feeds/posts/default/-/Error%20File?al#########################################################
http://pe#######n-cits.blogspot.com/js/cookienotice.js
http://pe#######n-cits.blogspot.com/favicon.ico
http://ma####.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
http://www.ci####alongan.com/js/cookienotice.js
http://6.##sco.re/
http://ma####.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff?v=#####
http://www.ci####alongan.com/favicon.ico
http://pl######97.puserving.com/0c/eb/c2/0cebc208e531c6b4761e5d1bb6afa0d0.js
http://pu###est.com/ntfc.php?p=#######
http://go.##btrks.com/notice.php?p=######################
http://fo###.#oogleapis.com/css?fa#####################################################################################
http://2.##.#logspot.com/-eXDzvmiaYcc/VktrFQnAsPI/AAAAAAAAGJQ/ECTgSNQKlzs/s1600/siminihome.png
http://do##hen.com/apu.php?zo############
http://cd#.##nearicons.com/free/1.0.0/icon-font.min.css
http://www.ci###atis.com/favicon.ico
http://1.##.#logspot.com/-5aYbXTaUxvU/WaUpd8qmbfI/AAAAAAAADuE/SzqpbJ8DJkM8tEF1S-PNYPL0Gx6oaMmjwCK4BGAYYCw/s1600/Basil.png
http://ci######ongans.blogspot.com/
http://aj##.#oogleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
http://se###.popads.net/c?_=#####################################################################################################################################################################...

Запросы HTTP POST

http://ad##o.re/t
http://ad##o.re/p

UDP

DNS ASK ci#####iss.blogspot.com
DNS ASK fo###.gstatic.com
DNS ASK my.##mark.net
DNS ASK st#####x.facebook.com
DNS ASK c1.##pads.net
DNS ASK fa###ook.com
DNS ASK 3.##.#logspot.com
DNS ASK re#####es.blogblog.com
DNS ASK accounts.google.com
DNS ASK ad##o.re
DNS ASK google.com
DNS ASK 6.##sco.re
DNS ASK ss#####q6bib.l.adsco.re
DNS ASK ss#####q6bib.n.adsco.re
DNS ASK sc#######amt2-1.xx.fbcdn.net
DNS ASK c.##sco.re
DNS ASK 4.##.#logspot.com
DNS ASK co#####.facebook.net
DNS ASK 1.##.#logspot.com
DNS ASK pe#######n-cits.blogspot.com
DNS ASK ci###atis.com
DNS ASK ci####alongan.com
DNS ASK bl##ger.com
DNS ASK ma####.bootstrapcdn.com
DNS ASK aj##.#oogleapis.com
DNS ASK ci######ongans.blogspot.com
DNS ASK pl######97.puserving.com
DNS ASK pu###est.com
DNS ASK go.##btrks.com
DNS ASK fo###.#oogleapis.com
DNS ASK cd#.##nearicons.com
DNS ASK 2.##.#logspot.com
DNS ASK do##hen.com
DNS ASK fi#######torage.googleapis.com
DNS ASK ss#####q6bib.s.adsco.re
DNS ASK se###.popads.net

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset
'<SYSTEM32>\icacls.exe' <DRIVERS>\etc\hosts /reset
'<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset
'<SYSTEM32>\icacls.exe' <DRIVERS>\etc\hosts.ics /reset
'%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ci######ongans.blogspot.com/"
'%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ci#####iss.blogspot.com/"
'%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://pe#######n-cits.blogspot.com/2015/09/error-file.html"