Trojan.DownLoader30.31465

Техническая информация

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\svchost.exe

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%:.repos

Сетевая активность

Подключается к

'rs####.##1-dk.mailanyone.net':25
'mt##.##0.yahoodns.net':25

TCP

Запросы HTTP GET

http://www.google.com/

UDP

DNS ASK microsoft.com
DNS ASK pa###arget.com
DNS ASK le##ns.com
DNS ASK ms##.tcnoc.com
DNS ASK ya##o.co.jp
DNS ASK mx#.###l.yahoo.co.jp
DNS ASK tt##wi.com
DNS ASK mi####nsultores.cl
DNS ASK wi##is.com
DNS ASK mx#######c02.gslb.pphosted.com
DNS ASK ar#######.theemaillaundry.net
DNS ASK mx#.##il-scanner.eu
DNS ASK do####shaftseal.com
DNS ASK un##eld.com
DNS ASK ma##.#niweld.com
DNS ASK do###talia.com
DNS ASK ma##.#omaitalia.com
DNS ASK in###woven.com
DNS ASK cu#####1.interwoven.com
DNS ASK vi##ilio.it
DNS ASK sm####n.virgilio.it
DNS ASK le#####assurances.com
DNS ASK mu####roposito.com
DNS ASK ma##.#ailerhost.net
DNS ASK mx#.##ailsrvr.com
DNS ASK le##stro.fr
DNS ASK mx##.#uphonynet.be
DNS ASK ja######rencecompany.com
DNS ASK sm##.##cureserver.net
DNS ASK ja#####evalentine.com
DNS ASK ja#####vinstudios.com
DNS ASK mx#.##tsolmail.net
DNS ASK ja###lhaner.com
DNS ASK ja####iebherr.com
DNS ASK ja###light.tv
DNS ASK mx##.#and1.co.uk
DNS ASK ha##ail.net
DNS ASK le##.net
DNS ASK mx#.#anmail.net
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK cr#####razycritters.com
DNS ASK le###dex.com
DNS ASK ya##o.fr
DNS ASK eb####ineers.com
DNS ASK ma##.##lengineers.com
DNS ASK ro###tmail.com
DNS ASK ms#.#inet.net
DNS ASK ms#####p-mx1.hinet.net
DNS ASK eu###nynet.be
DNS ASK ya##o.de
DNS ASK li#e.de
DNS ASK hy##em.com
DNS ASK we#####southernlife.com
DNS ASK ya##o.co.in
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK ma##.#28sign.com
DNS ASK zu##ch.com
DNS ASK la#####ercomunicare.it
DNS ASK ma##.###etepercomunicare.it
DNS ASK su###thq.com
DNS ASK sk###den.com
DNS ASK kp.org
DNS ASK kc###ture.com
DNS ASK im###tsci.com
DNS ASK mx#######703.gslb.pphosted.com
DNS ASK ma####.#ntercloud.com.bd
DNS ASK an####onsinc.com
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK te##s.net
DNS ASK mx.##lus.net
DNS ASK st###o36.co.za
DNS ASK ma##.#tudio36.co.za
DNS ASK yo####-optical.com
DNS ASK dg######.yorkey-optical.com
DNS ASK ed###n-bd.com
DNS ASK ip##fo.io
DNS ASK om###el.net.om
DNS ASK d8#####.##s.barracudanetworks.com
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK mx#.#sfgrp.com
DNS ASK al###ost.com
DNS ASK mx##.1and1.com
DNS ASK ca####chemicals.com
DNS ASK jo###goal.org
DNS ASK gr###-ellis.com
DNS ASK mx#######602.gslb.pphosted.com
DNS ASK in###ouise.com
DNS ASK is##t.com
DNS ASK mx#.##antel.net.om
DNS ASK mx######b3401.pphosted.com
DNS ASK mx#.###.#ailpod2-cph3.one.com
DNS ASK nz.###erlimited.com
DNS ASK mx#.##curemx.biz
DNS ASK jw###ness.info
DNS ASK sh##ail.com
DNS ASK go####nbroker.ro
DNS ASK tv###nline.com
DNS ASK mx#.##18online.com
DNS ASK ku##.edu
DNS ASK at#####n-dancers.com
DNS ASK re####ct.ovh.net
DNS ASK co###rvcare.net
DNS ASK fo###undinn.com
DNS ASK li#e.fr
DNS ASK la########m.mx1-dk.mailanyone.net
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK km###.mail.yale.edu
DNS ASK ns#.#trayer.edu
DNS ASK ph####s.brown.edu
DNS ASK sn####.#ervices.brown.edu
DNS ASK ho##ail.de
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK ps###.uic.edu
DNS ASK ma##.#sych.uic.edu
DNS ASK lg###tp.lge.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK lg#.com
DNS ASK ri#####ter.mnscu.edu
DNS ASK br###.uccs.edu
DNS ASK es##.com.vn
DNS ASK ma##.weber.edu
DNS ASK aspmx.l.google.com
DNS ASK ja##den.no
DNS ASK sa######.email.dupont.com
DNS ASK hi##lda.no
DNS ASK gm##l.com
DNS ASK na######.email.dupont.com
DNS ASK ne###gsg.com
DNS ASK mx#######d02.gslb.pphosted.com
DNS ASK go###email.com
DNS ASK ep#####ser.online.no
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK ho##ail.com
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK ma##.atu.edu
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK es#n.dk
DNS ASK alt1.gmail-smtp-in.l.google.com
DNS ASK ko##lett.no
DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK on##ne.no
DNS ASK hk.####n.herominers.com
DNS ASK mx.##line.no
DNS ASK ho###il.co.nz
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK ko##a.com
DNS ASK r-####6.korea.com
DNS ASK ya##o.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK ce##er.no
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK wm##air.com
DNS ASK ko#########.mail.protection.outlook.com
DNS ASK xs#####851w.sanofi.com
DNS ASK ma#####t.alorica.com
DNS ASK li#e.it
DNS ASK th####ngruppen.no
DNS ASK gw#.####rity.comendo.com
DNS ASK es#.net
DNS ASK es#####.##il.protection.outlook.com
DNS ASK google.com
DNS ASK mo####e11.nsc.no
DNS ASK sa####-aventis.com
DNS ASK cl######.us.messagelabs.com
DNS ASK nc###oup.com
DNS ASK mo###ce8.nsc.no
DNS ASK fr##urf.no
DNS ASK mx.##isurf.no
DNS ASK ms#.com
DNS ASK vi########er.fra02.hls.ttvnw.net
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK fo##ound.de
DNS ASK mx##.##ndenserver.de
DNS ASK qx#.no
DNS ASK am.#um.no
DNS ASK st##.nhh.no
DNS ASK ma###w01.nhh.no
DNS ASK er.##.skjonnhet.no
DNS ASK mp##sis.com
DNS ASK rw##.umdnj.edu
DNS ASK ma###.wesleyan.edu
DNS ASK mx####.email.dupont.com
DNS ASK du####powder.com
DNS ASK ma##.##pontpowder.com
DNS ASK lo##0.com
DNS ASK mx#.######deempresas.telefonica.es
DNS ASK ha###burton.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK ma##.umd.edu
DNS ASK mx#.##d.iphmx.com
DNS ASK we###yan.edu
DNS ASK li###s-elec.com
DNS ASK ge####erlogix.com
DNS ASK th#####elinetwork.com
DNS ASK mx###.in-mx.net
DNS ASK ww#.edu
DNS ASK l-####allier.com
DNS ASK fd#.edu
DNS ASK ALT1.ASPMX.L.GOOGLE.COM
DNS ASK ai#.com
DNS ASK am####04.aig.com
DNS ASK ns##rch.com
DNS ASK au####dyworld.com
DNS ASK rs#.no
DNS ASK rs####.##1-dk.mailanyone.net

Другое

Запускает на исполнение

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Полный путь к файлу>"
'%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k