Trojan.Hosts.51712

Техническая информация

Вредоносные функции

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'Regmonclass', WindowName: ''
ClassName: 'Filemonclass', WindowName: ''

Изменения в файловой системе

Создает следующие файлы

%TEMP%\se52a2.tmp
%TEMP%\903b.exe
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat

Удаляет следующие файлы

%TEMP%\se52a2.tmp

Изменяет файл HOSTS.

Сетевая активность

Подключается к

'ba##u.com':80
'ia.#1.la':80
'r3.#.lencr.org':80
'oc##.##ctigochina.com':80
'x1.#.lencr.org':80
'sd#.51.la':443
'pk#.goog':80
'sd#.51.la':80
'tu###duusuu.top':443
'tt##tp4.com':443
'tt##tp2.com':443
'sm##.app':443
'on####o.ssrcdn.com':443
'10#.#48.132.242':80
'mr###s03.com':443
'im####.baidu.com':443
'im#.##selofm.xyz':443
'js.##ers.51.la':443
'ps#.##static.com':443
'ps#####c.cdn.bcebos.com':443
'19#.#.195.135':80
'dn##45.com':80
'59##s.com':80
'bf#.qqkj.cn':80
'co####t-v6.51.la':80
'microsoft.com':80

TCP

Запросы HTTP GET

http://www.ba##u.com/s?wd###################################
http://10#.#48.132.242/js/TP/tp44.gif
http://19#.#.195.135/js/tp/tp6.gif
http://19#.#.195.135/js/tp/tp4.gif
http://19#.#.195.135/js/tp/tp5.gif
http://19#.#.195.135/js/tp/tp7.gif
http://19#.#.195.135/js/tp/tp8.gif
http://ns####k.baidu.com/v.gif?pi################################################################################################################################################################...
http://www.59##s.com/template/m1938/css/zui.css
http://sd#.51.la/js-sdk-pro.min.js
http://ap#.##are.baidu.com/s.gif?l=######################
http://x1.#.lencr.org/
http://oc##.##ctigochina.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR28ifac5%2BKWaDJG947H06fyWfYAgQU3z1IB2b54JFbeLGq1zxZMBc7TYUCEGJQt1%2BPJbAoxNiIUsnLORM%3D
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQPrprk0z0aEJnOkVsAQFhHhQ%3D%3D
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMRx3QaZpwj1z%2Fwd8J0n0KVDA%3D%3D
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPz83jSVTjbHNcbJRZGQXBN1w%3D%3D
http://ia.#1.la/go1?id###########################################################################################################################################################################...
http://19#.#.195.135/js/tp/tp3.gif
http://10#.#48.132.242/js/TP/hot.gif
http://19#.#.195.135/js/tp/tp2.gif
http://www.ba##u.com/img/flexible/logo/pc/peak-result.png
http://www.ba##u.com/img/flexible/logo/pc/result@2.png
http://bf#.qqkj.cn/shipinbofangqi/spbfq.swf?id##
http://www.dn##45.com/
http://www.dn##45.com/tj.js
http://www.59##s.com/template/m1938/css/ate.css
http://www.dn##45.com/common.js
http://19#.#.195.135/js/HF.js
http://19#.#.195.135/js/LM.js
http://co####t-v6.51.la/v6/collect?dt############################################################################################################################################################...
http://pk#.goog/gsr1/gsr1.crt
http://19#.#.195.135/js/WZ.js
http://19#.#.195.135/js/SPK.js
http://m.##idu.com/se/static/font/cicon.eot?t=#############
http://www.59##s.com/template/m1938/fonts/iconfont.eot')%20format('embedded-opentype'),url('../fonts/iconfont.woff')%20format('woff'),url('../fonts/iconfont.ttf')%20format('truetype'),%20url('....
http://19#.#.195.135/js/tp/JS.png
http://www.ba##u.com/img/bd_logo1.png
http://pu##.###nzhang.baidu.com/push.js
http://www.ba##u.com/img/flexible/logo/pc/result.png
http://www.59##s.com/
http://19#.#.195.135/js/XTB.js
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt