Trojan.DownLoader46.57723

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Сетевая активность

Подключается к

'ta####r.rozblog.com':443
'be##.#aprila.com':443
'we##ozar.ir':80
'ta##az.ir':443
'be###ote.com':443
'ir##naz.com':443
'sh##af.ir':80
'ta##az.ir':80
'be###ote.com':80
'ax##g.com':80
'ir##naz.com':80
'gr###tar.com':443
'gr###tar.com':80
'ro##p.ir':443
'up.##zahor.ir':443
'ta#####.mihanstore.net':443
'up.##zahor.ir':80
'ta#####.mihanstore.net':80
'x1.#.lencr.org':80
'microsoft.com':80

TCP

Запросы HTTP GET

http://ta#####.mihanstore.net/partner/show_ads.php?ad##########################################################
http://up.##zahor.ir/up/tazahor/Pictures/111.jpg
http://up.##zahor.ir/up/tazahor/Pictures/333.png
http://up.##zahor.ir/up/tazahor/Pictures/AsMa.gif
http://up.##zahor.ir/up/tazahor/Pictures/0.206508001318690964_parsnaz_ir.jpg
http://up.##zahor.ir/up/tazahor/Pictures/69070_122.jpg
http://up.##zahor.ir/up/tazahor/Pictures/0.9.1.7.7.0.3.7.2347971.5gif
http://up.##zahor.ir/up/tazahor/Pictures/123321.jpg
http://www.we##ozar.ir/c.aspx?Co####################
http://up.##zahor.ir/up/tazahor/Pictures/dq24.gif
http://up.##zahor.ir/up/tazahor/Pictures/0.9.1.7.7.0.3.7.2.5gif
http://up.##zahor.ir/up/tazahor/Pictures/Z5.jpg
http://up.##zahor.ir/up/tazahor/Pictures/index.jpeg
http://up.##zahor.ir/up/tazahor/Pictures/647647_607.jpg
http://up.##zahor.ir/up/tazahor/Pictures/65753_430.jpg
http://up.##zahor.ir/up/tazahor/Pictures/550657486-parsnaz-ir.jpg
http://up.##zahor.ir/up/tazahor/Pictures/L130904908373.jpg
http://en####.webgozar.ir/counter/xstat.aspx?t=###############################################################################################################################
http://www.we###zar.com/counter/pic/stat5.gif
http://up.##zahor.ir/up/tazahor/Pictures/Untitled-1866552.jpg
http://up.##zahor.ir/up/tazahor/Pictures/224246-270x180.jpg
http://up.##zahor.ir/up/tazahor/Pictures/1260434282.jpg
http://up.##zahor.ir/up/tazahor/Pictures/dfdfdf.jpg
http://up.##zahor.ir/up/tazahor/Pictures/865810_526.jpg
http://up.##zahor.ir/up/tazahor/Pictures/images314838.jpeg
http://up.##zahor.ir/up/tazahor/Pictures/L140029066714.jpg
http://up.##zahor.ir/up/tazahor/Pictures/bazdidsaz2.jpg
http://up.##zahor.ir/up/tazahor/Pictures/800203364.jpg
http://www.gr###tar.com/avatar/2ffa37038badadaf78ad4c7e1ed661ed?d=#####
http://up.##zahor.ir/up/tazahor/Pictures/avatar2175_31.gif
http://www.ir##naz.com/user_files/image/image39/0.907337001322695509_irannaz_com.jpg
http://www.ir##naz.com/user_files/L13153686559.jpg
http://ax##g.com/images/35157911348390356977.jpg
http://www.be###ote.com/images/stories/fun/fu1909.jpg
http://www.be###ote.com/images/stories/fun/fun793-1.jpg
http://ta##az.ir/upload/73/0.620492001354969432_taknaz_ir.jpg
http://www.ta##az.ir/user_files/L131529925553.jpg
http://up.##zahor.ir/up/tazahor/Pictures/dq24856453.gif
http://www.ta##az.ir/upload/87/0.923192001396050472_taknaz.jpg
http://up.##zahor.ir/up/tazahor/Pictures/221523639.jpg
http://up.##zahor.ir/up/tazahor/Pictures/111807115.jpg
http://up.##zahor.ir/up/tazahor/Pictures/1706503463.jpg
http://up.##zahor.ir/up/tazahor/Pictures/1562899991.jpg
http://up.##zahor.ir/up/tazahor/Pictures/L140557899933.jpg
http://up.##zahor.ir/up/tazahor/Pictures/0.306250001406448225_taknaz.png
http://up.##zahor.ir/up/tazahor/Pictures/142318948-parsnaz-ir.jpg
http://up.##zahor.ir/up/tazahor/Pictures/wwesswwww.jpeg
http://up.##zahor.ir/up/tazahor/Pictures/FunShad.Com-20100117-3b3dbaf68507998acd6a5a5254ab2d76.jpg
http://up.##zahor.ir/up/tazahor/Pictures/1158994231-parsnaz-ir.jpg
http://up.##zahor.ir/up/tazahor/Pictures/sms-khandedar-azar-93.png
http://x1.#.lencr.org/
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt