Trojan.PWS.Panda.5118

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\lm-ldwkclalbc-gocn-earq-srgj-mrpfonfrnswp-badgux-vpipteyqgtqzqr-xyptdg-nhkb-ixst-btkf-ohysarkfzr-[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\oahjyqybtisddnxosyjliiykzo-ykvnfyclnaqjla-dwdh-yeoy-sdqspfalnnndoaxiuyqsxjyt-cnxign-ohzhcr[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\rn-ndgkjkppphacuyhtllakcdigtfpb-ofnm-fttwzjlmdnclgtkooaif-tuxy-ouiqtuvnqcdheabizmiirk-cuat[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ey-vibfiqfzcjynspldpbfpqudrfcrolzyb-htpmvnjucjybju-atsd-ykej-elcodhnnuqdi-rqqtgtvyoxyquakd[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\fcgt-dhxs-dknqza-jplmduygvyit-jzgjlm-nhpv-ravqdmeyviushjtfxvxjneldkboaipxlyvqs-xocjynlijukk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ptptptpt-ptpt-ptpt-heatpaalbioufrfrjt-dmjh-dwarxynmzr-vqkq-wphe-aton-zvcuqtnhne-htuq-vlyxphzjey[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\vy-vlcuopvkdgksbajkoydn-xqqkjv-gbhcxfgxcgpi-twjukojvrc-eyybouqura-tijw-wbwpphonjteadgamzhjk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\fp-lgsn-cexczj-ddonne-nnxx-pmjwyq-gbpa-nslxii-ppnm-lgysvanaix-ihrc-abyk-rgux-ixjlexrkmxzo-fckg-dice-[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rzprxtgxtyebmsqtgs-jtqr-usgl-jpdg-mpnd-dmnqruzaixroqsqjkfix-vnel-iila-atow-pyyk-eawk-dastft-ukqj-[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kort-iouu-lmldwkcldwpm-ebfceacrltbq-ppgnrqmvnhfa-pmam-iggojpcljzbt-glks-qrneqcvkjpnlxslgxsna[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\clalbcgocnpmez-eaxvdujtldukdilmtwusdnlmxc-acey-nlrglilzua-ppnecl-dfld-qpxqfpksqsnhpr-mxxxjv-[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ifejdapljvzvyxpatw-osez-yscn-zodmmyspzv-ohxvkk-qznnppshrild-uojk-dahe-ateb-bhsn-kkmsvlbcukmxyj[1].html

Сетевая активность:

Подключается к:

'aq####r.xxuz.com':80
'an#####glychoosing.in':80
'ac####espretty.us':80

TCP:

Запросы HTTP GET:

aq####r.xxuz.com/questions/lm-ldwkclalbc-gocn-earq-srgj-mrpfonfrnswp-badgux-vpipteyqgtqzqr-xyptdg-nhkb-ixst-btkf-ohysarkfzr-.html
an#####glychoosing.in/tgp/oahjyqybtisddnxosyjliiykzo-ykvnfyclnaqjla-dwdh-yeoy-sdqspfalnnndoaxiuyqsxjyt-cnxign-ohzhcr.php
ac####espretty.us/post/rn-ndgkjkppphacuyhtllakcdigtfpb-ofnm-fttwzjlmdnclgtkooaif-tuxy-ouiqtuvnqcdheabizmiirk-cuat.html
aq####r.xxuz.com/o/ey-vibfiqfzcjynspldpbfpqudrfcrolzyb-htpmvnjucjybju-atsd-ykej-elcodhnnuqdi-rqqtgtvyoxyquakd.php
an#####glychoosing.in/tgp/fcgt-dhxs-dknqza-jplmduygvyit-jzgjlm-nhpv-ravqdmeyviushjtfxvxjneldkboaipxlyvqs-xocjynlijukk.php
ac####espretty.us/o/ptptptpt-ptpt-ptpt-heatpaalbioufrfrjt-dmjh-dwarxynmzr-vqkq-wphe-aton-zvcuqtnhne-htuq-vlyxphzjey.php
aq####r.xxuz.com/questions/ifejdapljvzvyxpatw-osez-yscn-zodmmyspzv-ohxvkk-qznnppshrild-uojk-dahe-ateb-bhsn-kkmsvlbcukmxyj.html
an#####glychoosing.in/post/fp-lgsn-cexczj-ddonne-nnxx-pmjwyq-gbpa-nslxii-ppnm-lgysvanaix-ihrc-abyk-rgux-ixjlexrkmxzo-fckg-dice-.html
ac####espretty.us/post/rzprxtgxtyebmsqtgs-jtqr-usgl-jpdg-mpnd-dmnqruzaixroqsqjkfix-vnel-iila-atow-pyyk-eawk-dastft-ukqj-.html
aq####r.xxuz.com/tgp/vy-vlcuopvkdgksbajkoydn-xqqkjv-gbhcxfgxcgpi-twjukojvrc-eyybouqura-tijw-wbwpphonjteadgamzhjk.php
an#####glychoosing.in/post/kort-iouu-lmldwkcldwpm-ebfceacrltbq-ppgnrqmvnhfa-pmam-iggojpcljzbt-glks-qrneqcvkjpnlxslgxsna.html
ac####espretty.us/questions/clalbcgocnpmez-eaxvdujtldukdilmtwusdnlmxc-acey-nlrglilzua-ppnecl-dfld-qpxqfpksqsnhpr-mxxxjv-.html