Trojan.PWS.Banker1.12279

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wg-rglz-lipb-uxmpfm-pvsinmdkdnvl-dubfcorpbibi-qkyvxsejkofcjp-nshj-lmjx-kfnaohphlzqrrczhkkcepl[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\vi-bfiq-fzcjynspgbrndnabxc-vlejqn-ukzn-spclii-osbawpvnofmy-ejzr-vqcqqs-gtfy-ifiowbspcdkgftzamy-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pb-uxmp-fmgn-ltblcr-vlxl-biowpy-twgaclegvnsrza-yvro-jwcnxjjusdblrnvyllvk-xftmqn-dnjhqncbjz-tsdn[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cb-kydftm-ysgl-gajzsdtwrnzv-gays-orfqouukfanl-owawxsjhcnxj-egow-amqcixgdbiou-fzsd-nnpquapyosgk[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\jpfcgtdhxsdknqzadmuqxj-pbgo-zvgjzrehpz-aulico-dgkd-zasdpzqrabonqj-pqjvrkbtehuytmybzawi-pfwk-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\kort-iouu-lmldwk-cldw-pmeb-fcea-crlt-bqpp-gnrq-mvnhfa-pmam-igar-teauqnyxjkri-htne-qcvkjpnlxslgxs-na[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\nqzajpfcgtdhxsdkbalmohelfvtfcj-yvtwab-vqex-yhzrdkvpmrbw-xixi-mxcd-gtzo-kftsdruovkltnahepagx[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\st-zhru-btoa-hjyq-ybey-ifxfblkyzhgdeargfp-papbvk-gayjvlliru-ejyjxx-mvky-allmvlynsnwi-oxyhcltune[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\crkgoxpydrrczrxqcejtnwzm-jkwf-arusihwbofbf-yjnmjprtybcjxoyn-ampiwiihfp-plsynw-fapmmvtyvkdr-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\xocqpiqj-teitqukqejcoxtyjftcaybpvondkclnwxpau-ndrp-tspp-uqftjpfpamlizrbwyn-ofjk-uoznawkgqz[1].php
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xqehat-rzpr-xtgxtyuunadate-pidi-qjbfosxqcu-bwxvgj-qzdarqaruafpzmsu-egxpvarcsdptoecayeoexigx[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xi-oyxioy-xioy-xioy-raaw-lijt-wbdm-iikk-hcxtvnehlafqpt-gxdixcvksrgneh-twwpgnusgt-dggsohamtf-tsqc[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uxmp-fmgnltblcrkgdhgtgd-xywpdiybjhlzvl-gjzo-card-caqjky-jxmr-egdfuqdaqjlg-ftky-twmr-glzv-fvey-nl[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pbuxmpfmgnltblcr-vlxlbiowpy-twga-cleg-vnsrzayvrojwcnxjju-sdbl-rnvyll-vkxf-tmqn-dnjh-qncbjztsdn[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fquobihckk-rqsh-gswppbrzoryvnefy-ruyjnd-igrc-xqelgt-pmxvtiauynxfytvpofplzrytamjxdnnsiovkpv-[1].php

Сетевая активность:

Подключается к:

'as##.xxuz.com':80
'sw####erorbitz.biz':80
'me#####sterunsaved.us':80

TCP:

Запросы HTTP GET:

sw####erorbitz.biz/tgp/vi-bfiq-fzcjynspgbrndnabxc-vlejqn-ukzn-spclii-osbawpvnofmy-ejzr-vqcqqs-gtfy-ifiowbspcdkgftzamy-.php
me#####sterunsaved.us/post/wg-rglz-lipb-uxmpfm-pvsinmdkdnvl-dubfcorpbibi-qkyvxsejkofcjp-nshj-lmjx-kfnaohphlzqrrczhkkcepl.html
as##.xxuz.com/o/cb-kydftm-ysgl-gajzsdtwrnzv-gays-orfqouukfanl-owawxsjhcnxj-egow-amqcixgdbiou-fzsd-nnpquapyosgk.php
as##.xxuz.com/tgp/nqzajpfcgtdhxsdkbalmohelfvtfcj-yvtwab-vqex-yhzrdkvpmrbw-xixi-mxcd-gtzo-kftsdruovkltnahepagx.php
as##.xxuz.com/questions/kort-iouu-lmldwk-cldw-pmeb-fcea-crlt-bqpp-gnrq-mvnhfa-pmam-igar-teauqnyxjkri-htne-qcvkjpnlxslgxs-na.html
sw####erorbitz.biz/tgp/jpfcgtdhxsdknqzadmuqxj-pbgo-zvgjzrehpz-aulico-dgkd-zasdpzqrabonqj-pqjvrkbtehuytmybzawi-pfwk-.php
me#####sterunsaved.us/o/st-zhru-btoa-hjyq-ybey-ifxfblkyzhgdeargfp-papbvk-gayjvlliru-ejyjxx-mvky-allmvlynsnwi-oxyhcltune.php
sw####erorbitz.biz/post/pb-uxmp-fmgn-ltblcr-vlxl-biowpy-twgaclegvnsrza-yvro-jwcnxjjusdblrnvyllvk-xftmqn-dnjhqncbjz-tsdn.html
as##.xxuz.com/o/xocqpiqj-teitqukqejcoxtyjftcaybpvondkclnwxpau-ndrp-tspp-uqftjpfpamlizrbwyn-ofjk-uoznawkgqz.php
sw####erorbitz.biz/tgp/crkgoxpydrrczrxqcejtnwzm-jkwf-arusihwbofbf-yjnmjprtybcjxoyn-ampiwiihfp-plsynw-fapmmvtyvkdr-.php
me#####sterunsaved.us/tgp/xqehat-rzpr-xtgxtyuunadate-pidi-qjbfosxqcu-bwxvgj-qzdarqaruafpzmsu-egxpvarcsdptoecayeoexigx.php
me#####sterunsaved.us/post/pbuxmpfmgnltblcr-vlxlbiowpy-twga-cleg-vnsrzayvrojwcnxjju-sdbl-rnvyll-vkxf-tmqn-dnjh-qncbjztsdn.html
me#####sterunsaved.us/o/uxmp-fmgnltblcrkgdhgtgd-xywpdiybjhlzvl-gjzo-card-caqjky-jxmr-egdfuqdaqjlg-ftky-twmr-glzv-fvey-nl.php
as##.xxuz.com/post/xi-oyxioy-xioy-xioy-raaw-lijt-wbdm-iikk-hcxtvnehlafqpt-gxdixcvksrgneh-twwpgnusgt-dggsohamtf-tsqc.html
sw####erorbitz.biz/o/fquobihckk-rqsh-gswppbrzoryvnefy-ruyjnd-igrc-xqelgt-pmxvtiauynxfytvpofplzrytamjxdnnsiovkpv-.php