Trojan.DownLoader10.44558

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\skype.dat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\oxpy-drrczrxqehat-lgqs-eyjwbltmlgbtnnqpxvlicj-xxjlosliph-fvxt-gtfpqu-dhbqabblux-ftpa-celaux-sd[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\si-sisi-sisisisisinsglns-gopbkdcoamuqix-alquvaackkdreaiqlgbatydkkdukio-zvdfqpawbwsppapfvy[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\jx-qnjtixjxqnjtixbcglcugoalquebvaatightprnovkfvab-iosh-xowizr-jvxtdw-kbte-ddxlbt-jtwi-ipmy-fa[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nhllnwamrdmynsoefr-tyyv-iqfqfqxywpjtmsftcjpftf-ygrp-stxibilzyjhc-jtgajx-spqt-nwqrsptsqp-crpb[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\sy-ftxp-lxstzhrubtrojgnbgb-xqhc-cbdk-pyifjuphnb-mxfyqzehlx-rcxvmrkydr-amzmabjgfawiwkytifrp-zh[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\nl-xjig-yhvaxlsyftdrzrjkyjrcsd-qudmfv-xlyn-drwkfadrjtcnxjbhac-nwfm-rufa-ndkgrgjpopio-vtoebana[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cbkydftmysgl-gajz-sdtw-rnzvgaysorfq-ouukfanlowawxsjhcnxjeg-owam-qcix-gdbiou-fzsd-nnpq-uapyosgk[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uxmp-fmgnltblcrkgdhgtgdxy-wpdiyb-jhlz-vlgj-zoca-rdca-qjky-jxmreg-dfuq-daqj-lgftkytwmr-glzv-fvey-nl[1].html
%APPDATA%\skype.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\si-sisisi-sisi-sisi-nsglnsgopbkdcoamuqixalquvaackk-dreaiq-lgba-tydkkdukiozvdfqpawbw-sppa-pfvy[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ru-btoahj-yqyb-tisdpidwpfsizjnq-ltyxxt-ruux-jxfzabukonkbru-cdjt-rokb-qjnb-pbvn-cnwfxx-rtus-lipaop-[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\iq-fzcj-ynsp-gbnnrpgakkifyvrpipli-nnab-ricg-bwmyplrzlldflzysdrsibf-rdrqqjellikyksgdlihtnlhc-[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\xxnmxxnmxxnmxxnm-hjygnawfvaytbakgfv-onrd-uanq-eyzopfhjgnnmpiabpqgj-wknqnlnqbcjhmp-lalmnstf[1].html

Сетевая активность:

Подключается к:

'ch#####f.dns-dns.com':80
'mo#######ocumentsthousands.in':80
'am###etweet.us':80

TCP:

Запросы HTTP GET:

ch#####f.dns-dns.com/questions/nhllnwamrdmynsoefr-tyyv-iqfqfqxywpjtmsftcjpftf-ygrp-stxibilzyjhc-jtgajx-spqt-nwqrsptsqp-crpb.html
mo#######ocumentsthousands.in/post/oxpy-drrczrxqehat-lgqs-eyjwbltmlgbtnnqpxvlicj-xxjlosliph-fvxt-gtfpqu-dhbqabblux-ftpa-celaux-sd.html
am###etweet.us/tgp/si-sisi-sisisisisinsglns-gopbkdcoamuqix-alquvaackkdreaiqlgbatydkkdukio-zvdfqpawbwsppapfvy.php
ch#####f.dns-dns.com/post/sy-ftxp-lxstzhrubtrojgnbgb-xqhc-cbdk-pyifjuphnb-mxfyqzehlx-rcxvmrkydr-amzmabjgfawiwkytifrp-zh.html
mo#######ocumentsthousands.in/o/nl-xjig-yhvaxlsyftdrzrjkyjrcsd-qudmfv-xlyn-drwkfadrjtcnxjbhac-nwfm-rufa-ndkgrgjpopio-vtoebana.php
am###etweet.us/questions/cbkydftmysgl-gajz-sdtw-rnzvgaysorfq-ouukfanlowawxsjhcnxjeg-owam-qcix-gdbiou-fzsd-nnpq-uapyosgk.html
ch#####f.dns-dns.com/post/xxnmxxnmxxnmxxnm-hjygnawfvaytbakgfv-onrd-uanq-eyzopfhjgnnmpiabpqgj-wknqnlnqbcjhmp-lalmnstf.html
mo#######ocumentsthousands.in/tgp/si-sisisi-sisi-sisi-nsglnsgopbkdcoamuqixalquvaackk-dreaiq-lgba-tydkkdukiozvdfqpawbw-sppa-pfvy.php
am###etweet.us/questions/uxmp-fmgnltblcrkgdhgtgdxy-wpdiyb-jhlz-vlgj-zoca-rdca-qjky-jxmreg-dfuq-daqj-lgftkytwmr-glzv-fvey-nl.html
ch#####f.dns-dns.com/o/jx-qnjtixjxqnjtixbcglcugoalquebvaatightprnovkfvab-iosh-xowizr-jvxtdw-kbte-ddxlbt-jtwi-ipmy-fa.php
mo#######ocumentsthousands.in/questions/ru-btoahj-yqyb-tisdpidwpfsizjnq-ltyxxt-ruux-jxfzabukonkbru-cdjt-rokb-qjnb-pbvn-cnwfxx-rtus-lipaop-.html
am###etweet.us/o/iq-fzcj-ynsp-gbnnrpgakkifyvrpipli-nnab-ricg-bwmyplrzlldflzysdrsibf-rdrqqjellikyksgdlihtnlhc-.php