Trojan.PWS.Gamania.44830

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000028] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,78,75,6e,6c,65,69,66,61,73,74,2e,64,6c,6c,00,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'
[<HKLM>\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,5c,6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,42,00,38,00,43,00,36,00,38,00,45,00,36,00,38,00,44,00,31,00,31,00,35,00,7d,00,5d,00,20,00,53,00,45,00,51,00,50,00,41,00,43,00,4b,00,45,00,54,00,20,00,32,...'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\services\ws2ifsl] 'Start' = '00000001'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\sc.exe' delete cryptsvc
'<SYSTEM32>\net1.exe' stop cryptsvc
'<SYSTEM32>\net.exe' stop cryptsvc
'<SYSTEM32>\sc.exe' config cryptsvc start= disabled

Внедряет код в

следующие системные процессы:

%WINDIR%\Explorer.EXE

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\cdeLKCqt725C4yT.dll
%TEMP%\w6fw1wYRy061TWj.dll
%TEMP%\oIlpokTjEy43879.dll
%TEMP%\C4OlrY9ZMq4TlPM.dll
%TEMP%\GebXTa3lj47i16q.dll
%TEMP%\K985Dh335A949fK.dll
%TEMP%\eT9ffRWMvM3mgDf.dll
%TEMP%\a0q83Kd5Z97XJdx.dll
%TEMP%\1YrUc4LUKD8Fq6D.dll
%TEMP%\UjkT770PTn3KaXt.dll
%WINDIR%\xunleifast.dll
<SYSTEM32>\yuksuser.dll
<SYSTEM32>\BVNSEUHJ8.dll
%WINDIR%\BVNSEUHJ8.dll
<SYSTEM32>\yumidimap.dll
%TEMP%\kpZI5caYse1oeQX.dll
%TEMP%\4OisfMHrdp2cB0m.dll
%TEMP%\7uW7vEVaGb0H3J4.dll
%TEMP%\QFXhbyy88g16LsP.dll

Самоперемещается:

из <Полный путь к вирусу> в C:\$Recycle.Bin\390345.tmp

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней