Trojan.Encoder.977

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\1e6f17d9.exe
C:\1e6f17d9\1e6f17d9.exe

Сетевая активность:

Подключается к:

'ou###ve3344.com':80
'un#####developer3.com':80
'tu##ck.com':80
'th####drona.co.nz':80
'wi#####stgallery.com':80
'to######lichnhatrang.com':80
'li#####le-journal.org':80
'ka####arehberi.com':80
'we########rretirementservices.com':80
'al###o.com.co':80
'hk####riors.co.uk':80
'cr####helametine.it':80
'ca######ibeachsoccer.com':80
'ip###otami.net':80
'we####ignlivorno.it':80
'li#####-counselling.com':80
'or#z.tw':80
'tu####alswalk.info':80
'cr###racker.com':80
'da###media.com':80
'sw#####sopticians.com':80
'ya##pan.com':80
'my####rnalip.com':80
'ip##ddr.es':80
're###tefarm.com':80
'cu###yip.com':80
'vi####ngjakarta.com':80
'wa###athore.com':80
'cs##d.com':80
'co###ul.com.br':80
'st###yhub.com':80
'xa###czl.com':80
'vi####gameworld.com':80
'st###emes.com':80
'ca###szeko.com':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://th####drona.co.nz/wp-content/themes/roots-master/img4.php?v=##########
http://ou###ve3344.com/wp-content/themes/village/img5.php?m=##########
http://we########rretirementservices.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?b=##########
http://tu##ck.com/wp-content/plugins/wp_module/img5.php?s=##########
http://ka####arehberi.com/wp-content/plugins/wp_module/img2.php?g=##########
http://wi#####stgallery.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?a=##########
http://un#####developer3.com/wp-content/plugins/wp_module/img3.php?z=##########
http://li#####le-journal.org/wp-content/plugins/wp_module/img1.php?t=##########
http://al###o.com.co/site/wp-content/themes/alimco/img2.php?a=##########
http://hk####riors.co.uk/wp-content/plugins/wp_module/img5.php?t=##########
http://cr####helametine.it/ciccioesse/img1.php?a=##########
http://ca######ibeachsoccer.com/wp-content/plugins/wp_module/img2.php?z=##########
http://ip###otami.net/wp-content/plugins/wp_module/img5.php?g=##########
http://we####ignlivorno.it/wp-content/themes/newscast/img4.php?c=##########
http://li#####-counselling.com/wp-content/plugins/wp_module/img2.php?x=##########
http://or#z.tw/wp-content/plugins/wp_module/img1.php?u=##########
http://vi####ngjakarta.com/wp-content/plugins/wp_module/img3.php?b=##########
http://sw#####sopticians.com/wp-content/plugins/wp_module/img1.php?r=##########
http://xa###czl.com/wp-content/plugins/wp_module/img3.php?k=##########
http://vi####gameworld.com/wp-content/plugins/wp_module/img1.php?k=##########
http://da###media.com/wp-content/plugins/wp_module/img5.php?s=##########
http://re###tefarm.com/img4.php?k=##########
http://ya##pan.com/wp-content/uploads/2015/03/img2.php?w=##########
http://cr###racker.com/wp-content/themes/twentytwelve/img2.php?m=##########
http://co###ul.com.br/wp-content/plugins/wp_module/img1.php?f=##########
http://st###yhub.com/wp-content/plugins/wp_module/img5.php?y=##########
http://to######lichnhatrang.com/wp-content/plugins/wp_module/img1.php?z=##########
http://tu####alswalk.info/wp-content/themes/Defne/img2.php?c=##########
http://st###emes.com/wp-content/themes/twentytwelve/img3.php?p=##########
http://ca###szeko.com/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?n=##########
http://wa###athore.com/wp-content/themes/meshable/img4.php?c=##########
http://cs##d.com/wp-content/themes/spacious/img1.php?o=##########