Trojan.Packed.32717

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
'<SYSTEM32>\svchost.exe' netsvcs
'%WINDIR%\explorer.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\ec525f4.exe
C:\ec525f4\ec525f4.exe

Сетевая активность:

Подключается к:

'fe###alnirs.com':80
'co####zzachile.com':80
'ed###ntage.com':80
'mi####-jewelry.com':80
'kw#####proci.mazury.pl':80
'co#######deramaquillarse.com':80
'co######yneuroclinic.com':80
'fa#####people.com.br':80
'ch####yfross.com':80
'sh###dtoyou.com':80
'br###fross.com':80
'ga####nesexboys.com':80
'ke##uk.cz':80
'co###ctao.com':80
'ma######guehomerepair.com':80
'ap###acii.com':80
'bi####okerage.com':80
'ch####ndermagic.com':80
'gl###zona.com':80
'mo##red.pl':80
'fu######mtechnologies.com':80
'hk##m.com':80
'ja####azonia.com':80
'ei###hai.net':80
'mo###deep.com':80
'ca###apan.com':80
'my####rnalip.com':80
'ip##ddr.es':80
'cu###yip.com':80
'pa####lane.co.id':80
'ca####midwifery.com':80
'co#####onakeychain.com':80
'co#####-into-cash.com':80
'mo###coffee.com':80
'ch####scrosson.com':80
'is####hcebakim.com':80
'el###hmias.com':80
'co#####zacolombia.com':80
'mi#######nationalthailand.com':80
'gs###kansas.com':80
'ho####yle1974.com':80
'gr###oup.co.il':80

TCP:

Запросы HTTP GET:

http://cu###yip.com/
http://my####rnalip.com/raw
http://ip##ddr.es/

Запросы HTTP POST:

http://kw#####proci.mazury.pl/images/ccccc.php?m=##############
http://ed###ntage.com/wp-content/uploads/rrrr.php?a=##############
http://br###fross.com/wp-content/themes/twentyeleven/ccccc.php?h=##############
http://mi####-jewelry.com/wp-content/uploads/rr.php?y=##############
http://fe###alnirs.com/wp-content/plugins/revslider/temp/c.php?h=##############
http://sh###dtoyou.com/download/cc.php?a=##############
http://fa#####people.com.br/wp-content/themes/mazine/rrrrr.php?d=##############
http://co####zzachile.com/wp-content/plugins/gravityforms/ccc.php?d=##############
http://ch####yfross.com/wp-content/themes/twentyfourteen/cccc.php?n=##############
http://ch####ndermagic.com/wp-content/plugins/wp-quick-contact-us/cc.php?h=##############
http://co###ctao.com/wp-content/themes/twentyeleven/cc.php?d=##############
http://ga####nesexboys.com/wp-content/uploads/rrrr.php?m=##############
http://ma######guehomerepair.com/wp-content/uploads/rrrr.php?u=##############
http://ap###acii.com/openx/www/delivery/ccc.php?h=##############
http://ke##uk.cz/wp-content/uploads/rrrr.php?y=##############
http://gl###zona.com/plugins/system/plg_system_rewrite/rr.php?g=##############
http://bi####okerage.com/wp-content/plugins/wp-antibot-standart/rrr.php?g=##############
http://mo##red.pl/wp-content/uploads/rrrrr.php?a=##############
http://fu######mtechnologies.com/wp-content/plugins/jetpack/ccccc.php?z=##############
http://co#######deramaquillarse.com/wp-content/themes/twentyten/c.php?v=##############
http://mo###deep.com/wp-content/uploads/rrr.php?f=##############
http://ca###apan.com/wp-content/plugins/bwp-recent-comments/ccc.php?j=##############
http://mi#######nationalthailand.com/wp-content/cccc.php?k=##############
http://co#####onakeychain.com/wp-content/plugins/wp-smushit/ccc.php?q=##############
http://ei###hai.net/wp-content/themes/twentytwelve/rr.php?m=##############
http://pa####lane.co.id/site/ccccc.php?b=##############
http://ca####midwifery.com/wp-content/plugins/ultimate-branding/c.php?r=##############
http://hk##m.com/wp-content/themes/xinji/rrrr.php?m=##############
http://ja####azonia.com/wp-content/uploads/r.php?f=##############
http://co#####zacolombia.com/wp-content/plugins/pods/cc.php?t=##############
http://el###hmias.com/wp-content/uploads/r.php?t=##############
http://ch####scrosson.com/wp-content/plugins/woodojo/ccccc.php?u=##############
http://co######yneuroclinic.com/wp-content/themes/twentytwelve/cccc.php?r=##############
http://is####hcebakim.com/wp-content/uploads/rrrr.php?m=##############
http://co#####-into-cash.com/wp-content/plugins/pretty-link/cc.php?g=##############
http://gr###oup.co.il/wp-content/plugins/revslider/temp/cccc.php?k=##############
http://gs###kansas.com/wp-content/plugins/wp-antibot-standart/rrrr.php?w=##############
http://mo###coffee.com/wp-content/uploads/cc.php?c=##############
http://ho####yle1974.com/wp-content/uploads/rrr.php?k=##############