Trojan.DownLoader18.4956

Добавлен в вирусную базу Dr.Web: 2015-12-08

Описание добавлено: 2015-12-08

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Logs Client Discovery Name' = '<SYSTEM32>\nutpxsdzzh.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Manager Certificate Sharing Provider] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\hjwyborrxl.exe' "<SYSTEM32>\nutpxsdzzh.exe"
'%WINDIR%\Temp\vscgmsit2s3asmte6.exe' -r 34170 tcp
'%TEMP%\vscgmsit2kspsmte6nfhp0l.exe'
'<SYSTEM32>\nutpxsdzzh.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\bvgpdvvkic\run
<SYSTEM32>\bvgpdvvkic\rng
%WINDIR%\Temp\vscgmsit2s3asmte6.exe
<SYSTEM32>\bvgpdvvkic\cfg
<SYSTEM32>\hjwyborrxl.exe
%TEMP%\vscgmsit2kspsmte6nfhp0l.exe
<SYSTEM32>\bvgpdvvkic\tst
<SYSTEM32>\nutpxsdzzh.exe
<SYSTEM32>\bvgpdvvkic\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\hjwyborrxl.exe
<SYSTEM32>\nutpxsdzzh.exe

Удаляет следующие файлы:

%WINDIR%\Temp\vscgmsit2s3asmte6.exe
<DRIVERS>\etc\hosts
%TEMP%\vscgmsit2kspsmte6nfhp0l.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ro###ext.net':80
'si###ext.net':80
'si###ook.net':80
'si###all.net':80
'ro###ook.net':80
'ju###all.net':80
'mo###ook.net':80
'mo###all.net':80
'ro###een.net':80
'si###een.net':80
'pi###ook.net':80
'so###ook.net':80
'so###all.net':80
'ab###een.net':80
'pi###all.net':80
'so###een.net':80
'ro###all.net':80
'pi###een.net':80
'pi###ext.net':80
'so###ext.net':80
'fe###all.net':80
'lo###all.net':80
'wh###een.net':80
'wh###ext.net':80
'hi###een.net':80
'lo###ext.net':80
'fe###een.net':80
'fe###ext.net':80
'fe###ook.net':80
'lo###ook.net':80
'mo###een.net':80
'ju###een.net':80
'ju###ext.net':80
'ju###ook.net':80
'mo###ext.net':80
'wh###ook.net':80
'hi###ext.net':80
'hi###ook.net':80
'hi###all.net':80
'wh###all.net':80
'kn###een.net':80
'wh###ing.net':80
'fe###ever.net':80
'hi###ing.net':80
'be##lxc.com':80
'wh###tart.net':80
'fe###tart.net':80
'lo###tart.net':80
'lo###ine.net':80
'lo###ever.net':80
'fe###ine.net':80
'mi###hown.net':80
'ab###ell.net':80
'mo###ugust.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'al###being.net':80
'ri###nstorm.net':80
'ca####nbring.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'wi###ing.net':80
'kn###all.net':80
'dr###sing.net':80
'dr###start.net':80
'wi###tart.net':80
'kn###ext.net':80
'ab###ext.net':80
'ab###ook.net':80
'ab###all.net':80
'kn###ook.net':80
'th###nine.net':80
'th###start.net':80
'th###never.net':80
'fe###ing.net':80
'lo###ing.net':80
'dr###nine.net':80
'wi###ine.net':80
'wi###ever.net':80
'th###sing.net':80
'dr###never.net':80

TCP:

Запросы HTTP GET:

http://ro###ext.net/index.php
http://si###ext.net/index.php
http://si###ook.net/index.php
http://si###all.net/index.php
http://ro###ook.net/index.php
http://ju###all.net/index.php
http://mo###ook.net/index.php
http://mo###all.net/index.php
http://ro###een.net/index.php
http://si###een.net/index.php
http://pi###ook.net/index.php
http://so###ook.net/index.php
http://so###all.net/index.php
http://ab###een.net/index.php
http://pi###all.net/index.php
http://so###een.net/index.php
http://ro###all.net/index.php
http://pi###een.net/index.php
http://pi###ext.net/index.php
http://so###ext.net/index.php
http://fe###all.net/index.php
http://lo###all.net/index.php
http://wh###een.net/index.php
http://wh###ext.net/index.php
http://hi###een.net/index.php
http://lo###ext.net/index.php
http://fe###een.net/index.php
http://fe###ext.net/index.php
http://fe###ook.net/index.php
http://lo###ook.net/index.php
http://mo###een.net/index.php
http://ju###een.net/index.php
http://ju###ext.net/index.php
http://ju###ook.net/index.php
http://mo###ext.net/index.php
http://wh###ook.net/index.php
http://hi###ext.net/index.php
http://hi###ook.net/index.php
http://hi###all.net/index.php
http://wh###all.net/index.php
http://kn###een.net/index.php
http://wh###ing.net/index.php
http://fe###ever.net/index.php
http://hi###ing.net/index.php
http://be##lxc.com/index.php
http://wh###tart.net/index.php
http://fe###tart.net/index.php
http://lo###tart.net/index.php
http://lo###ine.net/index.php
http://lo###ever.net/index.php
http://fe###ine.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://mo###ugust.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://ca####nbring.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://wi###ing.net/index.php
http://kn###all.net/index.php
http://dr###sing.net/index.php
http://dr###start.net/index.php
http://wi###tart.net/index.php
http://kn###ext.net/index.php
http://ab###ext.net/index.php
http://ab###ook.net/index.php
http://ab###all.net/index.php
http://kn###ook.net/index.php
http://th###nine.net/index.php
http://th###start.net/index.php
http://th###never.net/index.php
http://fe###ing.net/index.php
http://lo###ing.net/index.php
http://dr###nine.net/index.php
http://wi###ine.net/index.php
http://wi###ever.net/index.php
http://th###sing.net/index.php
http://dr###never.net/index.php

UDP:

DNS ASK ro###ext.net
DNS ASK si###ext.net
DNS ASK si###ook.net
DNS ASK si###all.net
DNS ASK ro###ook.net
DNS ASK ju###all.net
DNS ASK mo###ook.net
DNS ASK mo###all.net
DNS ASK ro###een.net
DNS ASK si###een.net
DNS ASK pi###ook.net
DNS ASK so###ook.net
DNS ASK so###all.net
DNS ASK ab###een.net
DNS ASK pi###all.net
DNS ASK so###een.net
DNS ASK ro###all.net
DNS ASK pi###een.net
DNS ASK pi###ext.net
DNS ASK so###ext.net
DNS ASK ju###ook.net
DNS ASK lo###all.net
DNS ASK fe###ook.net
DNS ASK fe###all.net
DNS ASK hi###een.net
DNS ASK wh###een.net
DNS ASK fe###een.net
DNS ASK lo###een.net
DNS ASK lo###ext.net
DNS ASK lo###ook.net
DNS ASK fe###ext.net
DNS ASK ju###een.net
DNS ASK hi###all.net
DNS ASK mo###een.net
DNS ASK mo###ext.net
DNS ASK ju###ext.net
DNS ASK hi###ext.net
DNS ASK wh###ext.net
DNS ASK wh###ook.net
DNS ASK wh###all.net
DNS ASK hi###ook.net
DNS ASK kn###een.net
DNS ASK wh###ing.net
DNS ASK fe###ever.net
DNS ASK hi###ing.net
DNS ASK be##lxc.com
DNS ASK wh###tart.net
DNS ASK fe###tart.net
DNS ASK lo###tart.net
DNS ASK lo###ine.net
DNS ASK lo###ever.net
DNS ASK fe###ine.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK mo###ugust.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK ca####nbring.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK wi###ing.net
DNS ASK kn###all.net
DNS ASK dr###sing.net
DNS ASK dr###start.net
DNS ASK wi###tart.net
DNS ASK kn###ext.net
DNS ASK ab###ext.net
DNS ASK ab###ook.net
DNS ASK ab###all.net
DNS ASK kn###ook.net
DNS ASK th###nine.net
DNS ASK th###start.net
DNS ASK th###never.net
DNS ASK fe###ing.net
DNS ASK lo###ing.net
DNS ASK dr###nine.net
DNS ASK wi###ine.net
DNS ASK wi###ever.net
DNS ASK th###sing.net
DNS ASK dr###never.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней