Trojan.DownLoader18.7641

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Assistant Block Color Security Isolation Human' = '<SYSTEM32>\nsbygja.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Trap COM Extensible Locator Device Background] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\pnhbnqpy.exe' "<SYSTEM32>\nsbygja.exe"
'%WINDIR%\Temp\msuy7b2mm9cow.exe' -r 48232 tcp
'%TEMP%\msuy7b2hl9cowmbk40dq1.exe'
'<SYSTEM32>\nsbygja.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\jauwhtssj\run
<SYSTEM32>\jauwhtssj\rng
%WINDIR%\Temp\msuy7b2mm9cow.exe
<SYSTEM32>\jauwhtssj\cfg
<SYSTEM32>\pnhbnqpy.exe
%TEMP%\msuy7b2hl9cowmbk40dq1.exe
<SYSTEM32>\jauwhtssj\tst
<SYSTEM32>\nsbygja.exe
<SYSTEM32>\jauwhtssj\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\pnhbnqpy.exe
<SYSTEM32>\nsbygja.exe

Удаляет следующие файлы:

%WINDIR%\Temp\msuy7b2mm9cow.exe
<DRIVERS>\etc\hosts
%TEMP%\msuy7b2hl9cowmbk40dq1.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'mo###tudy.net':80
'su###yloss.net':80
'su###ystudy.net':80
'su###yuncle.net':80
'mo###ncle.net':80
'mo###oss.net':80
'si###ncle.net':80
'me###tudy.net':80
'me###ncle.net':80
'su###yonce.net':80
'mo###nce.net':80
'qu###uncle.net':80
'th###ncle.net':80
'he###nce.net':80
'he###oss.net':80
'ca###nce.net':80
'qu###study.net':80
'qu###once.net':80
'th###nce.net':80
'th###oss.net':80
'th###tudy.net':80
'qu###loss.net':80
'tr###free.net':80
'mi###orty.net':80
'mi###ree.net':80
'cl###once.net':80
'da###nce.net':80
'tr###forty.net':80
'tr###wall.net':80
'wi###ree.net':80
'mi###all.net':80
'mi###ther.net':80
'tr###other.net':80
'me###nce.net':80
'si###nce.net':80
'si###oss.net':80
'si###tudy.net':80
'me###oss.net':80
'cl###uncle.net':80
'cl###loss.net':80
'da###oss.net':80
'da###tudy.net':80
'da###ncle.net':80
'cl###study.net':80
'ca###oss.net':80
'cl###edge.net':80
'da###dge.net':80
'da###rmy.net':80
'da###pril.net':80
'cl###army.net':80
'mi###ncle.net':80
'mi###oss.net':80
'tr###loss.net':80
'tr###study.net':80
'tr###uncle.net':80
'mi###tudy.net':80
'de###lxc.com':80
'me###rmy.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'si###rmy.net':80
'da###ray.net':80
'cl###april.net':80
'cl###gray.net':80
'me###dge.net':80
'si###dge.net':80
'th###loss.net':80
'si###loss.net':80
'si###study.net':80
'si###uncle.net':80
'th###study.net':80
'th###once.net':80
'ca###tudy.net':80
'he###tudy.net':80
'he###ncle.net':80
'si###once.net':80
'ca###ncle.net':80
'du###ncle.net':80
'wi###tudy.net':80
'wi###ncle.net':80
'mi###nce.net':80
'tr###once.net':80
'du###tudy.net':80
'du###nce.net':80
'th###uncle.net':80
'wi###nce.net':80
'wi###oss.net':80
'du###oss.net':80

TCP:

Запросы HTTP GET:

http://mo###tudy.net/index.php
http://su###yloss.net/index.php
http://su###ystudy.net/index.php
http://su###yuncle.net/index.php
http://mo###ncle.net/index.php
http://mo###oss.net/index.php
http://si###ncle.net/index.php
http://me###tudy.net/index.php
http://me###ncle.net/index.php
http://su###yonce.net/index.php
http://mo###nce.net/index.php
http://qu###uncle.net/index.php
http://th###ncle.net/index.php
http://he###nce.net/index.php
http://he###oss.net/index.php
http://ca###nce.net/index.php
http://qu###study.net/index.php
http://qu###once.net/index.php
http://th###nce.net/index.php
http://th###oss.net/index.php
http://th###tudy.net/index.php
http://qu###loss.net/index.php
http://tr###free.net/index.php
http://mi###orty.net/index.php
http://mi###ree.net/index.php
http://cl###once.net/index.php
http://da###nce.net/index.php
http://tr###forty.net/index.php
http://tr###wall.net/index.php
http://wi###ree.net/index.php
http://mi###all.net/index.php
http://mi###ther.net/index.php
http://tr###other.net/index.php
http://me###nce.net/index.php
http://si###nce.net/index.php
http://si###oss.net/index.php
http://si###tudy.net/index.php
http://me###oss.net/index.php
http://cl###uncle.net/index.php
http://cl###loss.net/index.php
http://da###oss.net/index.php
http://da###tudy.net/index.php
http://da###ncle.net/index.php
http://cl###study.net/index.php
http://ca###oss.net/index.php
http://cl###edge.net/index.php
http://da###dge.net/index.php
http://da###rmy.net/index.php
http://da###pril.net/index.php
http://cl###army.net/index.php
http://mi###ncle.net/index.php
http://mi###oss.net/index.php
http://tr###loss.net/index.php
http://tr###study.net/index.php
http://tr###uncle.net/index.php
http://mi###tudy.net/index.php
http://de###lxc.com/index.php
http://me###rmy.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://si###rmy.net/index.php
http://da###ray.net/index.php
http://cl###april.net/index.php
http://cl###gray.net/index.php
http://me###dge.net/index.php
http://si###dge.net/index.php
http://th###loss.net/index.php
http://si###loss.net/index.php
http://si###study.net/index.php
http://si###uncle.net/index.php
http://th###study.net/index.php
http://th###once.net/index.php
http://ca###tudy.net/index.php
http://he###tudy.net/index.php
http://he###ncle.net/index.php
http://si###once.net/index.php
http://ca###ncle.net/index.php
http://du###ncle.net/index.php
http://wi###tudy.net/index.php
http://wi###ncle.net/index.php
http://mi###nce.net/index.php
http://tr###once.net/index.php
http://du###tudy.net/index.php
http://du###nce.net/index.php
http://th###uncle.net/index.php
http://wi###nce.net/index.php
http://wi###oss.net/index.php
http://du###oss.net/index.php

UDP:

DNS ASK su###ystudy.net
DNS ASK mo###tudy.net
DNS ASK mo###ncle.net
DNS ASK th###nce.net
DNS ASK su###yuncle.net
DNS ASK su###yloss.net
DNS ASK me###ncle.net
DNS ASK si###ncle.net
DNS ASK mo###nce.net
DNS ASK mo###oss.net
DNS ASK su###yonce.net
DNS ASK he###nce.net
DNS ASK qu###uncle.net
DNS ASK ca###nce.net
DNS ASK ca###oss.net
DNS ASK he###oss.net
DNS ASK th###ncle.net
DNS ASK th###oss.net
DNS ASK qu###once.net
DNS ASK qu###loss.net
DNS ASK qu###study.net
DNS ASK th###tudy.net
DNS ASK me###tudy.net
DNS ASK tr###free.net
DNS ASK mi###orty.net
DNS ASK mi###ree.net
DNS ASK cl###once.net
DNS ASK da###nce.net
DNS ASK tr###forty.net
DNS ASK tr###wall.net
DNS ASK wi###ree.net
DNS ASK mi###all.net
DNS ASK mi###ther.net
DNS ASK tr###other.net
DNS ASK me###nce.net
DNS ASK si###nce.net
DNS ASK si###oss.net
DNS ASK si###tudy.net
DNS ASK me###oss.net
DNS ASK cl###uncle.net
DNS ASK cl###loss.net
DNS ASK da###oss.net
DNS ASK da###tudy.net
DNS ASK da###ncle.net
DNS ASK cl###study.net
DNS ASK cl###edge.net
DNS ASK da###dge.net
DNS ASK da###rmy.net
DNS ASK da###pril.net
DNS ASK cl###army.net
DNS ASK mi###ncle.net
DNS ASK mi###oss.net
DNS ASK tr###loss.net
DNS ASK tr###study.net
DNS ASK tr###uncle.net
DNS ASK mi###tudy.net
DNS ASK de###lxc.com
DNS ASK me###rmy.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK si###rmy.net
DNS ASK da###ray.net
DNS ASK cl###april.net
DNS ASK cl###gray.net
DNS ASK me###dge.net
DNS ASK si###dge.net
DNS ASK th###loss.net
DNS ASK si###loss.net
DNS ASK si###study.net
DNS ASK si###uncle.net
DNS ASK th###study.net
DNS ASK th###once.net
DNS ASK ca###tudy.net
DNS ASK he###tudy.net
DNS ASK he###ncle.net
DNS ASK si###once.net
DNS ASK ca###ncle.net
DNS ASK du###ncle.net
DNS ASK wi###tudy.net
DNS ASK wi###ncle.net
DNS ASK mi###nce.net
DNS ASK tr###once.net
DNS ASK du###tudy.net
DNS ASK du###nce.net
DNS ASK th###uncle.net
DNS ASK wi###nce.net
DNS ASK wi###oss.net
DNS ASK du###oss.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней