Trojan.DownLoader18.59494

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BitLocker Superfetch Installer Shadow' = 'C:\sprcbzauset\ndsebdft.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Intelligent Protocol Host Auto Panel] 'ImagePath' = 'C:\sprcbzauset\ndsebdft.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Intelligent Protocol Host Auto Panel] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'C:\sprcbzauset\cxyahjsgzh.exe' "c:\sprcbzauset\ndsebdft.exe"
'C:\sprcbzauset\ndsebdft.exe'
'C:\sprcbzauset\ekq2nqmjkfseemkbmf.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\sprcbzauset\ndsebdft.exe
C:\sprcbzauset\cxyahjsgzh.exe
C:\sprcbzauset\ekq2nqmjkfseemkbmf.exe
%WINDIR%\sprcbzauset\gsuntvh
C:\sprcbzauset\gsuntvh

Присваивает атрибут 'скрытый' для следующих файлов:

C:\sprcbzauset\cxyahjsgzh.exe
C:\sprcbzauset\ndsebdft.exe

Удаляет следующие файлы:

C:\sprcbzauset\ekq2nqmjkfseemkbmf.exe
%WINDIR%\sprcbzauset\gsuntvh

Сетевая активность:

Подключается к:

'sm###bring.net':80
'wo###listen.net':80
'wo###bring.net':80
'th####tshout.net':80
'wa###shout.net':80
'wo###shout.net':80
'sm###shout.net':80
'sm###demand.net':80
'sm###listen.net':80
'wo###demand.net':80
'cr###shout.net':80
'th####tbring.net':80
'su###rshout.net':80
'su####demand.net':80
'cr###demand.net':80
'th####tdemand.net':80
'wa###demand.net':80
'wa###listen.net':80
'wa###bring.net':80
'th####tlisten.net':80
'pa###bring.net':80
'fr####hildhood.net':80
'ex#####ncechildhood.net':80
'ex#####nceobject.net':80
'ex####encethird.net':80
'fr###object.net':80
'al####ythird.net':80
'ge####manobject.net':80
'ge####manthird.net':80
'ge#####anstation.net':80
'al####ystation.net':80
'pa###demand.net':80
'fi###demand.net':80
'fi###listen.net':80
'fi###bring.net':80
'pa###listen.net':80
'ex#####ncestation.net':80
'fr###third.net':80
'fr####tation.net':80
'pa###shout.net':80
'fi###shout.net':80
'ge####manbring.net':80
'al####ybring.net':80
'ex####enceshout.net':80
'ex#####ncedemand.net':80
'fr###shout.net':80
'al####ydemand.net':80
'ge####manshout.net':80
'ge####mandemand.net':80
'ge####manlisten.net':80
'al####ylisten.net':80
'pa###labor.net':80
'fi###labor.net':80
'fi###valley.net':80
'fi###sister.net':80
'pa###valley.net':80
'ex#####ncelisten.net':80
'fr###demand.net':80
'fr###listen.net':80
'fr###bring.net':80
'ex####encebring.net':80
'al####yshout.net':80
'kn###demand.net':80
'be###shout.net':80
'be###demand.net':80
'be###listen.net':80
'kn###listen.net':80
'su####listen.net':80
'cr###listen.net':80
'cr###bring.net':80
'kn###shout.net':80
'su###rbring.net':80
'me####listen.net':80
'fo####demand.net':80
'fo####listen.net':80
'fo###wbring.net':80
'me###rbring.net':80
'be###bring.net':80
'kn###bring.net':80
'me###rshout.net':80
'me####demand.net':80
'fo###wshout.net':80

TCP:

Запросы HTTP GET:

http://sm###bring.net/index.php
http://wo###listen.net/index.php
http://wo###bring.net/index.php
http://th####tshout.net/index.php
http://wa###shout.net/index.php
http://wo###shout.net/index.php
http://sm###shout.net/index.php
http://sm###demand.net/index.php
http://sm###listen.net/index.php
http://wo###demand.net/index.php
http://cr###shout.net/index.php
http://th####tbring.net/index.php
http://su###rshout.net/index.php
http://su####demand.net/index.php
http://cr###demand.net/index.php
http://th####tdemand.net/index.php
http://wa###demand.net/index.php
http://wa###listen.net/index.php
http://wa###bring.net/index.php
http://th####tlisten.net/index.php
http://pa###bring.net/index.php
http://fr####hildhood.net/index.php
http://ex#####ncechildhood.net/index.php
http://ex#####nceobject.net/index.php
http://ex####encethird.net/index.php
http://fr###object.net/index.php
http://al####ythird.net/index.php
http://ge####manobject.net/index.php
http://ge####manthird.net/index.php
http://ge#####anstation.net/index.php
http://al####ystation.net/index.php
http://pa###demand.net/index.php
http://fi###demand.net/index.php
http://fi###listen.net/index.php
http://fi###bring.net/index.php
http://pa###listen.net/index.php
http://ex#####ncestation.net/index.php
http://fr###third.net/index.php
http://fr####tation.net/index.php
http://pa###shout.net/index.php
http://fi###shout.net/index.php
http://ge####manbring.net/index.php
http://al####ybring.net/index.php
http://ex####enceshout.net/index.php
http://ex#####ncedemand.net/index.php
http://fr###shout.net/index.php
http://al####ydemand.net/index.php
http://ge####manshout.net/index.php
http://ge####mandemand.net/index.php
http://ge####manlisten.net/index.php
http://al####ylisten.net/index.php
http://pa###labor.net/index.php
http://fi###labor.net/index.php
http://fi###valley.net/index.php
http://fi###sister.net/index.php
http://pa###valley.net/index.php
http://ex#####ncelisten.net/index.php
http://fr###demand.net/index.php
http://fr###listen.net/index.php
http://fr###bring.net/index.php
http://ex####encebring.net/index.php
http://al####yshout.net/index.php
http://kn###demand.net/index.php
http://be###shout.net/index.php
http://be###demand.net/index.php
http://be###listen.net/index.php
http://kn###listen.net/index.php
http://su####listen.net/index.php
http://cr###listen.net/index.php
http://cr###bring.net/index.php
http://kn###shout.net/index.php
http://su###rbring.net/index.php
http://me####listen.net/index.php
http://fo####demand.net/index.php
http://fo####listen.net/index.php
http://fo###wbring.net/index.php
http://me###rbring.net/index.php
http://be###bring.net/index.php
http://kn###bring.net/index.php
http://me###rshout.net/index.php
http://me####demand.net/index.php
http://fo###wshout.net/index.php

UDP:

DNS ASK wo###listen.net
DNS ASK sm###listen.net
DNS ASK sm###bring.net
DNS ASK wa###shout.net
DNS ASK wo###bring.net
DNS ASK sm###shout.net
DNS ASK pa###bring.net
DNS ASK wo###shout.net
DNS ASK wo###demand.net
DNS ASK sm###demand.net
DNS ASK th####tbring.net
DNS ASK wa###bring.net
DNS ASK cr###shout.net
DNS ASK cr###demand.net
DNS ASK su###rshout.net
DNS ASK wa###demand.net
DNS ASK th####tshout.net
DNS ASK th####tdemand.net
DNS ASK th####tlisten.net
DNS ASK wa###listen.net
DNS ASK fi###bring.net
DNS ASK ex#####ncechildhood.net
DNS ASK ge#####anstation.net
DNS ASK fr####hildhood.net
DNS ASK fr###object.net
DNS ASK ex#####nceobject.net
DNS ASK ge####manobject.net
DNS ASK al####yobject.net
DNS ASK al####ythird.net
DNS ASK al####ystation.net
DNS ASK ge####manthird.net
DNS ASK fi###demand.net
DNS ASK pa###shout.net
DNS ASK pa###demand.net
DNS ASK pa###listen.net
DNS ASK fi###listen.net
DNS ASK fr###third.net
DNS ASK ex####encethird.net
DNS ASK ex#####ncestation.net
DNS ASK fi###shout.net
DNS ASK fr####tation.net
DNS ASK su####demand.net
DNS ASK ge####manbring.net
DNS ASK al####ybring.net
DNS ASK ex####enceshout.net
DNS ASK ex#####ncedemand.net
DNS ASK fr###shout.net
DNS ASK al####ydemand.net
DNS ASK ge####manshout.net
DNS ASK ge####mandemand.net
DNS ASK ge####manlisten.net
DNS ASK al####ylisten.net
DNS ASK pa###labor.net
DNS ASK fi###labor.net
DNS ASK fi###valley.net
DNS ASK fi###sister.net
DNS ASK pa###valley.net
DNS ASK ex#####ncelisten.net
DNS ASK fr###demand.net
DNS ASK fr###listen.net
DNS ASK fr###bring.net
DNS ASK ex####encebring.net
DNS ASK al####yshout.net
DNS ASK kn###demand.net
DNS ASK be###shout.net
DNS ASK be###demand.net
DNS ASK be###listen.net
DNS ASK kn###listen.net
DNS ASK su####listen.net
DNS ASK cr###listen.net
DNS ASK cr###bring.net
DNS ASK kn###shout.net
DNS ASK su###rbring.net
DNS ASK me####listen.net
DNS ASK fo####demand.net
DNS ASK fo####listen.net
DNS ASK fo###wbring.net
DNS ASK me###rbring.net
DNS ASK be###bring.net
DNS ASK kn###bring.net
DNS ASK me###rshout.net
DNS ASK me####demand.net
DNS ASK fo###wshout.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней