Trojan.DownLoader19.2820

Добавлен в вирусную базу Dr.Web: 2016-01-22

Описание добавлено: 2016-01-22

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Net.Tcp ActiveX Protocol Biometric Player' = '<SYSTEM32>\epibayalghd.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Block Identity Authentication Logs Problem] 'ImagePath' = '<SYSTEM32>\epibayalghd.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Block Identity Authentication Logs Problem] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\wwsfaaqmwwy.exe' "<SYSTEM32>\epibayalghd.exe"
'%WINDIR%\Temp\wz7tuss5459lackcaow.exe' -r 47069 tcp
'%TEMP%\wz7tuss5so0v4wkcaowyynb90.exe'
'<SYSTEM32>\epibayalghd.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\cialcvfysxesyuf\run
<SYSTEM32>\cialcvfysxesyuf\rng
%WINDIR%\Temp\wz7tuss5459lackcaow.exe
<SYSTEM32>\cialcvfysxesyuf\cfg
<SYSTEM32>\wwsfaaqmwwy.exe
%TEMP%\wz7tuss5so0v4wkcaowyynb90.exe
<SYSTEM32>\cialcvfysxesyuf\tst
<SYSTEM32>\epibayalghd.exe
<SYSTEM32>\cialcvfysxesyuf\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\wwsfaaqmwwy.exe
<SYSTEM32>\epibayalghd.exe

Удаляет следующие файлы:

%WINDIR%\Temp\wz7tuss5459lackcaow.exe
<DRIVERS>\etc\hosts
%TEMP%\wz7tuss5so0v4wkcaowyynb90.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'fa###some.net':80
'ri###even.net':80
'li###uch.net':80
'ri###ome.net':80
'fa###today.net':80
'ri###uch.net':80
'fa###seven.net':80
'ri###oday.net':80
'no###uch.net':80
'no###ome.net':80
'li###ome.net':80
'po###such.net':80
'ca###uch.net':80
'no###oday.net':80
'li###oday.net':80
'no###even.net':80
'li###even.net':80
'th###dance.net':80
'li###ance.net':80
'th###dare.net':80
'li###are.net':80
'th###tell.net':80
'li###ell.net':80
'th###body.net':80
'li###ody.net':80
'fi###tell.net':80
'fi###dare.net':80
'so###dance.net':80
'fa###such.net':80
'so###dare.net':80
'fi###body.net':80
'so###tell.net':80
'fi###dance.net':80
'so###body.net':80
'th###while.net':80
'fe###ome.net':80
'ri###nstorm.net':80
'ef###tbuilt.net':80
'we###even.net':80
'fe###oday.net':80
'we###ome.net':80
'fe###even.net':80
'of####urprise.net':80
'de####promise.net':80
'se####strong.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'ch####nother.net':80
'gw#####ynhuddleston.net':80
'si######edwerryhouse.net':80
'mo####gduring.net':80
'po###some.net':80
'ca###ome.net':80
'ta###such.net':80
'le###uch.net':80
'po###today.net':80
'ca###oday.net':80
'po###seven.net':80
'ca###even.net':80
'le###oday.net':80
'we###uch.net':80
'ta###some.net':80
'we###oday.net':80
'fe###uch.net':80
'le###even.net':80
'ta###today.net':80
'le###ome.net':80
'ta###seven.net':80

TCP:

Запросы HTTP GET:

http://fa###some.net/index.php
http://ri###even.net/index.php
http://li###uch.net/index.php
http://ri###ome.net/index.php
http://fa###today.net/index.php
http://ri###uch.net/index.php
http://fa###seven.net/index.php
http://ri###oday.net/index.php
http://no###uch.net/index.php
http://no###ome.net/index.php
http://li###ome.net/index.php
http://po###such.net/index.php
http://ca###uch.net/index.php
http://no###oday.net/index.php
http://li###oday.net/index.php
http://no###even.net/index.php
http://li###even.net/index.php
http://th###dance.net/index.php
http://li###ance.net/index.php
http://th###dare.net/index.php
http://li###are.net/index.php
http://th###tell.net/index.php
http://li###ell.net/index.php
http://th###body.net/index.php
http://li###ody.net/index.php
http://fi###tell.net/index.php
http://fi###dare.net/index.php
http://so###dance.net/index.php
http://fa###such.net/index.php
http://so###dare.net/index.php
http://fi###body.net/index.php
http://so###tell.net/index.php
http://fi###dance.net/index.php
http://so###body.net/index.php
http://th###while.net/index.php
http://fe###ome.net/index.php
http://ri###nstorm.net/index.php
http://ef###tbuilt.net/index.php
http://we###even.net/index.php
http://fe###oday.net/index.php
http://we###ome.net/index.php
http://fe###even.net/index.php
http://of####urprise.net/index.php
http://de####promise.net/index.php
http://se####strong.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://ch####nother.net/index.php
http://gw#####ynhuddleston.net/index.php
http://si######edwerryhouse.net/index.php
http://mo####gduring.net/index.php
http://po###some.net/index.php
http://ca###ome.net/index.php
http://ta###such.net/index.php
http://le###uch.net/index.php
http://po###today.net/index.php
http://ca###oday.net/index.php
http://po###seven.net/index.php
http://ca###even.net/index.php
http://le###oday.net/index.php
http://we###uch.net/index.php
http://ta###some.net/index.php
http://we###oday.net/index.php
http://fe###uch.net/index.php
http://le###even.net/index.php
http://ta###today.net/index.php
http://le###ome.net/index.php
http://ta###seven.net/index.php

UDP:

DNS ASK fa###some.net
DNS ASK ri###even.net
DNS ASK li###uch.net
DNS ASK ri###ome.net
DNS ASK fa###today.net
DNS ASK ri###uch.net
DNS ASK fa###seven.net
DNS ASK ri###oday.net
DNS ASK no###uch.net
DNS ASK no###ome.net
DNS ASK li###ome.net
DNS ASK po###such.net
DNS ASK ca###uch.net
DNS ASK no###oday.net
DNS ASK li###oday.net
DNS ASK no###even.net
DNS ASK li###even.net
DNS ASK th###dance.net
DNS ASK li###ance.net
DNS ASK th###dare.net
DNS ASK li###are.net
DNS ASK th###tell.net
DNS ASK li###ell.net
DNS ASK th###body.net
DNS ASK li###ody.net
DNS ASK fi###tell.net
DNS ASK fi###dare.net
DNS ASK so###dance.net
DNS ASK fa###such.net
DNS ASK so###dare.net
DNS ASK fi###body.net
DNS ASK so###tell.net
DNS ASK fi###dance.net
DNS ASK so###body.net
DNS ASK ca###oday.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK of####urprise.net
DNS ASK ri###nstorm.net
DNS ASK fe###even.net
DNS ASK we###even.net
DNS ASK fe###ome.net
DNS ASK we###ome.net
DNS ASK de####promise.net
DNS ASK se####strong.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK ch####nother.net
DNS ASK gw#####ynhuddleston.net
DNS ASK si######edwerryhouse.net
DNS ASK mo####gduring.net
DNS ASK fe###oday.net
DNS ASK le###uch.net
DNS ASK po###some.net
DNS ASK le###oday.net
DNS ASK ta###such.net
DNS ASK ca###even.net
DNS ASK po###today.net
DNS ASK ca###ome.net
DNS ASK po###seven.net
DNS ASK we###uch.net
DNS ASK ta###some.net
DNS ASK we###oday.net
DNS ASK fe###uch.net
DNS ASK le###even.net
DNS ASK ta###today.net
DNS ASK le###ome.net
DNS ASK ta###seven.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней