Trojan.DownLoader19.16550

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Panel AutoConnect Sharing' = '<SYSTEM32>\gtzolnws.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Manager IP Task RPC Connectivity Encrypting] 'ImagePath' = '<SYSTEM32>\gtzolnws.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Manager IP Task RPC Connectivity Encrypting] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\zqwddnaneuvs.exe' "<SYSTEM32>\gtzolnws.exe"
'%WINDIR%\Temp\liyhojc2omabg0.exe' -r 44850 tcp
'%TEMP%\liyhojc2jybbg0rla2rpx.exe'
'<SYSTEM32>\gtzolnws.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\yscnrxca\run
<SYSTEM32>\yscnrxca\rng
%WINDIR%\Temp\liyhojc2omabg0.exe
<SYSTEM32>\yscnrxca\cfg
<SYSTEM32>\zqwddnaneuvs.exe
%TEMP%\liyhojc2jybbg0rla2rpx.exe
<SYSTEM32>\yscnrxca\tst
<SYSTEM32>\gtzolnws.exe
<SYSTEM32>\yscnrxca\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\zqwddnaneuvs.exe
<SYSTEM32>\gtzolnws.exe

Удаляет следующие файлы:

%WINDIR%\Temp\liyhojc2omabg0.exe
<DRIVERS>\etc\hosts
%TEMP%\liyhojc2jybbg0rla2rpx.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'de###uide.net':80
'sh###late.net':80
'sh###guide.net':80
'sh###name.net':80
'de###ame.net':80
'de###ate.net':80
'fr###yname.net':80
'pu###uide.net':80
'pu###ame.net':80
'pu###alf.net':80
'fr###yhalf.net':80
'mo###name.net':80
'ti###ame.net':80
'ti###alf.net':80
'li###ate.net':80
'mo###half.net':80
'mo###guide.net':80
'sh###half.net':80
'de###alf.net':80
'ti###ate.net':80
'ti###uide.net':80
'mo###late.net':80
'so###ast.net':80
'lo###ady.net':80
'lo###ast.net':80
'lo###ing.net':80
'so###ing.net':80
'so###ady.net':80
'sa###ing.net':80
'wh###past.net':80
'wh###wing.net':80
'lo###ish.net':80
'so###ish.net':80
'al###half.net':80
'de####erhalf.net':80
'fr###ylate.net':80
'fr###yguide.net':80
'pu###ate.net':80
'al###name.net':80
'al###late.net':80
'de####erlate.net':80
'de####erguide.net':80
'de####ername.net':80
'al###guide.net':80
'so###alf.net':80
'lo###ame.net':80
'lo###alf.net':80
'al###only.net':80
'de####eronly.net':80
'so###ame.net':80
'so###ate.net':80
'wh###half.net':80
'lo###ate.net':80
'lo###uide.net':80
'so###uide.net':80
'mi###hown.net':80
'ab###ell.net':80
'mo###ugust.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'mo###olor.net':80
'ri###nstorm.net':80
'be##lxc.com':80
'al###being.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'ba###ate.net':80
'en###half.net':80
'st###late.net':80
'st###guide.net':80
'ba###uide.net':80
'li###alf.net':80
'li###uide.net':80
'en###late.net':80
'en###guide.net':80
'en###name.net':80
'li###ame.net':80
'wh###guide.net':80
'sa###uide.net':80
'sa###ame.net':80
'sa###alf.net':80
'wh###name.net':80
'wh###late.net':80
'st###name.net':80
'ba###ame.net':80
'ba###alf.net':80
'sa###ate.net':80
'st###half.net':80

TCP:

Запросы HTTP GET:

http://de###uide.net/index.php
http://sh###late.net/index.php
http://sh###guide.net/index.php
http://sh###name.net/index.php
http://de###ame.net/index.php
http://de###ate.net/index.php
http://fr###yname.net/index.php
http://pu###uide.net/index.php
http://pu###ame.net/index.php
http://pu###alf.net/index.php
http://fr###yhalf.net/index.php
http://mo###name.net/index.php
http://ti###ame.net/index.php
http://ti###alf.net/index.php
http://li###ate.net/index.php
http://mo###half.net/index.php
http://mo###guide.net/index.php
http://sh###half.net/index.php
http://de###alf.net/index.php
http://ti###ate.net/index.php
http://ti###uide.net/index.php
http://mo###late.net/index.php
http://so###ast.net/index.php
http://lo###ady.net/index.php
http://lo###ast.net/index.php
http://lo###ing.net/index.php
http://so###ing.net/index.php
http://so###ady.net/index.php
http://sa###ing.net/index.php
http://wh###past.net/index.php
http://wh###wing.net/index.php
http://lo###ish.net/index.php
http://so###ish.net/index.php
http://al###half.net/index.php
http://de####erhalf.net/index.php
http://fr###ylate.net/index.php
http://fr###yguide.net/index.php
http://pu###ate.net/index.php
http://al###name.net/index.php
http://al###late.net/index.php
http://de####erlate.net/index.php
http://de####erguide.net/index.php
http://de####ername.net/index.php
http://al###guide.net/index.php
http://so###alf.net/index.php
http://lo###ame.net/index.php
http://lo###alf.net/index.php
http://al###only.net/index.php
http://de####eronly.net/index.php
http://so###ame.net/index.php
http://so###ate.net/index.php
http://wh###half.net/index.php
http://lo###ate.net/index.php
http://lo###uide.net/index.php
http://so###uide.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://mo###ugust.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://mo###olor.net/index.php
http://ri###nstorm.net/index.php
http://be##lxc.com/index.php
http://al###being.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://ba###ate.net/index.php
http://en###half.net/index.php
http://st###late.net/index.php
http://st###guide.net/index.php
http://ba###uide.net/index.php
http://li###alf.net/index.php
http://li###uide.net/index.php
http://en###late.net/index.php
http://en###guide.net/index.php
http://en###name.net/index.php
http://li###ame.net/index.php
http://wh###guide.net/index.php
http://sa###uide.net/index.php
http://sa###ame.net/index.php
http://sa###alf.net/index.php
http://wh###name.net/index.php
http://wh###late.net/index.php
http://st###name.net/index.php
http://ba###ame.net/index.php
http://ba###alf.net/index.php
http://sa###ate.net/index.php
http://st###half.net/index.php

UDP:

DNS ASK de###uide.net
DNS ASK sh###late.net
DNS ASK sh###guide.net
DNS ASK sh###name.net
DNS ASK de###ame.net
DNS ASK de###ate.net
DNS ASK fr###yname.net
DNS ASK pu###uide.net
DNS ASK pu###ame.net
DNS ASK pu###alf.net
DNS ASK fr###yhalf.net
DNS ASK mo###name.net
DNS ASK ti###ame.net
DNS ASK ti###alf.net
DNS ASK li###ate.net
DNS ASK mo###half.net
DNS ASK mo###guide.net
DNS ASK sh###half.net
DNS ASK de###alf.net
DNS ASK ti###ate.net
DNS ASK ti###uide.net
DNS ASK mo###late.net
DNS ASK fr###yguide.net
DNS ASK lo###ady.net
DNS ASK so###ady.net
DNS ASK so###ast.net
DNS ASK so###ing.net
DNS ASK lo###ast.net
DNS ASK lo###ish.net
DNS ASK wh###past.net
DNS ASK sa###ast.net
DNS ASK sa###ing.net
DNS ASK so###ish.net
DNS ASK wh###wing.net
DNS ASK de####erhalf.net
DNS ASK al###name.net
DNS ASK al###half.net
DNS ASK pu###ate.net
DNS ASK fr###ylate.net
DNS ASK de####ername.net
DNS ASK de####erlate.net
DNS ASK lo###ing.net
DNS ASK al###late.net
DNS ASK al###guide.net
DNS ASK de####erguide.net
DNS ASK so###alf.net
DNS ASK lo###ame.net
DNS ASK lo###alf.net
DNS ASK al###only.net
DNS ASK de####eronly.net
DNS ASK so###ame.net
DNS ASK so###ate.net
DNS ASK wh###half.net
DNS ASK lo###ate.net
DNS ASK lo###uide.net
DNS ASK so###uide.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK mo###ugust.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK mo###olor.net
DNS ASK ri###nstorm.net
DNS ASK be##lxc.com
DNS ASK al###being.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK ba###ate.net
DNS ASK en###half.net
DNS ASK st###late.net
DNS ASK st###guide.net
DNS ASK ba###uide.net
DNS ASK li###alf.net
DNS ASK li###uide.net
DNS ASK en###late.net
DNS ASK en###guide.net
DNS ASK en###name.net
DNS ASK li###ame.net
DNS ASK wh###guide.net
DNS ASK sa###uide.net
DNS ASK sa###ame.net
DNS ASK sa###alf.net
DNS ASK wh###name.net
DNS ASK wh###late.net
DNS ASK st###name.net
DNS ASK ba###ame.net
DNS ASK ba###alf.net
DNS ASK sa###ate.net
DNS ASK st###half.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней