Trojan.DownLoader19.16664

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Gateway IKE Propagation Helper' = 'C:\qplskcdyvmquo\ybtiejkyskl.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Visual Audio Drive AutoConfig] 'ImagePath' = 'C:\qplskcdyvmquo\ybtiejkyskl.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Visual Audio Drive AutoConfig] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'C:\qplskcdyvmquo\gtpmmny.exe' "c:\qplskcdyvmquo\ybtiejkyskl.exe"
'C:\qplskcdyvmquo\ybtiejkyskl.exe'
'C:\qplskcdyvmquo\in3a77oklhfdeuwc.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\qplskcdyvmquo\ybtiejkyskl.exe
C:\qplskcdyvmquo\gtpmmny.exe
C:\qplskcdyvmquo\xw1uz2eorxi
%WINDIR%\qplskcdyvmquo\r3ozptluhiex
C:\qplskcdyvmquo\r3ozptluhiex
C:\qplskcdyvmquo\in3a77oklhfdeuwc.exe

Присваивает атрибут 'скрытый' для следующих файлов:

C:\qplskcdyvmquo\gtpmmny.exe
C:\qplskcdyvmquo\ybtiejkyskl.exe

Удаляет следующие файлы:

C:\qplskcdyvmquo\in3a77oklhfdeuwc.exe
%WINDIR%\qplskcdyvmquo\r3ozptluhiex

Подменяет следующие файлы:

%WINDIR%\qplskcdyvmquo\r3ozptluhiex

Сетевая активность:

Подключается к:

'fo####public.net':80
'me####public.net':80
'fo####eearly.net':80
'me####eearly.net':80
'fo###wdress.net':80
'kn###catch.net':80
'be###eearly.net':80
'me###rdress.net':80
'be###catch.net':80
'me###rcatch.net':80
'ge####maneearly.net':80
'al####yeearly.net':80
'ge####mancatch.net':80
'al####ycatch.net':80
'ge####manpublic.net':80
'al####ydress.net':80
'fo###wcatch.net':80
'al####ypublic.net':80
'ge####mandress.net':80
'cr###dress.net':80
'th####tcatch.net':80
'cr###public.net':80
'su###rdress.net':80
'wa###catch.net':80
'th####tpublic.net':80
'wa###public.net':80
'th####teearly.net':80
'wa###eearly.net':80
'su####public.net':80
'kn###public.net':80
'be###dress.net':80
'kn###eearly.net':80
'be###public.net':80
'kn###dress.net':80
'su####eearly.net':80
'cr###eearly.net':80
'su###rcatch.net':80
'cr###catch.net':80
'ex####encedress.net':80
'wa####lothes.net':80
'th####tdistant.net':80
'wa###health.net':80
'th####tclothes.net':80
'wa####istant.net':80
'wo###health.net':80
'sm###health.net':80
'wo####eparate.net':80
'sm####eparate.net':80
'th####thealth.net':80
'cr###health.net':80
'su####clothes.net':80
'cr####eparate.net':80
'su####health.net':80
'cr####lothes.net':80
'th####tseparate.net':80
'wa####eparate.net':80
'su####distant.net':80
'cr####istant.net':80
'fr###catch.net':80
'ex####encecatch.net':80
'pa####istant.net':80
'fi####istant.net':80
'fr###eearly.net':80
'ex#####ncepublic.net':80
'fr###dress.net':80
'ex#####nceeearly.net':80
'fr###public.net':80
'fi####lothes.net':80
'wo####istant.net':80
'sm####istant.net':80
'wo####lothes.net':80
'sm####lothes.net':80
'pa####eparate.net':80
'fi###health.net':80
'pa####lothes.net':80
'fi####eparate.net':80
'pa###health.net':80

TCP:

Запросы HTTP GET:

http://fo####public.net/index.php
http://me####public.net/index.php
http://fo####eearly.net/index.php
http://me####eearly.net/index.php
http://fo###wdress.net/index.php
http://kn###catch.net/index.php
http://be###eearly.net/index.php
http://me###rdress.net/index.php
http://be###catch.net/index.php
http://me###rcatch.net/index.php
http://ge####maneearly.net/index.php
http://al####yeearly.net/index.php
http://ge####mancatch.net/index.php
http://al####ycatch.net/index.php
http://ge####manpublic.net/index.php
http://al####ydress.net/index.php
http://fo###wcatch.net/index.php
http://al####ypublic.net/index.php
http://ge####mandress.net/index.php
http://cr###dress.net/index.php
http://th####tcatch.net/index.php
http://cr###public.net/index.php
http://su###rdress.net/index.php
http://wa###catch.net/index.php
http://th####tpublic.net/index.php
http://wa###public.net/index.php
http://th####teearly.net/index.php
http://wa###eearly.net/index.php
http://su####public.net/index.php
http://kn###public.net/index.php
http://be###dress.net/index.php
http://kn###eearly.net/index.php
http://be###public.net/index.php
http://kn###dress.net/index.php
http://su####eearly.net/index.php
http://cr###eearly.net/index.php
http://su###rcatch.net/index.php
http://cr###catch.net/index.php
http://ex####encedress.net/index.php
http://wa####lothes.net/index.php
http://th####tdistant.net/index.php
http://wa###health.net/index.php
http://th####tclothes.net/index.php
http://wa####istant.net/index.php
http://wo###health.net/index.php
http://sm###health.net/index.php
http://wo####eparate.net/index.php
http://sm####eparate.net/index.php
http://th####thealth.net/index.php
http://cr###health.net/index.php
http://su####clothes.net/index.php
http://cr####eparate.net/index.php
http://su####health.net/index.php
http://cr####lothes.net/index.php
http://th####tseparate.net/index.php
http://wa####eparate.net/index.php
http://su####distant.net/index.php
http://cr####istant.net/index.php
http://fr###catch.net/index.php
http://ex####encecatch.net/index.php
http://pa####istant.net/index.php
http://fi####istant.net/index.php
http://fr###eearly.net/index.php
http://ex#####ncepublic.net/index.php
http://fr###dress.net/index.php
http://ex#####nceeearly.net/index.php
http://fr###public.net/index.php
http://fi####lothes.net/index.php
http://wo####istant.net/index.php
http://sm####istant.net/index.php
http://wo####lothes.net/index.php
http://sm####lothes.net/index.php
http://pa####eparate.net/index.php
http://fi###health.net/index.php
http://pa####lothes.net/index.php
http://fi####eparate.net/index.php
http://pa###health.net/index.php

UDP:

DNS ASK fo####public.net
DNS ASK me####public.net
DNS ASK fo####eearly.net
DNS ASK me####eearly.net
DNS ASK fo###wdress.net
DNS ASK kn###catch.net
DNS ASK be###eearly.net
DNS ASK me###rdress.net
DNS ASK be###catch.net
DNS ASK me###rcatch.net
DNS ASK ge####maneearly.net
DNS ASK al####yeearly.net
DNS ASK ge####mancatch.net
DNS ASK al####ycatch.net
DNS ASK ge####manpublic.net
DNS ASK al####ydress.net
DNS ASK fo###wcatch.net
DNS ASK al####ypublic.net
DNS ASK ge####mandress.net
DNS ASK kn###eearly.net
DNS ASK th####tcatch.net
DNS ASK wa###catch.net
DNS ASK su###rdress.net
DNS ASK cr###dress.net
DNS ASK th####teearly.net
DNS ASK wa###public.net
DNS ASK th####tdress.net
DNS ASK wa###eearly.net
DNS ASK th####tpublic.net
DNS ASK cr###public.net
DNS ASK be###dress.net
DNS ASK kn###dress.net
DNS ASK be###public.net
DNS ASK kn###public.net
DNS ASK su###rcatch.net
DNS ASK cr###eearly.net
DNS ASK su####public.net
DNS ASK cr###catch.net
DNS ASK su####eearly.net
DNS ASK wa####lothes.net
DNS ASK th####tdistant.net
DNS ASK wa###health.net
DNS ASK th####tclothes.net
DNS ASK wa####istant.net
DNS ASK wo###health.net
DNS ASK sm###health.net
DNS ASK wo####eparate.net
DNS ASK sm####eparate.net
DNS ASK th####thealth.net
DNS ASK cr###health.net
DNS ASK su####clothes.net
DNS ASK cr####eparate.net
DNS ASK su####health.net
DNS ASK cr####lothes.net
DNS ASK th####tseparate.net
DNS ASK wa####eparate.net
DNS ASK su####distant.net
DNS ASK cr####istant.net
DNS ASK wo####lothes.net
DNS ASK ex####encecatch.net
DNS ASK fr###eearly.net
DNS ASK fi####istant.net
DNS ASK fr###catch.net
DNS ASK ex#####nceeearly.net
DNS ASK fr###dress.net
DNS ASK ex####encedress.net
DNS ASK fr###public.net
DNS ASK ex#####ncepublic.net
DNS ASK pa####istant.net
DNS ASK sm####istant.net
DNS ASK pa####eparate.net
DNS ASK sm####lothes.net
DNS ASK wo####istant.net
DNS ASK fi####eparate.net
DNS ASK pa####lothes.net
DNS ASK fi####lothes.net
DNS ASK pa###health.net
DNS ASK fi###health.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней