Trojan.DownLoader19.16824

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Parental WebClient Protocol' = 'C:\vplkospzcllnbj\lnodvrq.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Wired Browser Management SPP Scheduler] 'ImagePath' = 'C:\vplkospzcllnbj\lnodvrq.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Wired Browser Management SPP Scheduler] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'C:\vplkospzcllnbj\qbufoxihvq.exe' "c:\vplkospzcllnbj\lnodvrq.exe"
'C:\vplkospzcllnbj\lnodvrq.exe'
'C:\vplkospzcllnbj\qpd0344gerwovz8sntvxr.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\vplkospzcllnbj\lnodvrq.exe
C:\vplkospzcllnbj\qbufoxihvq.exe
C:\vplkospzcllnbj\qpd0344gerwovz8sntvxr.exe
%WINDIR%\vplkospzcllnbj\tybqhrl2h
C:\vplkospzcllnbj\tybqhrl2h

Присваивает атрибут 'скрытый' для следующих файлов:

C:\vplkospzcllnbj\qbufoxihvq.exe
C:\vplkospzcllnbj\lnodvrq.exe

Удаляет следующие файлы:

C:\vplkospzcllnbj\qpd0344gerwovz8sntvxr.exe
%WINDIR%\vplkospzcllnbj\tybqhrl2h

Подменяет следующие файлы:

%WINDIR%\vplkospzcllnbj\tybqhrl2h

Сетевая активность:

Подключается к:

'se####during.net':80
'la###during.net':80
'la###indeed.net':80
'la###notice.net':80
'se####indeed.net':80
'mo####notice.net':80
'si####indeed.net':80
'si####notice.net':80
'si####length.net':80
'mo####length.net':80
'pa###public.net':80
'fi###public.net':80
'fi###eearly.net':80
'fi###catch.net':80
'pa###eearly.net':80
'la###length.net':80
'se####notice.net':80
'se####length.net':80
'pa###dress.net':80
'fi###dress.net':80
'pe####snotice.net':80
'wi####notice.net':80
'wi####length.net':80
'po####leduring.net':80
'pe####slength.net':80
'wi####during.net':80
'su####tlength.net':80
'pe####sduring.net':80
'pe####sindeed.net':80
'wi####indeed.net':80
'mo####inlength.net':80
'po####lelength.net':80
'mo####during.net':80
'mo####indeed.net':80
'si####during.net':80
'po####leindeed.net':80
'mo####induring.net':80
'mo####inindeed.net':80
'mo####innotice.net':80
'po####lenotice.net':80
'pa###catch.net':80
'kn###public.net':80
'be###dress.net':80
'be###public.net':80
'be###eearly.net':80
'kn###eearly.net':80
'su####eearly.net':80
'cr###eearly.net':80
'cr###catch.net':80
'kn###dress.net':80
'su###rcatch.net':80
'me####eearly.net':80
'fo####public.net':80
'fo####eearly.net':80
'fo###wcatch.net':80
'me###rcatch.net':80
'be###catch.net':80
'kn###catch.net':80
'me###rdress.net':80
'me####public.net':80
'fo###wdress.net':80
'sm###catch.net':80
'wo###eearly.net':80
'wo###catch.net':80
'th####tdress.net':80
'wa###dress.net':80
'wo###dress.net':80
'sm###dress.net':80
'sm###public.net':80
'sm###eearly.net':80
'wo###public.net':80
'cr###dress.net':80
'th####tcatch.net':80
'su###rdress.net':80
'su####public.net':80
'cr###public.net':80
'th####tpublic.net':80
'wa###public.net':80
'wa###eearly.net':80
'wa###catch.net':80
'th####teearly.net':80

TCP:

Запросы HTTP GET:

http://se####during.net/index.php
http://la###during.net/index.php
http://la###indeed.net/index.php
http://la###notice.net/index.php
http://se####indeed.net/index.php
http://mo####notice.net/index.php
http://si####indeed.net/index.php
http://si####notice.net/index.php
http://si####length.net/index.php
http://mo####length.net/index.php
http://pa###public.net/index.php
http://fi###public.net/index.php
http://fi###eearly.net/index.php
http://fi###catch.net/index.php
http://pa###eearly.net/index.php
http://la###length.net/index.php
http://se####notice.net/index.php
http://se####length.net/index.php
http://pa###dress.net/index.php
http://fi###dress.net/index.php
http://pe####snotice.net/index.php
http://wi####notice.net/index.php
http://wi####length.net/index.php
http://po####leduring.net/index.php
http://pe####slength.net/index.php
http://wi####during.net/index.php
http://su####tlength.net/index.php
http://pe####sduring.net/index.php
http://pe####sindeed.net/index.php
http://wi####indeed.net/index.php
http://mo####inlength.net/index.php
http://po####lelength.net/index.php
http://mo####during.net/index.php
http://mo####indeed.net/index.php
http://si####during.net/index.php
http://po####leindeed.net/index.php
http://mo####induring.net/index.php
http://mo####inindeed.net/index.php
http://mo####innotice.net/index.php
http://po####lenotice.net/index.php
http://pa###catch.net/index.php
http://kn###public.net/index.php
http://be###dress.net/index.php
http://be###public.net/index.php
http://be###eearly.net/index.php
http://kn###eearly.net/index.php
http://su####eearly.net/index.php
http://cr###eearly.net/index.php
http://cr###catch.net/index.php
http://kn###dress.net/index.php
http://su###rcatch.net/index.php
http://me####eearly.net/index.php
http://fo####public.net/index.php
http://fo####eearly.net/index.php
http://fo###wcatch.net/index.php
http://me###rcatch.net/index.php
http://be###catch.net/index.php
http://kn###catch.net/index.php
http://me###rdress.net/index.php
http://me####public.net/index.php
http://fo###wdress.net/index.php
http://sm###catch.net/index.php
http://wo###eearly.net/index.php
http://wo###catch.net/index.php
http://th####tdress.net/index.php
http://wa###dress.net/index.php
http://wo###dress.net/index.php
http://sm###dress.net/index.php
http://sm###public.net/index.php
http://sm###eearly.net/index.php
http://wo###public.net/index.php
http://cr###dress.net/index.php
http://th####tcatch.net/index.php
http://su###rdress.net/index.php
http://su####public.net/index.php
http://cr###public.net/index.php
http://th####tpublic.net/index.php
http://wa###public.net/index.php
http://wa###eearly.net/index.php
http://wa###catch.net/index.php
http://th####teearly.net/index.php

UDP:

DNS ASK se####during.net
DNS ASK la###during.net
DNS ASK la###indeed.net
DNS ASK la###notice.net
DNS ASK se####indeed.net
DNS ASK mo####notice.net
DNS ASK si####indeed.net
DNS ASK si####notice.net
DNS ASK si####length.net
DNS ASK mo####length.net
DNS ASK pa###public.net
DNS ASK fi###public.net
DNS ASK fi###eearly.net
DNS ASK fi###catch.net
DNS ASK pa###eearly.net
DNS ASK la###length.net
DNS ASK se####notice.net
DNS ASK se####length.net
DNS ASK pa###dress.net
DNS ASK fi###dress.net
DNS ASK pe####snotice.net
DNS ASK wi####notice.net
DNS ASK wi####length.net
DNS ASK po####leduring.net
DNS ASK pe####slength.net
DNS ASK wi####during.net
DNS ASK su####tlength.net
DNS ASK pe####sduring.net
DNS ASK pe####sindeed.net
DNS ASK wi####indeed.net
DNS ASK mo####inlength.net
DNS ASK po####lelength.net
DNS ASK mo####during.net
DNS ASK mo####indeed.net
DNS ASK si####during.net
DNS ASK po####leindeed.net
DNS ASK mo####induring.net
DNS ASK mo####inindeed.net
DNS ASK mo####innotice.net
DNS ASK po####lenotice.net
DNS ASK pa###catch.net
DNS ASK kn###public.net
DNS ASK be###dress.net
DNS ASK be###public.net
DNS ASK be###eearly.net
DNS ASK kn###eearly.net
DNS ASK su####eearly.net
DNS ASK cr###eearly.net
DNS ASK cr###catch.net
DNS ASK kn###dress.net
DNS ASK su###rcatch.net
DNS ASK me####eearly.net
DNS ASK fo####public.net
DNS ASK fo####eearly.net
DNS ASK fo###wcatch.net
DNS ASK me###rcatch.net
DNS ASK be###catch.net
DNS ASK kn###catch.net
DNS ASK me###rdress.net
DNS ASK me####public.net
DNS ASK fo###wdress.net
DNS ASK sm###catch.net
DNS ASK wo###eearly.net
DNS ASK wo###catch.net
DNS ASK th####tdress.net
DNS ASK wa###dress.net
DNS ASK wo###dress.net
DNS ASK sm###dress.net
DNS ASK sm###public.net
DNS ASK sm###eearly.net
DNS ASK wo###public.net
DNS ASK cr###dress.net
DNS ASK th####tcatch.net
DNS ASK su###rdress.net
DNS ASK su####public.net
DNS ASK cr###public.net
DNS ASK th####tpublic.net
DNS ASK wa###public.net
DNS ASK wa###eearly.net
DNS ASK wa###catch.net
DNS ASK th####teearly.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней