Trojan.DownLoader19.16872

Добавлен в вирусную базу Dr.Web: 2016-02-04

Описание добавлено: 2016-02-04

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Connect Store Framework Office' = '<SYSTEM32>\ihnswyr.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\TPM Device Internet SNMP Multimedia Encryption] 'ImagePath' = '<SYSTEM32>\ihnswyr.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\TPM Device Internet SNMP Multimedia Encryption] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\mpddzxro.exe' "<SYSTEM32>\ihnswyr.exe"
'%WINDIR%\Temp\bwrguru2t3bfox.exe' -r 33674 tcp
'%TEMP%\bwrguru2oiefoxhjdnsfl.exe'
'<SYSTEM32>\ihnswyr.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\afhvlhquik\run
<SYSTEM32>\afhvlhquik\rng
%WINDIR%\Temp\bwrguru2t3bfox.exe
<SYSTEM32>\afhvlhquik\cfg
<SYSTEM32>\mpddzxro.exe
%TEMP%\bwrguru2oiefoxhjdnsfl.exe
<SYSTEM32>\afhvlhquik\tst
<SYSTEM32>\ihnswyr.exe
<SYSTEM32>\afhvlhquik\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\mpddzxro.exe
<SYSTEM32>\ihnswyr.exe

Удаляет следующие файлы:

%WINDIR%\Temp\bwrguru2t3bfox.exe
<DRIVERS>\etc\hosts
%TEMP%\bwrguru2oiefoxhjdnsfl.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'bo###aid.net':80
'ga###aid.net':80
'bo###loth.net':80
'ga###loth.net':80
'bo###orn.net':80
'ga###orn.net':80
'bo###ugust.net':80
'ga###ugust.net':80
'qu###born.net':80
'qu###cloth.net':80
'fi###paid.net':80
'de####erfish.net':80
'fi###cloth.net':80
'qu###august.net':80
'fi###born.net':80
'qu###paid.net':80
'fi###august.net':80
'le###cloth.net':80
'mo###august.net':80
'wa###ugust.net':80
'mo###paid.net':80
'wa###aid.net':80
'st###cloth.net':80
'we###loth.net':80
'mo###born.net':80
'wa###orn.net':80
'wa###loth.net':80
'fa###aid.net':80
'le###august.net':80
'fa###loth.net':80
'le###paid.net':80
'fa###orn.net':80
'mo###cloth.net':80
'fa###ugust.net':80
'le###born.net':80
'ti###ish.net':80
'sh###wing.net':80
'ti###ady.net':80
'mo###fish.net':80
'de###ast.net':80
'sh###lady.net':80
'de###ing.net':80
'sh###past.net':80
'mo###lady.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'mo###past.net':80
'ti###ast.net':80
'mo###wing.net':80
'ti###ing.net':80
'de###ady.net':80
'de####erwing.net':80
'al###past.net':80
'fr###yfish.net':80
'al###wing.net':80
'de####erlady.net':80
'al###fish.net':80
'de####erpast.net':80
'al###lady.net':80
'pu###ish.net':80
'pu###ing.net':80
'fr###ywing.net':80
'sh###fish.net':80
'de###ish.net':80
'pu###ady.net':80
'fr###ylady.net':80
'pu###ast.net':80
'fr###ypast.net':80

TCP:

Запросы HTTP GET:

http://bo###aid.net/index.php
http://ga###aid.net/index.php
http://bo###loth.net/index.php
http://ga###loth.net/index.php
http://bo###orn.net/index.php
http://ga###orn.net/index.php
http://bo###ugust.net/index.php
http://ga###ugust.net/index.php
http://qu###born.net/index.php
http://qu###cloth.net/index.php
http://fi###paid.net/index.php
http://de####erfish.net/index.php
http://fi###cloth.net/index.php
http://qu###august.net/index.php
http://fi###born.net/index.php
http://qu###paid.net/index.php
http://fi###august.net/index.php
http://le###cloth.net/index.php
http://mo###august.net/index.php
http://wa###ugust.net/index.php
http://mo###paid.net/index.php
http://wa###aid.net/index.php
http://st###cloth.net/index.php
http://we###loth.net/index.php
http://mo###born.net/index.php
http://wa###orn.net/index.php
http://wa###loth.net/index.php
http://fa###aid.net/index.php
http://le###august.net/index.php
http://fa###loth.net/index.php
http://le###paid.net/index.php
http://fa###orn.net/index.php
http://mo###cloth.net/index.php
http://fa###ugust.net/index.php
http://le###born.net/index.php
http://ti###ish.net/index.php
http://sh###wing.net/index.php
http://ti###ady.net/index.php
http://mo###fish.net/index.php
http://de###ast.net/index.php
http://sh###lady.net/index.php
http://de###ing.net/index.php
http://sh###past.net/index.php
http://mo###lady.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://mo###past.net/index.php
http://ti###ast.net/index.php
http://mo###wing.net/index.php
http://ti###ing.net/index.php
http://de###ady.net/index.php
http://de####erwing.net/index.php
http://al###past.net/index.php
http://fr###yfish.net/index.php
http://al###wing.net/index.php
http://de####erlady.net/index.php
http://al###fish.net/index.php
http://de####erpast.net/index.php
http://al###lady.net/index.php
http://pu###ish.net/index.php
http://pu###ing.net/index.php
http://fr###ywing.net/index.php
http://sh###fish.net/index.php
http://de###ish.net/index.php
http://pu###ady.net/index.php
http://fr###ylady.net/index.php
http://pu###ast.net/index.php
http://fr###ypast.net/index.php

UDP:

DNS ASK bo###aid.net
DNS ASK ga###aid.net
DNS ASK bo###loth.net
DNS ASK ga###loth.net
DNS ASK bo###ugust.net
DNS ASK ga###orn.net
DNS ASK le###cloth.net
DNS ASK ga###ugust.net
DNS ASK bo###orn.net
DNS ASK qu###cloth.net
DNS ASK fi###paid.net
DNS ASK de####erfish.net
DNS ASK fi###cloth.net
DNS ASK qu###paid.net
DNS ASK fi###born.net
DNS ASK qu###born.net
DNS ASK fi###august.net
DNS ASK qu###august.net
DNS ASK mo###august.net
DNS ASK wa###ugust.net
DNS ASK mo###paid.net
DNS ASK wa###aid.net
DNS ASK mo###born.net
DNS ASK we###loth.net
DNS ASK st###paid.net
DNS ASK wa###orn.net
DNS ASK st###cloth.net
DNS ASK fa###aid.net
DNS ASK le###august.net
DNS ASK fa###loth.net
DNS ASK le###paid.net
DNS ASK fa###ugust.net
DNS ASK mo###cloth.net
DNS ASK wa###loth.net
DNS ASK le###born.net
DNS ASK fa###orn.net
DNS ASK ti###ish.net
DNS ASK sh###wing.net
DNS ASK ti###ady.net
DNS ASK mo###fish.net
DNS ASK de###ast.net
DNS ASK sh###lady.net
DNS ASK de###ing.net
DNS ASK sh###past.net
DNS ASK mo###lady.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK mo###past.net
DNS ASK ti###ast.net
DNS ASK mo###wing.net
DNS ASK ti###ing.net
DNS ASK de###ady.net
DNS ASK de####erwing.net
DNS ASK al###past.net
DNS ASK fr###yfish.net
DNS ASK al###wing.net
DNS ASK de####erlady.net
DNS ASK al###fish.net
DNS ASK de####erpast.net
DNS ASK al###lady.net
DNS ASK pu###ish.net
DNS ASK pu###ing.net
DNS ASK fr###ywing.net
DNS ASK sh###fish.net
DNS ASK de###ish.net
DNS ASK pu###ady.net
DNS ASK fr###ylady.net
DNS ASK pu###ast.net
DNS ASK fr###ypast.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней