Trojan.DownLoader19.17199

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Themes Framework Task Connection' = '<SYSTEM32>\pwilkzqb.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Class Plug Tunneling Extensible Time] 'ImagePath' = '<SYSTEM32>\pwilkzqb.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Class Plug Tunneling Extensible Time] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\cgthxwka.exe' "<SYSTEM32>\pwilkzqb.exe"
'%WINDIR%\Temp\rlnq8i30yqmfphe.exe' -r 37335 tcp
'%TEMP%\rlnq8i2sp0mfphembrwqv.exe'
'<SYSTEM32>\pwilkzqb.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\raxdnqdgfpwj\run
<SYSTEM32>\raxdnqdgfpwj\rng
%WINDIR%\Temp\rlnq8i30yqmfphe.exe
<SYSTEM32>\raxdnqdgfpwj\cfg
<SYSTEM32>\cgthxwka.exe
%TEMP%\rlnq8i2sp0mfphembrwqv.exe
<SYSTEM32>\raxdnqdgfpwj\tst
<SYSTEM32>\pwilkzqb.exe
<SYSTEM32>\raxdnqdgfpwj\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\cgthxwka.exe
<SYSTEM32>\pwilkzqb.exe

Удаляет следующие файлы:

%WINDIR%\Temp\rlnq8i30yqmfphe.exe
<DRIVERS>\etc\hosts
%TEMP%\rlnq8i2sp0mfphembrwqv.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'le###reach.net':80
'fa###each.net':80
'fa###aise.net':80
'fa###roud.net':80
'le###raise.net':80
'mo###price.net':80
'mo###raise.net':80
'wa###aise.net':80
'wa###roud.net':80
'wa###rice.net':80
'mo###croud.net':80
'ga###roud.net':80
'bo###aise.net':80
'bo###roud.net':80
'bo###rice.net':80
'ga###rice.net':80
'ga###aise.net':80
'fa###rice.net':80
'le###croud.net':80
'le###price.net':80
'bo###each.net':80
'ga###each.net':80
'af###raise.net':80
'fo###raise.net':80
'fo###croud.net':80
'fo###price.net':80
'af###croud.net':80
'af###reach.net':80
'se###roud.net':80
'we####daycroud.net':80
'we####dayprice.net':80
'fo###reach.net':80
'se###rice.net':80
'we###rice.net':80
'st###croud.net':80
'st###price.net':80
'mo###reach.net':80
'wa###each.net':80
'we###roud.net':80
'we###each.net':80
'af###price.net':80
'st###reach.net':80
'st###raise.net':80
'we###aise.net':80
'qu###reach.net':80
'fo###cloth.net':80
'af###paid.net':80
'af###cloth.net':80
'al###being.net':80
'ri###nstorm.net':80
'fo###paid.net':80
'fo###born.net':80
'se###loth.net':80
'af###born.net':80
'af###august.net':80
'fo###august.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'jo####ymeasure.net':80
'ef###tbuilt.net':80
'th###while.net':80
'mo###ugust.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'mo###olor.net':80
'mi###hown.net':80
'ab###ell.net':80
'na###orn.net':80
'fi###price.net':80
'dr###born.net':80
'dr###august.net':80
'na###ugust.net':80
'qu###price.net':80
'qu###raise.net':80
'fi###reach.net':80
'fi###raise.net':80
'fi###croud.net':80
'qu###croud.net':80
'se###ugust.net':80
'we####dayaugust.net':80
'we####daypaid.net':80
'we####daycloth.net':80
'se###aid.net':80
'se###orn.net':80
'dr###paid.net':80
'na###aid.net':80
'na###loth.net':80
'we####dayborn.net':80
'dr###cloth.net':80

TCP:

Запросы HTTP GET:

http://le###reach.net/index.php
http://fa###each.net/index.php
http://fa###aise.net/index.php
http://fa###roud.net/index.php
http://le###raise.net/index.php
http://mo###price.net/index.php
http://mo###raise.net/index.php
http://wa###aise.net/index.php
http://wa###roud.net/index.php
http://wa###rice.net/index.php
http://mo###croud.net/index.php
http://ga###roud.net/index.php
http://bo###aise.net/index.php
http://bo###roud.net/index.php
http://bo###rice.net/index.php
http://ga###rice.net/index.php
http://ga###aise.net/index.php
http://fa###rice.net/index.php
http://le###croud.net/index.php
http://le###price.net/index.php
http://bo###each.net/index.php
http://ga###each.net/index.php
http://af###raise.net/index.php
http://fo###raise.net/index.php
http://fo###croud.net/index.php
http://fo###price.net/index.php
http://af###croud.net/index.php
http://af###reach.net/index.php
http://se###roud.net/index.php
http://we####daycroud.net/index.php
http://we####dayprice.net/index.php
http://fo###reach.net/index.php
http://se###rice.net/index.php
http://we###rice.net/index.php
http://st###croud.net/index.php
http://st###price.net/index.php
http://mo###reach.net/index.php
http://wa###each.net/index.php
http://we###roud.net/index.php
http://we###each.net/index.php
http://af###price.net/index.php
http://st###reach.net/index.php
http://st###raise.net/index.php
http://we###aise.net/index.php
http://qu###reach.net/index.php
http://fo###cloth.net/index.php
http://af###paid.net/index.php
http://af###cloth.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://fo###paid.net/index.php
http://fo###born.net/index.php
http://se###loth.net/index.php
http://af###born.net/index.php
http://af###august.net/index.php
http://fo###august.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://jo####ymeasure.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://mo###ugust.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://mo###olor.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://na###orn.net/index.php
http://fi###price.net/index.php
http://dr###born.net/index.php
http://dr###august.net/index.php
http://na###ugust.net/index.php
http://qu###price.net/index.php
http://qu###raise.net/index.php
http://fi###reach.net/index.php
http://fi###raise.net/index.php
http://fi###croud.net/index.php
http://qu###croud.net/index.php
http://se###ugust.net/index.php
http://we####dayaugust.net/index.php
http://we####daypaid.net/index.php
http://we####daycloth.net/index.php
http://se###aid.net/index.php
http://se###orn.net/index.php
http://dr###paid.net/index.php
http://na###aid.net/index.php
http://na###loth.net/index.php
http://we####dayborn.net/index.php
http://dr###cloth.net/index.php

UDP:

DNS ASK le###reach.net
DNS ASK fa###each.net
DNS ASK fa###aise.net
DNS ASK fa###roud.net
DNS ASK le###raise.net
DNS ASK mo###price.net
DNS ASK mo###raise.net
DNS ASK wa###aise.net
DNS ASK wa###roud.net
DNS ASK wa###rice.net
DNS ASK mo###croud.net
DNS ASK ga###roud.net
DNS ASK bo###aise.net
DNS ASK bo###roud.net
DNS ASK bo###rice.net
DNS ASK ga###rice.net
DNS ASK ga###aise.net
DNS ASK fa###rice.net
DNS ASK le###croud.net
DNS ASK le###price.net
DNS ASK bo###each.net
DNS ASK ga###each.net
DNS ASK mo###reach.net
DNS ASK fo###raise.net
DNS ASK af###reach.net
DNS ASK af###raise.net
DNS ASK af###croud.net
DNS ASK fo###croud.net
DNS ASK fo###reach.net
DNS ASK we####daycroud.net
DNS ASK se###aise.net
DNS ASK se###roud.net
DNS ASK se###rice.net
DNS ASK we####dayprice.net
DNS ASK st###croud.net
DNS ASK we###roud.net
DNS ASK we###rice.net
DNS ASK wa###each.net
DNS ASK st###price.net
DNS ASK st###raise.net
DNS ASK af###price.net
DNS ASK fo###price.net
DNS ASK we###each.net
DNS ASK we###aise.net
DNS ASK st###reach.net
DNS ASK qu###reach.net
DNS ASK fo###cloth.net
DNS ASK af###paid.net
DNS ASK af###cloth.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK fo###paid.net
DNS ASK fo###born.net
DNS ASK se###loth.net
DNS ASK af###born.net
DNS ASK af###august.net
DNS ASK fo###august.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK jo####ymeasure.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK mo###ugust.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK mo###olor.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK na###orn.net
DNS ASK fi###price.net
DNS ASK dr###born.net
DNS ASK dr###august.net
DNS ASK na###ugust.net
DNS ASK qu###price.net
DNS ASK qu###raise.net
DNS ASK fi###reach.net
DNS ASK fi###raise.net
DNS ASK fi###croud.net
DNS ASK qu###croud.net
DNS ASK se###ugust.net
DNS ASK we####dayaugust.net
DNS ASK we####daypaid.net
DNS ASK we####daycloth.net
DNS ASK se###aid.net
DNS ASK se###orn.net
DNS ASK dr###paid.net
DNS ASK na###aid.net
DNS ASK na###loth.net
DNS ASK we####dayborn.net
DNS ASK dr###cloth.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней