Trojan.DownLoader19.28607

Добавлен в вирусную базу Dr.Web: 2016-02-19

Описание добавлено: 2016-02-18

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Profile PnP-X IP Bluetooth User-mode Service' = '<SYSTEM32>\asvljlx.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Distributed Counter Shadow] 'ImagePath' = '<SYSTEM32>\asvljlx.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Distributed Counter Shadow] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\xlyxgrpckhe.exe' "<SYSTEM32>\asvljlx.exe"
'%WINDIR%\Temp\mpmbfwz2t4meneno.exe' -r 35472 tcp
'%TEMP%\mpmbfwz2oo1enenokggjvc.exe'
'<SYSTEM32>\asvljlx.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\nekialyocxsiech\run
<SYSTEM32>\nekialyocxsiech\rng
%WINDIR%\Temp\mpmbfwz2t4meneno.exe
<SYSTEM32>\nekialyocxsiech\cfg
<SYSTEM32>\xlyxgrpckhe.exe
%TEMP%\mpmbfwz2oo1enenokggjvc.exe
<SYSTEM32>\nekialyocxsiech\tst
<SYSTEM32>\asvljlx.exe
<SYSTEM32>\nekialyocxsiech\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\xlyxgrpckhe.exe
<SYSTEM32>\asvljlx.exe

Удаляет следующие файлы:

%WINDIR%\Temp\mpmbfwz2t4meneno.exe
<DRIVERS>\etc\hosts
%TEMP%\mpmbfwz2oo1enenokggjvc.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

've###age.net':80
'pi###happy.net':80
've###ince.net':80
'we###age.net':80
'mu###appy.net':80
'pi###since.net':80
'mu###ince.net':80
'pi###heat.net':80
'mu###eat.net':80
'we###ince.net':80
'fa###ince.net':80
'to###age.net':80
'fa###eat.net':80
'to###ince.net':80
'fa###age.net':80
'we###eat.net':80
've###eat.net':80
'we###appy.net':80
've###appy.net':80
'pi###page.net':80
'yo###ive.net':80
'tr###eight.net':80
'yo###oice.net':80
'tr###five.net':80
'yo###ight.net':80
'lr###voice.net':80
'vi###oice.net':80
'tr###they.net':80
'yo###hey.net':80
'tr###voice.net':80
'ta###appy.net':80
'wa###eat.net':80
'mu###age.net':80
'wa###appy.net':80
'ta###eat.net':80
'wa###age.net':80
'ta###age.net':80
'wa###ince.net':80
'ta###ince.net':80
'to###eat.net':80
'yo###age.net':80
'lr###happy.net':80
'yo###ince.net':80
'tr###page.net':80
'vi###appy.net':80
'lr###since.net':80
'vi###ince.net':80
'lr###heat.net':80
'vi###eat.net':80
'tr###since.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'ta###and.net':80
'tr###heat.net':80
'yo###eat.net':80
'tr###happy.net':80
'yo###appy.net':80
'lr###page.net':80
'le###heat.net':80
'se###since.net':80
'le###happy.net':80
'se###heat.net':80
'le###since.net':80
'to###appy.net':80
'fa###appy.net':80
'se###page.net':80
'le###page.net':80
'se###happy.net':80
'fi###appy.net':80
'pl###heat.net':80
'vi###age.net':80
'pl###happy.net':80
'fi###eat.net':80
'pl###page.net':80
'fi###age.net':80
'pl###since.net':80
'fi###ince.net':80

TCP:

Запросы HTTP GET:

http://ve###age.net/index.php
http://pi###happy.net/index.php
http://ve###ince.net/index.php
http://we###age.net/index.php
http://mu###appy.net/index.php
http://pi###since.net/index.php
http://mu###ince.net/index.php
http://pi###heat.net/index.php
http://mu###eat.net/index.php
http://we###ince.net/index.php
http://fa###ince.net/index.php
http://to###age.net/index.php
http://fa###eat.net/index.php
http://to###ince.net/index.php
http://fa###age.net/index.php
http://we###eat.net/index.php
http://ve###eat.net/index.php
http://we###appy.net/index.php
http://ve###appy.net/index.php
http://pi###page.net/index.php
http://yo###ive.net/index.php
http://tr###eight.net/index.php
http://yo###oice.net/index.php
http://tr###five.net/index.php
http://yo###ight.net/index.php
http://lr###voice.net/index.php
http://vi###oice.net/index.php
http://tr###they.net/index.php
http://yo###hey.net/index.php
http://tr###voice.net/index.php
http://ta###appy.net/index.php
http://wa###eat.net/index.php
http://mu###age.net/index.php
http://wa###appy.net/index.php
http://ta###eat.net/index.php
http://wa###age.net/index.php
http://ta###age.net/index.php
http://wa###ince.net/index.php
http://ta###ince.net/index.php
http://to###eat.net/index.php
http://yo###age.net/index.php
http://lr###happy.net/index.php
http://yo###ince.net/index.php
http://tr###page.net/index.php
http://vi###appy.net/index.php
http://lr###since.net/index.php
http://vi###ince.net/index.php
http://lr###heat.net/index.php
http://vi###eat.net/index.php
http://tr###since.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://ta###and.net/index.php
http://tr###heat.net/index.php
http://yo###eat.net/index.php
http://tr###happy.net/index.php
http://yo###appy.net/index.php
http://lr###page.net/index.php
http://le###heat.net/index.php
http://se###since.net/index.php
http://le###happy.net/index.php
http://se###heat.net/index.php
http://le###since.net/index.php
http://to###appy.net/index.php
http://fa###appy.net/index.php
http://se###page.net/index.php
http://le###page.net/index.php
http://se###happy.net/index.php
http://fi###appy.net/index.php
http://pl###heat.net/index.php
http://vi###age.net/index.php
http://pl###happy.net/index.php
http://fi###eat.net/index.php
http://pl###page.net/index.php
http://fi###age.net/index.php
http://pl###since.net/index.php
http://fi###ince.net/index.php

UDP:

DNS ASK pi###happy.net
DNS ASK mu###appy.net
DNS ASK ve###age.net
DNS ASK ve###ince.net
DNS ASK we###age.net
DNS ASK mu###ince.net
DNS ASK pi###page.net
DNS ASK pi###since.net
DNS ASK pi###heat.net
DNS ASK mu###eat.net
DNS ASK to###age.net
DNS ASK fa###age.net
DNS ASK fa###ince.net
DNS ASK fa###eat.net
DNS ASK to###ince.net
DNS ASK ve###eat.net
DNS ASK we###ince.net
DNS ASK we###eat.net
DNS ASK we###appy.net
DNS ASK ve###appy.net
DNS ASK tr###eight.net
DNS ASK yo###ight.net
DNS ASK yo###ive.net
DNS ASK yo###oice.net
DNS ASK tr###five.net
DNS ASK vi###oice.net
DNS ASK lr###five.net
DNS ASK lr###voice.net
DNS ASK tr###they.net
DNS ASK yo###hey.net
DNS ASK wa###eat.net
DNS ASK ta###eat.net
DNS ASK ta###appy.net
DNS ASK mu###age.net
DNS ASK wa###appy.net
DNS ASK ta###age.net
DNS ASK tr###voice.net
DNS ASK wa###age.net
DNS ASK wa###ince.net
DNS ASK ta###ince.net
DNS ASK to###eat.net
DNS ASK yo###age.net
DNS ASK lr###happy.net
DNS ASK yo###ince.net
DNS ASK tr###page.net
DNS ASK vi###appy.net
DNS ASK lr###since.net
DNS ASK vi###ince.net
DNS ASK lr###heat.net
DNS ASK vi###eat.net
DNS ASK tr###since.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK ta###and.net
DNS ASK tr###heat.net
DNS ASK yo###eat.net
DNS ASK tr###happy.net
DNS ASK yo###appy.net
DNS ASK lr###page.net
DNS ASK le###heat.net
DNS ASK se###since.net
DNS ASK le###happy.net
DNS ASK se###heat.net
DNS ASK le###since.net
DNS ASK to###appy.net
DNS ASK fa###appy.net
DNS ASK se###page.net
DNS ASK le###page.net
DNS ASK se###happy.net
DNS ASK fi###appy.net
DNS ASK pl###heat.net
DNS ASK vi###age.net
DNS ASK pl###happy.net
DNS ASK fi###eat.net
DNS ASK pl###page.net
DNS ASK fi###age.net
DNS ASK pl###since.net
DNS ASK fi###ince.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней