Trojan.DownLoader19.33788

Добавлен в вирусную базу Dr.Web: 2016-02-25

Описание добавлено: 2016-02-25

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UPnP Grouping HomeGroup Group Scheduler' = '<SYSTEM32>\phxpatgggm.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Configuration Host Authentication] 'ImagePath' = '<SYSTEM32>\phxpatgggm.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Configuration Host Authentication] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\bzpyrhklbv.exe' "<SYSTEM32>\phxpatgggm.exe"
'%WINDIR%\Temp\atcryp3hkeeiczl.exe' -r 29126 tcp
'%TEMP%\atcryp36vfeiczllooxh7.exe'
'<SYSTEM32>\phxpatgggm.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ayqxfvkzalgrdk\run
<SYSTEM32>\ayqxfvkzalgrdk\rng
%WINDIR%\Temp\atcryp3hkeeiczl.exe
<SYSTEM32>\ayqxfvkzalgrdk\cfg
<SYSTEM32>\bzpyrhklbv.exe
%TEMP%\atcryp36vfeiczllooxh7.exe
<SYSTEM32>\ayqxfvkzalgrdk\tst
<SYSTEM32>\phxpatgggm.exe
<SYSTEM32>\ayqxfvkzalgrdk\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\bzpyrhklbv.exe
<SYSTEM32>\phxpatgggm.exe

Удаляет следующие файлы:

%WINDIR%\Temp\atcryp3hkeeiczl.exe
<DRIVERS>\etc\hosts
%TEMP%\atcryp36vfeiczllooxh7.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'pl###wrote.net':80
'fi###rote.net':80
'pl###cold.net':80
'fi###old.net':80
'pl###bone.net':80
'fi###ire.net':80
'se###cold.net':80
'fi###one.net':80
'pl###fire.net':80
'vi###old.net':80
'lr###wrote.net':80
'yo###ire.net':80
'lr###cold.net':80
'vi###rote.net':80
'lr###fire.net':80
'vi###ire.net':80
'lr###bone.net':80
'vi###one.net':80
'to###one.net':80
'fa###one.net':80
'to###rote.net':80
'fa###rote.net':80
'to###ire.net':80
've###old.net':80
'we###rote.net':80
'fa###ire.net':80
'we###old.net':80
'le###wrote.net':80
'se###bone.net':80
'le###cold.net':80
'se###wrote.net':80
'le###bone.net':80
'to###old.net':80
'fa###old.net':80
'se###fire.net':80
'le###fire.net':80
'tr###fire.net':80
've###eply.net':80
'we###hole.net':80
've###hrow.net':80
'we###eply.net':80
've###hole.net':80
'pi###throw.net':80
'mu###hrow.net':80
'pi###stock.net':80
'mu###tock.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'to###hole.net':80
've###tock.net':80
'we###hrow.net':80
'fa###hole.net':80
'we###tock.net':80
'ta###hole.net':80
'tr###cold.net':80
'ta###eply.net':80
'wa###hole.net':80
'yo###old.net':80
'tr###bone.net':80
'yo###one.net':80
'tr###wrote.net':80
'yo###rote.net':80
'pi###whole.net':80
'mu###hole.net':80
'pi###reply.net':80
'mu###eply.net':80
'wa###tock.net':80
'ta###hrow.net':80
'wa###eply.net':80
'ta###tock.net':80
'wa###hrow.net':80

TCP:

Запросы HTTP GET:

http://pl###wrote.net/index.php
http://fi###rote.net/index.php
http://pl###cold.net/index.php
http://fi###old.net/index.php
http://pl###bone.net/index.php
http://fi###ire.net/index.php
http://se###cold.net/index.php
http://fi###one.net/index.php
http://pl###fire.net/index.php
http://vi###old.net/index.php
http://lr###wrote.net/index.php
http://yo###ire.net/index.php
http://lr###cold.net/index.php
http://vi###rote.net/index.php
http://lr###fire.net/index.php
http://vi###ire.net/index.php
http://lr###bone.net/index.php
http://vi###one.net/index.php
http://to###one.net/index.php
http://fa###one.net/index.php
http://to###rote.net/index.php
http://fa###rote.net/index.php
http://to###ire.net/index.php
http://ve###old.net/index.php
http://we###rote.net/index.php
http://fa###ire.net/index.php
http://we###old.net/index.php
http://le###wrote.net/index.php
http://se###bone.net/index.php
http://le###cold.net/index.php
http://se###wrote.net/index.php
http://le###bone.net/index.php
http://to###old.net/index.php
http://fa###old.net/index.php
http://se###fire.net/index.php
http://le###fire.net/index.php
http://tr###fire.net/index.php
http://ve###eply.net/index.php
http://we###hole.net/index.php
http://ve###hrow.net/index.php
http://we###eply.net/index.php
http://ve###hole.net/index.php
http://pi###throw.net/index.php
http://mu###hrow.net/index.php
http://pi###stock.net/index.php
http://mu###tock.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://to###hole.net/index.php
http://ve###tock.net/index.php
http://we###hrow.net/index.php
http://fa###hole.net/index.php
http://we###tock.net/index.php
http://ta###hole.net/index.php
http://tr###cold.net/index.php
http://ta###eply.net/index.php
http://wa###hole.net/index.php
http://yo###old.net/index.php
http://tr###bone.net/index.php
http://yo###one.net/index.php
http://tr###wrote.net/index.php
http://yo###rote.net/index.php
http://pi###whole.net/index.php
http://mu###hole.net/index.php
http://pi###reply.net/index.php
http://mu###eply.net/index.php
http://wa###tock.net/index.php
http://ta###hrow.net/index.php
http://wa###eply.net/index.php
http://ta###tock.net/index.php
http://wa###hrow.net/index.php

UDP:

DNS ASK pl###wrote.net
DNS ASK fi###rote.net
DNS ASK pl###cold.net
DNS ASK fi###old.net
DNS ASK pl###bone.net
DNS ASK fi###ire.net
DNS ASK se###cold.net
DNS ASK fi###one.net
DNS ASK pl###fire.net
DNS ASK vi###old.net
DNS ASK lr###wrote.net
DNS ASK yo###ire.net
DNS ASK lr###cold.net
DNS ASK vi###rote.net
DNS ASK lr###fire.net
DNS ASK vi###ire.net
DNS ASK lr###bone.net
DNS ASK vi###one.net
DNS ASK le###cold.net
DNS ASK fa###one.net
DNS ASK to###ire.net
DNS ASK fa###rote.net
DNS ASK to###one.net
DNS ASK fa###ire.net
DNS ASK we###rote.net
DNS ASK ve###rote.net
DNS ASK we###old.net
DNS ASK ve###old.net
DNS ASK se###bone.net
DNS ASK le###bone.net
DNS ASK se###wrote.net
DNS ASK le###wrote.net
DNS ASK se###fire.net
DNS ASK fa###old.net
DNS ASK to###rote.net
DNS ASK le###fire.net
DNS ASK to###old.net
DNS ASK tr###fire.net
DNS ASK ve###eply.net
DNS ASK we###hole.net
DNS ASK ve###hrow.net
DNS ASK we###eply.net
DNS ASK ve###hole.net
DNS ASK pi###throw.net
DNS ASK mu###hrow.net
DNS ASK pi###stock.net
DNS ASK mu###tock.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK to###hole.net
DNS ASK ve###tock.net
DNS ASK we###hrow.net
DNS ASK fa###hole.net
DNS ASK we###tock.net
DNS ASK ta###hole.net
DNS ASK tr###cold.net
DNS ASK ta###eply.net
DNS ASK wa###hole.net
DNS ASK yo###old.net
DNS ASK tr###bone.net
DNS ASK yo###one.net
DNS ASK tr###wrote.net
DNS ASK yo###rote.net
DNS ASK pi###whole.net
DNS ASK mu###hole.net
DNS ASK pi###reply.net
DNS ASK mu###eply.net
DNS ASK wa###tock.net
DNS ASK ta###hrow.net
DNS ASK wa###eply.net
DNS ASK ta###tock.net
DNS ASK wa###hrow.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней