Trojan.DownLoader19.38971

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Computer Adapter Card Tunneling Source Tablet' = '<SYSTEM32>\ohukmcfofz.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Software Networking Agent] 'ImagePath' = '<SYSTEM32>\ohukmcfofz.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Software Networking Agent] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\faoqgnqp.exe' "<SYSTEM32>\ohukmcfofz.exe"
'%WINDIR%\Temp\odzniet2naksuz.exe' -r 45485 tcp
'%TEMP%\odzniet2iuusuzhtlshv.exe'
'<SYSTEM32>\ohukmcfofz.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\thzpvorjmsortdi\run
<SYSTEM32>\thzpvorjmsortdi\rng
%WINDIR%\Temp\odzniet2naksuz.exe
<SYSTEM32>\thzpvorjmsortdi\cfg
<SYSTEM32>\faoqgnqp.exe
%TEMP%\odzniet2iuusuzhtlshv.exe
<SYSTEM32>\thzpvorjmsortdi\tst
<SYSTEM32>\ohukmcfofz.exe
<SYSTEM32>\thzpvorjmsortdi\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\faoqgnqp.exe
<SYSTEM32>\ohukmcfofz.exe

Удаляет следующие файлы:

%WINDIR%\Temp\odzniet2naksuz.exe
<DRIVERS>\etc\hosts
%TEMP%\odzniet2iuusuzhtlshv.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'st###heat.net':80
'we###eat.net':80
'we###appy.net':80
'wa###age.net':80
'st###happy.net':80
'st###since.net':80
'af###happy.net':80
'fo###happy.net':80
'we###age.net':80
'we###ince.net':80
'st###page.net':80
'fa###age.net':80
'mo###happy.net':80
'le###page.net':80
'le###since.net':80
'fa###ince.net':80
'wa###appy.net':80
'wa###ince.net':80
'mo###page.net':80
'mo###since.net':80
'mo###heat.net':80
'wa###eat.net':80
'dr###happy.net':80
'na###appy.net':80
'we####daypage.net':80
'we####daysince.net':80
'se###age.net':80
'dr###heat.net':80
'dr###page.net':80
'na###age.net':80
'na###ince.net':80
'na###eat.net':80
'dr###since.net':80
'fo###since.net':80
'af###page.net':80
'af###since.net':80
'af###heat.net':80
'fo###heat.net':80
'fo###page.net':80
'we####dayheat.net':80
'se###ince.net':80
'se###eat.net':80
'se###appy.net':80
'we####dayhappy.net':80
'fa###eat.net':80
'we####daysound.net':80
'se###and.net':80
'se###ound.net':80
'se###reen.net':80
'we####daygreen.net':80
'we####dayhand.net':80
'na###reen.net':80
'dr###sound.net':80
'dr###green.net':80
'dr###lift.net':80
'na###ift.net':80
'de###lxc.com':80
'fo###green.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'af###sound.net':80
'se###ift.net':80
'we####daylift.net':80
'fo###hand.net':80
'fo###sound.net':80
'af###hand.net':80
'ga###eat.net':80
'bo###ince.net':80
'bo###eat.net':80
'bo###appy.net':80
'ga###appy.net':80
'ga###ince.net':80
'fa###appy.net':80
'le###heat.net':80
'le###happy.net':80
'bo###age.net':80
'ga###age.net':80
'fi###happy.net':80
'qu###happy.net':80
'na###and.net':80
'na###ound.net':80
'dr###hand.net':80
'fi###heat.net':80
'fi###page.net':80
'qu###page.net':80
'qu###since.net':80
'qu###heat.net':80
'fi###since.net':80

TCP:

Запросы HTTP GET:

http://st###heat.net/index.php
http://we###eat.net/index.php
http://we###appy.net/index.php
http://wa###age.net/index.php
http://st###happy.net/index.php
http://st###since.net/index.php
http://af###happy.net/index.php
http://fo###happy.net/index.php
http://we###age.net/index.php
http://we###ince.net/index.php
http://st###page.net/index.php
http://fa###age.net/index.php
http://mo###happy.net/index.php
http://le###page.net/index.php
http://le###since.net/index.php
http://fa###ince.net/index.php
http://wa###appy.net/index.php
http://wa###ince.net/index.php
http://mo###page.net/index.php
http://mo###since.net/index.php
http://mo###heat.net/index.php
http://wa###eat.net/index.php
http://dr###happy.net/index.php
http://na###appy.net/index.php
http://we####daypage.net/index.php
http://we####daysince.net/index.php
http://se###age.net/index.php
http://dr###heat.net/index.php
http://dr###page.net/index.php
http://na###age.net/index.php
http://na###ince.net/index.php
http://na###eat.net/index.php
http://dr###since.net/index.php
http://fo###since.net/index.php
http://af###page.net/index.php
http://af###since.net/index.php
http://af###heat.net/index.php
http://fo###heat.net/index.php
http://fo###page.net/index.php
http://we####dayheat.net/index.php
http://se###ince.net/index.php
http://se###eat.net/index.php
http://se###appy.net/index.php
http://we####dayhappy.net/index.php
http://fa###eat.net/index.php
http://we####daysound.net/index.php
http://se###and.net/index.php
http://se###ound.net/index.php
http://se###reen.net/index.php
http://we####daygreen.net/index.php
http://we####dayhand.net/index.php
http://na###reen.net/index.php
http://dr###sound.net/index.php
http://dr###green.net/index.php
http://dr###lift.net/index.php
http://na###ift.net/index.php
http://de###lxc.com/index.php
http://fo###green.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://af###sound.net/index.php
http://se###ift.net/index.php
http://we####daylift.net/index.php
http://fo###hand.net/index.php
http://fo###sound.net/index.php
http://af###hand.net/index.php
http://ga###eat.net/index.php
http://bo###ince.net/index.php
http://bo###eat.net/index.php
http://bo###appy.net/index.php
http://ga###appy.net/index.php
http://ga###ince.net/index.php
http://fa###appy.net/index.php
http://le###heat.net/index.php
http://le###happy.net/index.php
http://bo###age.net/index.php
http://ga###age.net/index.php
http://fi###happy.net/index.php
http://qu###happy.net/index.php
http://na###and.net/index.php
http://na###ound.net/index.php
http://dr###hand.net/index.php
http://fi###heat.net/index.php
http://fi###page.net/index.php
http://qu###page.net/index.php
http://qu###since.net/index.php
http://qu###heat.net/index.php
http://fi###since.net/index.php

UDP:

DNS ASK we###appy.net
DNS ASK st###heat.net
DNS ASK st###happy.net
DNS ASK mo###page.net
DNS ASK wa###age.net
DNS ASK we###eat.net
DNS ASK we###age.net
DNS ASK af###happy.net
DNS ASK st###page.net
DNS ASK st###since.net
DNS ASK we###ince.net
DNS ASK le###page.net
DNS ASK fa###age.net
DNS ASK fa###ince.net
DNS ASK fa###eat.net
DNS ASK le###since.net
DNS ASK mo###happy.net
DNS ASK mo###since.net
DNS ASK wa###ince.net
DNS ASK wa###eat.net
DNS ASK wa###appy.net
DNS ASK mo###heat.net
DNS ASK fo###happy.net
DNS ASK dr###happy.net
DNS ASK na###appy.net
DNS ASK we####daypage.net
DNS ASK we####daysince.net
DNS ASK se###age.net
DNS ASK dr###heat.net
DNS ASK dr###page.net
DNS ASK na###age.net
DNS ASK na###ince.net
DNS ASK na###eat.net
DNS ASK dr###since.net
DNS ASK fo###since.net
DNS ASK af###page.net
DNS ASK af###since.net
DNS ASK af###heat.net
DNS ASK fo###heat.net
DNS ASK fo###page.net
DNS ASK we####dayheat.net
DNS ASK se###ince.net
DNS ASK se###eat.net
DNS ASK se###appy.net
DNS ASK we####dayhappy.net
DNS ASK we####daysound.net
DNS ASK se###and.net
DNS ASK se###ound.net
DNS ASK se###reen.net
DNS ASK we####daygreen.net
DNS ASK we####dayhand.net
DNS ASK na###reen.net
DNS ASK dr###sound.net
DNS ASK dr###green.net
DNS ASK dr###lift.net
DNS ASK na###ift.net
DNS ASK de###lxc.com
DNS ASK fo###green.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK af###sound.net
DNS ASK se###ift.net
DNS ASK we####daylift.net
DNS ASK fo###hand.net
DNS ASK fo###sound.net
DNS ASK af###hand.net
DNS ASK ga###eat.net
DNS ASK bo###ince.net
DNS ASK bo###eat.net
DNS ASK bo###appy.net
DNS ASK ga###appy.net
DNS ASK ga###ince.net
DNS ASK fa###appy.net
DNS ASK le###heat.net
DNS ASK le###happy.net
DNS ASK bo###age.net
DNS ASK ga###age.net
DNS ASK fi###happy.net
DNS ASK qu###happy.net
DNS ASK na###and.net
DNS ASK na###ound.net
DNS ASK dr###hand.net
DNS ASK fi###heat.net
DNS ASK fi###page.net
DNS ASK qu###page.net
DNS ASK qu###since.net
DNS ASK qu###heat.net
DNS ASK fi###since.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней