Trojan.DownLoader21.30195

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Experience Framework Service' = '<SYSTEM32>\wgefkupuywq.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Launcher Keying Services NetBIOS Disk Encryption] 'ImagePath' = '<SYSTEM32>\wgefkupuywq.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Launcher Keying Services NetBIOS Disk Encryption] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'<SYSTEM32>\pffhvrin.exe' "<SYSTEM32>\wgefkupuywq.exe"
'%WINDIR%\Temp\eflezw3kugsn.exe' -r 50285 tcp
'%TEMP%\eflezw3ayzsnrhbdypo.exe'
'<SYSTEM32>\wgefkupuywq.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ycqhekdrkkhq\run
<SYSTEM32>\ycqhekdrkkhq\rng
%WINDIR%\Temp\eflezw3kugsn.exe
<SYSTEM32>\ycqhekdrkkhq\cfg
<SYSTEM32>\pffhvrin.exe
%TEMP%\eflezw3ayzsnrhbdypo.exe
<SYSTEM32>\ycqhekdrkkhq\tst
<SYSTEM32>\wgefkupuywq.exe
<SYSTEM32>\ycqhekdrkkhq\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\pffhvrin.exe
<SYSTEM32>\wgefkupuywq.exe

Удаляет следующие файлы:

%WINDIR%\Temp\eflezw3kugsn.exe
<DRIVERS>\etc\hosts
%TEMP%\eflezw3ayzsnrhbdypo.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'gl###eld.net':80
'ta###held.net':80
'ta###height.net':80
'ta###sleep.net':80
'gl###eight.net':80
'gl###ain.net':80
'eq###height.net':80
'gr###height.net':80
'gr###sleep.net':80
'ta###rain.net':80
'eq###sleep.net':80
'sa###leep.net':80
'sp###eight.net':80
'sp###leep.net':80
'up###ain.net':80
'wh###rain.net':80
'sa###eight.net':80
'sa###ain.net':80
'gl###leep.net':80
'sp###ain.net':80
'sp###eld.net':80
'sa###eld.net':80
'wa###height.net':80
'fa###eight.net':80
'fa###leep.net':80
'vi###rain.net':80
'wa###sleep.net':80
'wa###held.net':80
'dr###sleep.net':80
'th###leep.net':80
'fa###ain.net':80
'fa###eld.net':80
'wa###rain.net':80
'gr###rain.net':80
'sp###sleep.net':80
'eq###rain.net':80
'eq###held.net':80
'gr###held.net':80
'vi###sleep.net':80
'vi###held.net':80
'sp###rain.net':80
'sp###held.net':80
'sp###height.net':80
'vi###height.net':80
'wh###held.net':80
'vi####mportant.net':80
'wa###fine.net':80
'sp####mportant.net':80
'sp###else.net':80
'vi###else.net':80
'fa###ine.net':80
'fa###lse.net':80
'wa####mportant.net':80
'wa###else.net':80
'wa###nice.net':80
'fa###ice.net':80
'de###lxc.com':80
'gr###else.net':80
'be##lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'eq####mportant.net':80
'sp###nice.net':80
'vi###nice.net':80
'vi###fine.net':80
'gr####mportant.net':80
'sp###fine.net':80
'so###held.net':80
'ar###rain.net':80
'ar###held.net':80
'ar###height.net':80
'so###height.net':80
'so###rain.net':80
'wh###height.net':80
'up###eld.net':80
'up###eight.net':80
'up###leep.net':80
'wh###sleep.net':80
'dr###nice.net':80
'th###ice.net':80
'th###ine.net':80
'fa####portant.net':80
'dr###fine.net':80
'dr###else.net':80
'ar###sleep.net':80
'so###sleep.net':80
'th####portant.net':80
'th###lse.net':80
'dr####mportant.net':80

TCP:

Запросы HTTP GET:

http://gl###eld.net/index.php
http://ta###held.net/index.php
http://ta###height.net/index.php
http://ta###sleep.net/index.php
http://gl###eight.net/index.php
http://gl###ain.net/index.php
http://eq###height.net/index.php
http://gr###height.net/index.php
http://gr###sleep.net/index.php
http://ta###rain.net/index.php
http://eq###sleep.net/index.php
http://sa###leep.net/index.php
http://sp###eight.net/index.php
http://sp###leep.net/index.php
http://up###ain.net/index.php
http://wh###rain.net/index.php
http://sa###eight.net/index.php
http://sa###ain.net/index.php
http://gl###leep.net/index.php
http://sp###ain.net/index.php
http://sp###eld.net/index.php
http://sa###eld.net/index.php
http://wa###height.net/index.php
http://fa###eight.net/index.php
http://fa###leep.net/index.php
http://vi###rain.net/index.php
http://wa###sleep.net/index.php
http://wa###held.net/index.php
http://dr###sleep.net/index.php
http://th###leep.net/index.php
http://fa###ain.net/index.php
http://fa###eld.net/index.php
http://wa###rain.net/index.php
http://gr###rain.net/index.php
http://sp###sleep.net/index.php
http://eq###rain.net/index.php
http://eq###held.net/index.php
http://gr###held.net/index.php
http://vi###sleep.net/index.php
http://vi###held.net/index.php
http://sp###rain.net/index.php
http://sp###held.net/index.php
http://sp###height.net/index.php
http://vi###height.net/index.php
http://wh###held.net/index.php
http://vi####mportant.net/index.php
http://wa###fine.net/index.php
http://sp####mportant.net/index.php
http://sp###else.net/index.php
http://vi###else.net/index.php
http://fa###ine.net/index.php
http://fa###lse.net/index.php
http://wa####mportant.net/index.php
http://wa###else.net/index.php
http://wa###nice.net/index.php
http://fa###ice.net/index.php
http://de###lxc.com/index.php
http://gr###else.net/index.php
http://be##lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://eq####mportant.net/index.php
http://sp###nice.net/index.php
http://vi###nice.net/index.php
http://vi###fine.net/index.php
http://gr####mportant.net/index.php
http://sp###fine.net/index.php
http://so###held.net/index.php
http://ar###rain.net/index.php
http://ar###held.net/index.php
http://ar###height.net/index.php
http://so###height.net/index.php
http://so###rain.net/index.php
http://wh###height.net/index.php
http://up###eld.net/index.php
http://up###eight.net/index.php
http://up###leep.net/index.php
http://wh###sleep.net/index.php
http://dr###nice.net/index.php
http://th###ice.net/index.php
http://th###ine.net/index.php
http://fa####portant.net/index.php
http://dr###fine.net/index.php
http://dr###else.net/index.php
http://ar###sleep.net/index.php
http://so###sleep.net/index.php
http://th####portant.net/index.php
http://th###lse.net/index.php
http://dr####mportant.net/index.php

UDP:

DNS ASK ta###height.net
DNS ASK gl###eld.net
DNS ASK gl###eight.net
DNS ASK gl###leep.net
DNS ASK ta###sleep.net
DNS ASK ta###held.net
DNS ASK gr###sleep.net
DNS ASK eq###height.net
DNS ASK eq###sleep.net
DNS ASK gl###ain.net
DNS ASK ta###rain.net
DNS ASK sp###leep.net
DNS ASK sa###leep.net
DNS ASK wh###rain.net
DNS ASK wh###held.net
DNS ASK up###ain.net
DNS ASK sp###eight.net
DNS ASK sp###ain.net
DNS ASK sa###ain.net
DNS ASK sa###eld.net
DNS ASK sa###eight.net
DNS ASK sp###eld.net
DNS ASK gr###height.net
DNS ASK wa###height.net
DNS ASK fa###eight.net
DNS ASK fa###leep.net
DNS ASK vi###rain.net
DNS ASK wa###sleep.net
DNS ASK wa###held.net
DNS ASK dr###sleep.net
DNS ASK th###leep.net
DNS ASK fa###ain.net
DNS ASK fa###eld.net
DNS ASK wa###rain.net
DNS ASK gr###rain.net
DNS ASK sp###sleep.net
DNS ASK eq###rain.net
DNS ASK eq###held.net
DNS ASK gr###held.net
DNS ASK vi###sleep.net
DNS ASK vi###held.net
DNS ASK sp###rain.net
DNS ASK sp###held.net
DNS ASK sp###height.net
DNS ASK vi###height.net
DNS ASK vi####mportant.net
DNS ASK wa###fine.net
DNS ASK sp####mportant.net
DNS ASK sp###else.net
DNS ASK vi###else.net
DNS ASK fa###ine.net
DNS ASK fa###lse.net
DNS ASK wa####mportant.net
DNS ASK wa###else.net
DNS ASK wa###nice.net
DNS ASK fa###ice.net
DNS ASK de###lxc.com
DNS ASK gr###else.net
DNS ASK be##lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK eq####mportant.net
DNS ASK sp###nice.net
DNS ASK vi###nice.net
DNS ASK vi###fine.net
DNS ASK gr####mportant.net
DNS ASK sp###fine.net
DNS ASK so###held.net
DNS ASK ar###rain.net
DNS ASK ar###held.net
DNS ASK ar###height.net
DNS ASK so###height.net
DNS ASK so###rain.net
DNS ASK wh###height.net
DNS ASK up###eld.net
DNS ASK up###eight.net
DNS ASK up###leep.net
DNS ASK wh###sleep.net
DNS ASK dr###nice.net
DNS ASK th###ice.net
DNS ASK th###ine.net
DNS ASK fa####portant.net
DNS ASK dr###fine.net
DNS ASK dr###else.net
DNS ASK ar###sleep.net
DNS ASK so###sleep.net
DNS ASK th####portant.net
DNS ASK th###lse.net
DNS ASK dr####mportant.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней