Trojan.DownLoader22.51

Добавлен в вирусную базу Dr.Web: 2016-06-28

Описание добавлено: 2016-06-28

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Smart Player Audio Power Management Telephony' = '<SYSTEM32>\xdrpcgdgfey.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Offline Launcher HomeGroup Store Window Socket] 'ImagePath' = '<SYSTEM32>\xdrpcgdgfey.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Offline Launcher HomeGroup Store Window Socket] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\ytwkvfgdljhm.exe' "<SYSTEM32>\xdrpcgdgfey.exe"
'%WINDIR%\Temp\cfyfmi3fhbepfam.exe' -r 37856 tcp
'%TEMP%\cfyfmi3ahmepfamvckugput.exe'
'<SYSTEM32>\xdrpcgdgfey.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\slylqsjujywp\run
<SYSTEM32>\slylqsjujywp\rng
%WINDIR%\Temp\cfyfmi3fhbepfam.exe
<SYSTEM32>\slylqsjujywp\cfg
<SYSTEM32>\ytwkvfgdljhm.exe
%TEMP%\cfyfmi3ahmepfamvckugput.exe
<SYSTEM32>\slylqsjujywp\tst
<SYSTEM32>\xdrpcgdgfey.exe
<SYSTEM32>\slylqsjujywp\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\ytwkvfgdljhm.exe
<SYSTEM32>\xdrpcgdgfey.exe

Удаляет следующие файлы:

%WINDIR%\Temp\cfyfmi3fhbepfam.exe
<DRIVERS>\etc\hosts
%TEMP%\cfyfmi3ahmepfamvckugput.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'fa###tart.net':80
'wa###sing.net':80
'fa###ine.net':80
'wa###start.net':80
'fa###ing.net':80
'dr###nine.net':80
'th###ine.net':80
'dr###never.net':80
'th###ever.net':80
'sp###start.net':80
'vi###start.net':80
'sp###nine.net':80
'vi###nine.net':80
'sp###sing.net':80
'fa###ever.net':80
'wa###nine.net':80
'vi###sing.net':80
'wa###never.net':80
'dr###start.net':80
'up###all.net':80
'wh###tall.net':80
'ar###been.net':80
'so###been.net':80
'up###ook.net':80
'wh###next.net':80
'up###een.net':80
'wh###cook.net':80
'up###ext.net':80
'th###ing.net':80
'ar###tall.net':80
'th###tart.net':80
'dr###sing.net':80
'so###tall.net':80
'ar###next.net':80
'so###next.net':80
'ar###cook.net':80
'so###cook.net':80
'sp###ever.net':80
'sa###ever.net':80
'up###ing.net':80
'wh###sing.net':80
'sp###ine.net':80
'sa###tart.net':80
'sp###ing.net':80
'sa###ine.net':80
'sp###tart.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'wh###never.net':80
'up###tart.net':80
'wh###start.net':80
'up###ine.net':80
'wh###nine.net':80
'sa###ing.net':80
'gr###nine.net':80
'eq###start.net':80
'gr###never.net':80
'eq###nine.net':80
'gr###start.net':80
'sp###never.net':80
'vi###never.net':80
'eq###sing.net':80
'gr###sing.net':80
'gl###ine.net':80
'ta###nine.net':80
'gl###ever.net':80
'ta###never.net':80
'gl###tart.net':80
'ta###sing.net':80
'eq###never.net':80
'ta###start.net':80
'gl###ing.net':80

TCP:

Запросы HTTP GET:

http://fa###tart.net/index.php
http://wa###sing.net/index.php
http://fa###ine.net/index.php
http://wa###start.net/index.php
http://fa###ing.net/index.php
http://dr###nine.net/index.php
http://th###ine.net/index.php
http://dr###never.net/index.php
http://th###ever.net/index.php
http://sp###start.net/index.php
http://vi###start.net/index.php
http://sp###nine.net/index.php
http://vi###nine.net/index.php
http://sp###sing.net/index.php
http://fa###ever.net/index.php
http://wa###nine.net/index.php
http://vi###sing.net/index.php
http://wa###never.net/index.php
http://dr###start.net/index.php
http://up###all.net/index.php
http://wh###tall.net/index.php
http://ar###been.net/index.php
http://so###been.net/index.php
http://up###ook.net/index.php
http://wh###next.net/index.php
http://up###een.net/index.php
http://wh###cook.net/index.php
http://up###ext.net/index.php
http://th###ing.net/index.php
http://ar###tall.net/index.php
http://th###tart.net/index.php
http://dr###sing.net/index.php
http://so###tall.net/index.php
http://ar###next.net/index.php
http://so###next.net/index.php
http://ar###cook.net/index.php
http://so###cook.net/index.php
http://sp###ever.net/index.php
http://sa###ever.net/index.php
http://up###ing.net/index.php
http://wh###sing.net/index.php
http://sp###ine.net/index.php
http://sa###tart.net/index.php
http://sp###ing.net/index.php
http://sa###ine.net/index.php
http://sp###tart.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://wh###never.net/index.php
http://up###tart.net/index.php
http://wh###start.net/index.php
http://up###ine.net/index.php
http://wh###nine.net/index.php
http://sa###ing.net/index.php
http://gr###nine.net/index.php
http://eq###start.net/index.php
http://gr###never.net/index.php
http://eq###nine.net/index.php
http://gr###start.net/index.php
http://sp###never.net/index.php
http://vi###never.net/index.php
http://eq###sing.net/index.php
http://gr###sing.net/index.php
http://gl###ine.net/index.php
http://ta###nine.net/index.php
http://gl###ever.net/index.php
http://ta###never.net/index.php
http://gl###tart.net/index.php
http://ta###sing.net/index.php
http://eq###never.net/index.php
http://ta###start.net/index.php
http://gl###ing.net/index.php

UDP:

DNS ASK fa###tart.net
DNS ASK wa###sing.net
DNS ASK fa###ine.net
DNS ASK wa###start.net
DNS ASK fa###ing.net
DNS ASK dr###nine.net
DNS ASK th###ine.net
DNS ASK dr###never.net
DNS ASK th###ever.net
DNS ASK sp###start.net
DNS ASK vi###start.net
DNS ASK sp###nine.net
DNS ASK vi###nine.net
DNS ASK sp###sing.net
DNS ASK fa###ever.net
DNS ASK wa###nine.net
DNS ASK vi###sing.net
DNS ASK wa###never.net
DNS ASK dr###start.net
DNS ASK up###all.net
DNS ASK wh###tall.net
DNS ASK ar###been.net
DNS ASK so###been.net
DNS ASK up###ook.net
DNS ASK wh###next.net
DNS ASK up###een.net
DNS ASK wh###cook.net
DNS ASK up###ext.net
DNS ASK th###ing.net
DNS ASK ar###tall.net
DNS ASK th###tart.net
DNS ASK dr###sing.net
DNS ASK so###tall.net
DNS ASK ar###next.net
DNS ASK so###next.net
DNS ASK ar###cook.net
DNS ASK so###cook.net
DNS ASK vi###never.net
DNS ASK sp###ever.net
DNS ASK sa###ever.net
DNS ASK up###ing.net
DNS ASK wh###sing.net
DNS ASK sp###ine.net
DNS ASK sa###tart.net
DNS ASK sp###ing.net
DNS ASK sa###ine.net
DNS ASK sp###tart.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK wh###never.net
DNS ASK up###tart.net
DNS ASK wh###start.net
DNS ASK up###ine.net
DNS ASK wh###nine.net
DNS ASK eq###nine.net
DNS ASK gr###nine.net
DNS ASK eq###never.net
DNS ASK gr###never.net
DNS ASK eq###start.net
DNS ASK gr###sing.net
DNS ASK sp###never.net
DNS ASK gr###start.net
DNS ASK eq###sing.net
DNS ASK ta###never.net
DNS ASK gl###ine.net
DNS ASK sa###ing.net
DNS ASK gl###ever.net
DNS ASK ta###nine.net
DNS ASK gl###ing.net
DNS ASK ta###sing.net
DNS ASK gl###tart.net
DNS ASK ta###start.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней