Trojan.DownLoader22.7027

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Profile Application List' = 'C:\e4hxygzohlauy\sfysqjwu.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Font RPC Network Proxy] 'ImagePath' = 'C:\e4hxygzohlauy\sfysqjwu.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Font RPC Network Proxy] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\e4hxygzohlauy\gmxohjfhdyw.exe' "c:\e4hxygzohlauy\sfysqjwu.exe"
'C:\e4hxygzohlauy\sfysqjwu.exe'
'C:\e4hxygzohlauy\iaoyj8h34kihi6wxziesyip.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\e4hxygzohlauy\sfysqjwu.exe
C:\e4hxygzohlauy\gmxohjfhdyw.exe
C:\e4hxygzohlauy\haaanioj
%WINDIR%\e4hxygzohlauy\jtlgek
C:\e4hxygzohlauy\jtlgek
C:\e4hxygzohlauy\iaoyj8h34kihi6wxziesyip.exe

Присваивает атрибут 'скрытый' для следующих файлов:

C:\e4hxygzohlauy\gmxohjfhdyw.exe
C:\e4hxygzohlauy\sfysqjwu.exe

Удаляет следующие файлы:

C:\e4hxygzohlauy\iaoyj8h34kihi6wxziesyip.exe
%WINDIR%\e4hxygzohlauy\jtlgek

Подменяет следующие файлы:

%WINDIR%\e4hxygzohlauy\jtlgek

Сетевая активность:

Подключается к:

'an#####latennyson.net':80
'ga#####letennyson.net':80
'an#####lamillicent.net':80
'ga#####lemillicent.net':80
'si#####ercharisma.net':80
'gr#####lecharisma.net':80
'si#####erbernadine.net':80
'gr#####lebernadine.net':80
'br#####iatennyson.net':80
'ga#####latennyson.net':80
'br#####iamillicent.net':80
'ga#####lamillicent.net':80
'an#####lachastity.net':80
'ga#####lechastity.net':80
'an#####laernestine.net':80
'ga#####leernestine.net':80
'he#####onanderson.net':80
'kr#####leanderson.net':80
'he#####onanastacia.net':80
'kr#####leanastacia.net':80
'th#####nacharisma.net':80
'ce#####necharisma.net':80
'th#####nabernadine.net':80
'ce#####nebernadine.net':80
'si#####eranderson.net':80
'gr#####leanderson.net':80
'si#####eranastacia.net':80
'gr#####leanastacia.net':80
'he#####oncharisma.net':80
'kr#####lecharisma.net':80
'he#####onbernadine.net':80
'kr#####lebernadine.net':80
'je#####ontennyson.net':80
'br#####tetennyson.net':80
'je#####onmillicent.net':80
'br#####temillicent.net':80
'he#####tachastity.net':80
'ge#####nechastity.net':80
'he#####taernestine.net':80
'ge#####neernestine.net':80
'th#####natennyson.net':80
'ce#####netennyson.net':80
'th#####namillicent.net':80
'ce#####nemillicent.net':80
'je#####onchastity.net':80
'br#####techastity.net':80
'je#####onernestine.net':80
'br#####teernestine.net':80
'gr#####ortennyson.net':80
'sh#####letennyson.net':80
'gr#####ormillicent.net':80
'sh#####lemillicent.net':80
'br#####iachastity.net':80
'ga#####lachastity.net':80
'br#####iaernestine.net':80
'ga#####laernestine.net':80
'he#####tatennyson.net':80
'ge#####netennyson.net':80
'he#####tamillicent.net':80
'ge#####nemillicent.net':80
'gr#####orchastity.net':80
'sh#####lechastity.net':80
'gr#####orernestine.net':80
'sh#####leernestine.net':80

TCP:

Запросы HTTP GET:

http://an#####latennyson.net/index.php
http://ga#####letennyson.net/index.php
http://an#####lamillicent.net/index.php
http://ga#####lemillicent.net/index.php
http://si#####ercharisma.net/index.php
http://gr#####lecharisma.net/index.php
http://si#####erbernadine.net/index.php
http://gr#####lebernadine.net/index.php
http://br#####iatennyson.net/index.php
http://ga#####latennyson.net/index.php
http://br#####iamillicent.net/index.php
http://ga#####lamillicent.net/index.php
http://an#####lachastity.net/index.php
http://ga#####lechastity.net/index.php
http://an#####laernestine.net/index.php
http://ga#####leernestine.net/index.php
http://he#####onanderson.net/index.php
http://kr#####leanderson.net/index.php
http://he#####onanastacia.net/index.php
http://kr#####leanastacia.net/index.php
http://th#####nacharisma.net/index.php
http://ce#####necharisma.net/index.php
http://th#####nabernadine.net/index.php
http://ce#####nebernadine.net/index.php
http://si#####eranderson.net/index.php
http://gr#####leanderson.net/index.php
http://si#####eranastacia.net/index.php
http://gr#####leanastacia.net/index.php
http://he#####oncharisma.net/index.php
http://kr#####lecharisma.net/index.php
http://he#####onbernadine.net/index.php
http://kr#####lebernadine.net/index.php
http://je#####ontennyson.net/index.php
http://br#####tetennyson.net/index.php
http://je#####onmillicent.net/index.php
http://br#####temillicent.net/index.php
http://he#####tachastity.net/index.php
http://ge#####nechastity.net/index.php
http://he#####taernestine.net/index.php
http://ge#####neernestine.net/index.php
http://th#####natennyson.net/index.php
http://ce#####netennyson.net/index.php
http://th#####namillicent.net/index.php
http://ce#####nemillicent.net/index.php
http://je#####onchastity.net/index.php
http://br#####techastity.net/index.php
http://je#####onernestine.net/index.php
http://br#####teernestine.net/index.php
http://gr#####ortennyson.net/index.php
http://sh#####letennyson.net/index.php
http://gr#####ormillicent.net/index.php
http://sh#####lemillicent.net/index.php
http://br#####iachastity.net/index.php
http://ga#####lachastity.net/index.php
http://br#####iaernestine.net/index.php
http://ga#####laernestine.net/index.php
http://he#####tatennyson.net/index.php
http://ge#####netennyson.net/index.php
http://he#####tamillicent.net/index.php
http://ge#####nemillicent.net/index.php
http://gr#####orchastity.net/index.php
http://sh#####lechastity.net/index.php
http://gr#####orernestine.net/index.php
http://sh#####leernestine.net/index.php

UDP:

DNS ASK ga#####letennyson.net
DNS ASK si#####erbernadine.net
DNS ASK ga#####lemillicent.net
DNS ASK an#####latennyson.net
DNS ASK gr#####lecharisma.net
DNS ASK si#####eranastacia.net
DNS ASK gr#####lebernadine.net
DNS ASK si#####ercharisma.net
DNS ASK ga#####latennyson.net
DNS ASK an#####laernestine.net
DNS ASK ga#####lamillicent.net
DNS ASK br#####iatennyson.net
DNS ASK ga#####lechastity.net
DNS ASK an#####lamillicent.net
DNS ASK ga#####leernestine.net
DNS ASK an#####lachastity.net
DNS ASK kr#####leanderson.net
DNS ASK th#####nabernadine.net
DNS ASK kr#####leanastacia.net
DNS ASK he#####onanderson.net
DNS ASK ce#####necharisma.net
DNS ASK th#####naanastacia.net
DNS ASK ce#####nebernadine.net
DNS ASK th#####nacharisma.net
DNS ASK gr#####leanderson.net
DNS ASK he#####onbernadine.net
DNS ASK gr#####leanastacia.net
DNS ASK si#####eranderson.net
DNS ASK kr#####lecharisma.net
DNS ASK he#####onanastacia.net
DNS ASK kr#####lebernadine.net
DNS ASK he#####oncharisma.net
DNS ASK br#####iamillicent.net
DNS ASK je#####ontennyson.net
DNS ASK br#####tetennyson.net
DNS ASK je#####onmillicent.net
DNS ASK br#####temillicent.net
DNS ASK he#####tachastity.net
DNS ASK ge#####nechastity.net
DNS ASK he#####taernestine.net
DNS ASK ge#####neernestine.net
DNS ASK th#####natennyson.net
DNS ASK ce#####netennyson.net
DNS ASK th#####namillicent.net
DNS ASK ce#####nemillicent.net
DNS ASK je#####onchastity.net
DNS ASK br#####techastity.net
DNS ASK je#####onernestine.net
DNS ASK br#####teernestine.net
DNS ASK gr#####ortennyson.net
DNS ASK sh#####letennyson.net
DNS ASK gr#####ormillicent.net
DNS ASK sh#####lemillicent.net
DNS ASK br#####iachastity.net
DNS ASK ga#####lachastity.net
DNS ASK br#####iaernestine.net
DNS ASK ga#####laernestine.net
DNS ASK he#####tatennyson.net
DNS ASK ge#####netennyson.net
DNS ASK he#####tamillicent.net
DNS ASK ge#####nemillicent.net
DNS ASK gr#####orchastity.net
DNS ASK sh#####lechastity.net
DNS ASK gr#####orernestine.net
DNS ASK sh#####leernestine.net

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней