Trojan.DownLoader22.14337

Добавлен в вирусную базу Dr.Web: 2016-08-01

Описание добавлено: 2016-08-01

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PNRP TP Awareness Computer Task' = '<SYSTEM32>\pxqjilswrjvb.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Location DCOM Receiver Resource CNG] 'ImagePath' = '<SYSTEM32>\pxqjilswrjvb.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Location DCOM Receiver Resource CNG] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\avztsujcdgeb.exe' "<SYSTEM32>\pxqjilswrjvb.exe"
'%WINDIR%\Temp\vpbu0jg3nwpohdg.exe' -r 33011 tcp
'%TEMP%\vpbu0jg3djvohdgkf4bhyut.exe'
'<SYSTEM32>\pxqjilswrjvb.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\pajtxjoxdgsnjw\run
<SYSTEM32>\pajtxjoxdgsnjw\rng
%WINDIR%\Temp\vpbu0jg3nwpohdg.exe
<SYSTEM32>\pajtxjoxdgsnjw\cfg
<SYSTEM32>\avztsujcdgeb.exe
%TEMP%\vpbu0jg3djvohdgkf4bhyut.exe
<SYSTEM32>\pajtxjoxdgsnjw\tst
<SYSTEM32>\pxqjilswrjvb.exe
<SYSTEM32>\pajtxjoxdgsnjw\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\avztsujcdgeb.exe
<SYSTEM32>\pxqjilswrjvb.exe

Удаляет следующие файлы:

%WINDIR%\Temp\vpbu0jg3nwpohdg.exe
<DRIVERS>\etc\hosts
%TEMP%\vpbu0jg3djvohdgkf4bhyut.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'fo###gold.net':80
'se###ome.net':80
'fo###grain.net':80
'af###gold.net':80
'we####dayover.net':80
'se###rain.net':80
'we####dayhome.net':80
'se###ver.net':80
'af###grain.net':80
'st###gold.net':80
'we###old.net':80
'st###grain.net':80
'we###rain.net':80
'af###over.net':80
'fo###over.net':80
'af###home.net':80
'fo###home.net':80
'so###cloth.net':80
'fi###cloth.net':80
'dr###gold.net':80
'na###old.net':80
'so###august.net':80
'fi###august.net':80
'so###paid.net':80
'fi###paid.net':80
'na###rain.net':80
'we####daygold.net':80
'dr###home.net':80
'we####daygrain.net':80
'se###old.net':80
'na###ver.net':80
'dr###grain.net':80
'na###ome.net':80
'dr###over.net':80
'we###ver.net':80
'bo###rain.net':80
'ga###rain.net':80
'bo###ver.net':80
'ga###ver.net':80
'le###home.net':80
'fa###ome.net':80
'bo###old.net':80
'ga###old.net':80
'ga###ome.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'qu###gold.net':80
'bo###ome.net':80
'qu###grain.net':80
'fi###gold.net':80
'wa###rain.net':80
'mo###gold.net':80
'wa###ver.net':80
'mo###grain.net':80
'we###ome.net':80
'st###over.net':80
'wa###old.net':80
'st###home.net':80
'mo###over.net':80
'le###grain.net':80
'fa###rain.net':80
'le###over.net':80
'fa###ver.net':80
'mo###home.net':80
'wa###ome.net':80
'le###gold.net':80
'fa###old.net':80

TCP:

Запросы HTTP GET:

http://fo###gold.net/index.php
http://se###ome.net/index.php
http://fo###grain.net/index.php
http://af###gold.net/index.php
http://we####dayover.net/index.php
http://se###rain.net/index.php
http://we####dayhome.net/index.php
http://se###ver.net/index.php
http://af###grain.net/index.php
http://st###gold.net/index.php
http://we###old.net/index.php
http://st###grain.net/index.php
http://we###rain.net/index.php
http://af###over.net/index.php
http://fo###over.net/index.php
http://af###home.net/index.php
http://fo###home.net/index.php
http://so###cloth.net/index.php
http://fi###cloth.net/index.php
http://dr###gold.net/index.php
http://na###old.net/index.php
http://so###august.net/index.php
http://fi###august.net/index.php
http://so###paid.net/index.php
http://fi###paid.net/index.php
http://na###rain.net/index.php
http://we####daygold.net/index.php
http://dr###home.net/index.php
http://we####daygrain.net/index.php
http://se###old.net/index.php
http://na###ver.net/index.php
http://dr###grain.net/index.php
http://na###ome.net/index.php
http://dr###over.net/index.php
http://we###ver.net/index.php
http://bo###rain.net/index.php
http://ga###rain.net/index.php
http://bo###ver.net/index.php
http://ga###ver.net/index.php
http://le###home.net/index.php
http://fa###ome.net/index.php
http://bo###old.net/index.php
http://ga###old.net/index.php
http://ga###ome.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://qu###gold.net/index.php
http://bo###ome.net/index.php
http://qu###grain.net/index.php
http://fi###gold.net/index.php
http://wa###rain.net/index.php
http://mo###gold.net/index.php
http://wa###ver.net/index.php
http://mo###grain.net/index.php
http://we###ome.net/index.php
http://st###over.net/index.php
http://wa###old.net/index.php
http://st###home.net/index.php
http://mo###over.net/index.php
http://le###grain.net/index.php
http://fa###rain.net/index.php
http://le###over.net/index.php
http://fa###ver.net/index.php
http://mo###home.net/index.php
http://wa###ome.net/index.php
http://le###gold.net/index.php
http://fa###old.net/index.php

UDP:

DNS ASK fo###gold.net
DNS ASK se###ome.net
DNS ASK fo###grain.net
DNS ASK af###gold.net
DNS ASK we####dayover.net
DNS ASK se###rain.net
DNS ASK we####dayhome.net
DNS ASK se###ver.net
DNS ASK af###grain.net
DNS ASK st###gold.net
DNS ASK we###old.net
DNS ASK st###grain.net
DNS ASK we###rain.net
DNS ASK af###over.net
DNS ASK fo###over.net
DNS ASK af###home.net
DNS ASK fo###home.net
DNS ASK we####daygrain.net
DNS ASK fi###cloth.net
DNS ASK so###paid.net
DNS ASK na###old.net
DNS ASK so###cloth.net
DNS ASK fi###august.net
DNS ASK so###born.net
DNS ASK fi###paid.net
DNS ASK so###august.net
DNS ASK dr###gold.net
DNS ASK dr###home.net
DNS ASK na###ome.net
DNS ASK se###old.net
DNS ASK we####daygold.net
DNS ASK dr###grain.net
DNS ASK na###rain.net
DNS ASK dr###over.net
DNS ASK na###ver.net
DNS ASK we###ver.net
DNS ASK bo###rain.net
DNS ASK ga###rain.net
DNS ASK bo###ver.net
DNS ASK ga###ver.net
DNS ASK le###home.net
DNS ASK fa###ome.net
DNS ASK bo###old.net
DNS ASK ga###old.net
DNS ASK ga###ome.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK qu###gold.net
DNS ASK bo###ome.net
DNS ASK qu###grain.net
DNS ASK fi###gold.net
DNS ASK wa###rain.net
DNS ASK mo###gold.net
DNS ASK wa###ver.net
DNS ASK mo###grain.net
DNS ASK we###ome.net
DNS ASK st###over.net
DNS ASK wa###old.net
DNS ASK st###home.net
DNS ASK mo###over.net
DNS ASK le###grain.net
DNS ASK fa###rain.net
DNS ASK le###over.net
DNS ASK fa###ver.net
DNS ASK mo###home.net
DNS ASK wa###ome.net
DNS ASK le###gold.net
DNS ASK fa###old.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней