Trojan.DownLoader22.23794

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '.exe' = '%TEMP%\.exe'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /f /im Client.exe
'<SYSTEM32>\taskkill.exe' /f /im TASLogin.exe
'C:\whrwuu.exe'
'<SYSTEM32>\taskkill.exe' /f /im DNF.exe

Завершает или пытается завершить

следующие пользовательские процессы:

dnf.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%2\¶ЇМ¬2.bmp
%WINDIR%2\¶ЇМ¬1.bmp
%WINDIR%2\¶ЇМ¬3.bmp
%WINDIR%2\¶ЇМ¬5.bmp
%WINDIR%2\¶ЇМ¬4.bmp
%WINDIR%2\°ґПВИЎПы.bmp
%WINDIR%2\µЗВј2.bmp
%WINDIR%2\QQ°ІИ«ЦРРД.bmp
%WINDIR%2\КЦ»ъБоЕЖ2.bmp
%WINDIR%2\КЦ»ъБоЕЖ1.bmp
%WINDIR%2\БР±н1.bmp
%WINDIR%2\xХэіЈ.bmp
%WINDIR%2\xµгИј.bmp
C:\ztest.txt
%WINDIR%2\x°ґПВ.bmp
%WINDIR%2\¶ЇМ¬7.bmp
%WINDIR%2\¶ЇМ¬6.bmp
%WINDIR%2\НјЖ¬Цч1.bmp
%WINDIR%2\БР±н2.bmp
%WINDIR%2\БР±н3.bmp
%WINDIR%2\ХэіЈИЎПы.bmp
%WINDIR%2\ХэФЪµЗВј.bmp
%WINDIR%2\И·ИПµгИј.bmp
%WINDIR%2\СйЦ¤Вл.bmp
%WINDIR%2\И·ИП°ґПВ.bmp
C:\whrwuu.exe
C:\ss.txt
C:\ssm.mod
%WINDIR%2\И·ИПХэіЈ.bmp
%WINDIR%2\µЧНјНёГч.bmp
%WINDIR%2\ЅбКш.bmp
%WINDIR%2\ГЬВлґнОу.bmp
%WINDIR%2\µгИјИЎПы.bmp
%WINDIR%2\µЗВј3.bmp
%WINDIR%2\µЗВј1.bmp
%WINDIR%2\СйЦ¤ХэіЈ.bmp
%WINDIR%2\ХЪ4.bmp
%WINDIR%2\СйЦ¤°ґПВ.bmp
%WINDIR%2\ДЪНјЖ¬.bmp
%WINDIR%2\СйЦ¤µгИј.bmp

Сетевая активность:

Подключается к:

'im##.ph.126.net':80
'12#.#25.114.144':80
'xu#.##login2.qq.com':80
'11#.#0.189.78':760

TCP:

Запросы HTTP GET:

http://im##.ph.126.net/0_LSUzpvATp1O-RDlHmxjg==/6631388823096231294.bmp
http://im##.ph.126.net/4elQnSI-md5M7iqXtH8GpA==/6631408614305531091.bmp
http://im##.ph.126.net/_umBJR8B6DA8S32SNDhhrw==/6631266777305546446.bmp
http://im##.ph.126.net/toHiC3VLyBb0bvLQ2Vl47g==/6631298663142758905.bmp
http://g.#####otos.baidu.com/album/s%3D1600%3Bq%3D90/sign=d4f61569718b4710ca2ff9caf3fef88c/6a63f6246b600c33e9133380194c510fd9f9a114.jpg via 12#.#25.114.144
http://im##.ph.126.net/p96ViPUsuVuuut7PEZ1H6w==/6631245886583919951.bmp
http://im##.ph.126.net/oYYyt3n91j7tROcmXNUv4A==/6631415211374935259.bmp
http://c.#####otos.baidu.com/album/s%3D1600%3Bq%3D90/sign=1754eeabd639b60049ce0bb1d9600e5b/38dbb6fd5266d0160bbe7360942bd40734fa35d6.jpg via 12#.#25.114.144
http://e.#####otos.baidu.com/album/s%3D1600%3Bq%3D90/sign=3e290c2c768b4710ca2ff9caf3fef88c/6a63f6246b600c3303cc2ac51e4c510fd9f9a102.jpg via 12#.#25.114.144
http://im##.ph.126.net/tV4V7CEQVJMxB62acahUtA==/6631220597816510519.bmp
http://im##.ph.126.net/mohKFMVd1gUoDE0Wa1SB1Q==/6631352539211853323.bmp
http://im##.ph.126.net/lnmuVv7cr_ZDSD5QDLHosQ==/6631352539211853318.bmp
http://im##.ph.126.net/yMl6huUslYndCDjt6RYhOQ==/6631353638723474043.bmp
http://im##.ph.126.net/zV1qIFAB1uNQvrygHhWTXQ==/6631373429932771002.bmp
http://im##.ph.126.net/Jouky3-0VHjXMt_PKQh8BQ==/6631316255328798176.bmp
http://im##.ph.126.net/zVBlsutf1dR7LGt48ZVzwQ==/6631342643607872328.bmp
http://im##.ph.126.net/Hwf0yLm0vaDms85zLMIprQ==/6631232692444420089.bmp
http://im##.ph.126.net/WiNkDxN48uDQlndkGWpRcQ==/6631418509910181038.bmp
http://im##.ph.126.net/IfFzEBV11QAS4NduoOylDw==/6631325051421134072.bmp
http://im##.ph.126.net/mJUVjT9NQE3Ko-UNm45v-A==/6631249185118803299.bmp
http://im##.ph.126.net/_Ri47yrGAJsCfktwUSeDSw==/6631354738235408139.bmp
http://im##.ph.126.net/JtN_4uA8fUta2hctTB8hng==/6631304160700210868.bmp
http://im##.ph.126.net/rrJvGHP6EDGsEhFfWvFPhw==/6631318454351370549.bmp
http://im##.ph.126.net/RpZJb7nKpuEr0QH9khdC4Q==/6631208503188910925.bmp
http://xu#.##login2.qq.com/cgi-bin/xlogin?pr#####################################################################################################################################################...
http://im##.ph.126.net/OtPfkg2F6ntrAq1G6eP5YQ==/6631249185118803234.bmp
http://im##.ph.126.net/HiuRvufW5Ygo9_o1YJhRnQ==/6631342643607189632.bmp
http://im##.ph.126.net/xaP3ncKtrm4tQ3a_MrE3yQ==/6631349240676956273.bmp
http://im##.ph.126.net/82pQQNxx-yxdd2rPbpQb-Q==/6631290966560680240.bmp
http://im##.ph.126.net/ANI_3rye8IKyFOE0utL1Ng==/6631369031886567268.bmp
http://im##.ph.126.net/-_zKQGf8kpvC8GqkjuLo5A==/6631263478770299356.bmp
http://im##.ph.126.net/wg4q0x22qPcwtfSN9rWUYg==/6631304160700210867.bmp
http://im##.ph.126.net/P7A54hAS5lNUD1eAWPpNFg==/6631374529444384964.bmp
http://im##.ph.126.net/_IeuIW4142D5BapW52a5dw==/6631349240676956276.bmp
http://im##.ph.126.net/vRZ8iy838OrXeLrfmAapvg==/6631362434816802558.bmp
http://im##.ph.126.net/6GYvPdrEyyyiUqLwvg9Z2w==/6631275573397886235.bmp