Trojan.DownLoader22.24288

Добавлен в вирусную базу Dr.Web: 2016-08-21

Описание добавлено: 2016-08-21

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Files Enumerator UserMode' = '<SYSTEM32>\dofpqoi.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Power Location Experience Helper] 'ImagePath' = '<SYSTEM32>\dofpqoi.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Power Location Experience Helper] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\alkkrre.exe' "<SYSTEM32>\dofpqoi.exe"
'%WINDIR%\Temp\laj4ywya2qyzbrkkf.exe' -r 41176 tcp
'%TEMP%\laj4ywyajtgvytkkfkrhqvmj.exe'
'<SYSTEM32>\dofpqoi.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ktvfxxoummfm\run
<SYSTEM32>\ktvfxxoummfm\rng
%WINDIR%\Temp\laj4ywya2qyzbrkkf.exe
<SYSTEM32>\ktvfxxoummfm\cfg
%TEMP%\laj4ywyajtgvytkkfkrhqvmj.exe
<SYSTEM32>\ktvfxxoummfm\tst
<SYSTEM32>\alkkrre.exe
<SYSTEM32>\dofpqoi.exe

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\alkkrre.exe
<SYSTEM32>\dofpqoi.exe

Удаляет следующие файлы:

%WINDIR%\Temp\laj4ywya2qyzbrkkf.exe
%TEMP%\laj4ywyajtgvytkkfkrhqvmj.exe

Сетевая активность:

Подключается к:

'en###wild.net':80
'li###ild.net':80
'st###kind.net':80
'ba###ind.net':80
'en###began.net':80
'li###egan.net':80
'en###june.net':80
'li###une.net':80
'st###wild.net':80
'ba###ild.net':80
'wh###kind.net':80
'sa###ind.net':80
'st###began.net':80
'ba###egan.net':80
'st###june.net':80
'ba###une.net':80
'en###kind.net':80
'de###ild.net':80
'sh###june.net':80
'ti###ind.net':80
'sh###wild.net':80
'de###egan.net':80
'sh###kind.net':80
'de###une.net':80
'sh###began.net':80
'ti###ild.net':80
'mo###june.net':80
'li###ind.net':80
'mo###wild.net':80
'ti###egan.net':80
'mo###kind.net':80
'ti###une.net':80
'mo###began.net':80
'sa###egan.net':80
'gw#####ynhuddleston.net':80
'si######edwerryhouse.net':80
'al####eighbor.net':80
'ge###eangry.net':80
'ch####nother.net':80
'mo####gduring.net':80
'se####strong.net':80
'of####urprise.net':80
'mi####pecial.net':80
'ri###nstorm.net':80
'do####object.net':80
'br###nthird.net':80
'si#####tesherisse.net':80
'de####between.net':80
'du#####llamartinson.net':80
'ma#####llabotwright.net':80
'wi###bout.net':80
'so###ind.net':80
'wh###wild.net':80
'so###egan.net':80
'lo###ind.net':80
'sa###une.net':80
'wh###began.net':80
'sa###ild.net':80
'wh###june.net':80
'de####erhurry.net':80
'lo###ild.net':80
'ca###tep.net':80
'al###hurry.net':80
'so###une.net':80
'lo###egan.net':80
'so###ild.net':80
'lo###une.net':80

TCP:

Запросы HTTP GET:

http://en###wild.net/index.php
http://li###ild.net/index.php
http://st###kind.net/index.php
http://ba###ind.net/index.php
http://en###began.net/index.php
http://li###egan.net/index.php
http://en###june.net/index.php
http://li###une.net/index.php
http://st###wild.net/index.php
http://ba###ild.net/index.php
http://wh###kind.net/index.php
http://sa###ind.net/index.php
http://st###began.net/index.php
http://ba###egan.net/index.php
http://st###june.net/index.php
http://ba###une.net/index.php
http://en###kind.net/index.php
http://de###ild.net/index.php
http://sh###june.net/index.php
http://ti###ind.net/index.php
http://sh###wild.net/index.php
http://de###egan.net/index.php
http://sh###kind.net/index.php
http://de###une.net/index.php
http://sh###began.net/index.php
http://ti###ild.net/index.php
http://mo###june.net/index.php
http://li###ind.net/index.php
http://mo###wild.net/index.php
http://ti###egan.net/index.php
http://mo###kind.net/index.php
http://ti###une.net/index.php
http://mo###began.net/index.php
http://sa###egan.net/index.php
http://gw#####ynhuddleston.net/index.php
http://si######edwerryhouse.net/index.php
http://al####eighbor.net/index.php
http://ge###eangry.net/index.php
http://ch####nother.net/index.php
http://mo####gduring.net/index.php
http://se####strong.net/index.php
http://of####urprise.net/index.php
http://mi####pecial.net/index.php
http://ri###nstorm.net/index.php
http://do####object.net/index.php
http://br###nthird.net/index.php
http://si#####tesherisse.net/index.php
http://de####between.net/index.php
http://du#####llamartinson.net/index.php
http://ma#####llabotwright.net/index.php
http://wi###bout.net/index.php
http://so###ind.net/index.php
http://wh###wild.net/index.php
http://so###egan.net/index.php
http://lo###ind.net/index.php
http://sa###une.net/index.php
http://wh###began.net/index.php
http://sa###ild.net/index.php
http://wh###june.net/index.php
http://de####erhurry.net/index.php
http://lo###ild.net/index.php
http://ca###tep.net/index.php
http://al###hurry.net/index.php
http://so###une.net/index.php
http://lo###egan.net/index.php
http://so###ild.net/index.php
http://lo###une.net/index.php

UDP:

DNS ASK li###ild.net
DNS ASK en###june.net
DNS ASK ba###ind.net
DNS ASK en###wild.net
DNS ASK li###egan.net
DNS ASK en###kind.net
DNS ASK li###une.net
DNS ASK en###began.net
DNS ASK st###kind.net
DNS ASK st###wild.net
DNS ASK ba###ild.net
DNS ASK wh###kind.net
DNS ASK sa###ind.net
DNS ASK st###began.net
DNS ASK ba###egan.net
DNS ASK st###june.net
DNS ASK ba###une.net
DNS ASK sh###june.net
DNS ASK de###une.net
DNS ASK sh###wild.net
DNS ASK de###ild.net
DNS ASK sh###kind.net
DNS ASK de###ind.net
DNS ASK sh###began.net
DNS ASK de###egan.net
DNS ASK ti###ind.net
DNS ASK ti###ild.net
DNS ASK mo###june.net
DNS ASK li###ind.net
DNS ASK mo###wild.net
DNS ASK ti###egan.net
DNS ASK mo###kind.net
DNS ASK ti###une.net
DNS ASK mo###began.net
DNS ASK sa###egan.net
DNS ASK gw#####ynhuddleston.net
DNS ASK si######edwerryhouse.net
DNS ASK al####eighbor.net
DNS ASK ge###eangry.net
DNS ASK ch####nother.net
DNS ASK mo####gduring.net
DNS ASK se####strong.net
DNS ASK of####urprise.net
DNS ASK mi####pecial.net
DNS ASK ri###nstorm.net
DNS ASK do####object.net
DNS ASK br###nthird.net
DNS ASK si#####tesherisse.net
DNS ASK de####between.net
DNS ASK du#####llamartinson.net
DNS ASK ma#####llabotwright.net
DNS ASK wi###bout.net
DNS ASK so###ind.net
DNS ASK wh###wild.net
DNS ASK so###egan.net
DNS ASK lo###ind.net
DNS ASK sa###une.net
DNS ASK wh###began.net
DNS ASK sa###ild.net
DNS ASK wh###june.net
DNS ASK de####erhurry.net
DNS ASK lo###ild.net
DNS ASK ca###tep.net
DNS ASK al###hurry.net
DNS ASK so###une.net
DNS ASK lo###egan.net
DNS ASK so###ild.net
DNS ASK lo###une.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней