Trojan.DownLoader22.33874

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Cache Base WLAN PNRP Framework Storage' = 'C:\wtnamfmhnuffdsr\szfurpmn.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Distributed PC Helper Service] 'ImagePath' = 'C:\wtnamfmhnuffdsr\szfurpmn.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Distributed PC Helper Service] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'C:\wtnamfmhnuffdsr\ubunyyvx.exe' "c:\wtnamfmhnuffdsr\szfurpmn.exe"
'C:\wtnamfmhnuffdsr\szfurpmn.exe'
'C:\wtnamfmhnuffdsr\gdh2ig2basyteaiwsq.exe'

Изменения в файловой системе:

Создает следующие файлы:

C:\wtnamfmhnuffdsr\szfurpmn.exe
C:\wtnamfmhnuffdsr\ubunyyvx.exe
C:\wtnamfmhnuffdsr\gdh2ig2basyteaiwsq.exe
%WINDIR%\wtnamfmhnuffdsr\pkygnublivq
C:\wtnamfmhnuffdsr\pkygnublivq

Присваивает атрибут 'скрытый' для следующих файлов:

C:\wtnamfmhnuffdsr\ubunyyvx.exe
C:\wtnamfmhnuffdsr\szfurpmn.exe

Удаляет следующие файлы:

C:\wtnamfmhnuffdsr\gdh2ig2basyteaiwsq.exe
%WINDIR%\wtnamfmhnuffdsr\pkygnublivq

Подменяет следующие файлы:

%WINDIR%\wtnamfmhnuffdsr\pkygnublivq

Сетевая активность:

Подключается к:

'fi####single.net':80
'th####single.net':80
'fi####charge.net':80
'ri####ifference.net':80
'wh####revery.net':80
'ri###every.net':80
'fi###eevery.net':80
'th###hevery.net':80
'pi####esingle.net':80
'th####charge.net':80
'fi#####ifference.net':80
'th#####ifference.net':80
'su#####ifference.net':80
'fo#####difference.net':80
'su###nevery.net':80
'fo####nsingle.net':80
'su####charge.net':80
'fo####ncharge.net':80
'wh####rcharge.net':80
'ri###charge.net':80
'wh#####difference.net':80
'fo####nevery.net':80
'wh####rsingle.net':80
'ri###single.net':80
'ei####single.net':80
'en####hsingle.net':80
'ei####charge.net':80
'fa#####ifference.net':80
'ch####enevery.net':80
'fa###yevery.net':80
'ei###revery.net':80
'en####hevery.net':80
'fr###should.net':80
'en####hcharge.net':80
'ei#####ifference.net':80
'en#####difference.net':80
'pi#####difference.net':80
'ci#####tedifference.net':80
'pi####eevery.net':80
'ci####ttesingle.net':80
'pi####echarge.net':80
'ci####ttecharge.net':80
'ch####encharge.net':80
'fa####charge.net':80
'ch#####ndifference.net':80
'ci####tteevery.net':80
'ch####ensingle.net':80
'fa####single.net':80
'ch####enchoose.net':80
'fa####choose.net':80
'ch#####nalthough.net':80
'ci####tteperiod.net':80
'pi####ehowever.net':80
'ci#####tehowever.net':80
'ch####enhowever.net':80
'fa####however.net':80
'ei####choose.net':80
'fa####although.net':80
'ch####enperiod.net':80
'fa####period.net':80
'fi####period.net':80
'th####period.net':80
'fi####however.net':80
'th####choose.net':80
'fi####although.net':80
'th####although.net':80
'pi####ealthough.net':80
'ci#####tealthough.net':80
'pi####eperiod.net':80
'th####however.net':80
'pi####echoose.net':80
'ci####ttechoose.net':80
'pe####single.net':80
'ma####esingle.net':80
'pe####charge.net':80
'be#####difference.net':80
'ex###tevery.net':80
'be####eevery.net':80
'pe###nevery.net':80
'ma####eevery.net':80
'su####single.net':80
'ma####echarge.net':80
'pe#####ifference.net':80
'ma#####difference.net':80
'ei####period.net':80
'en####hperiod.net':80
'ei####however.net':80
'en####hchoose.net':80
'ei####although.net':80
'en####halthough.net':80
'ex####charge.net':80
'be####echarge.net':80
'ex#####ifference.net':80
'en####hhowever.net':80
'ex####single.net':80
'be####esingle.net':80

TCP:

Запросы HTTP GET:

http://fi####single.net/index.php
http://th####single.net/index.php
http://fi####charge.net/index.php
http://ri####ifference.net/index.php
http://wh####revery.net/index.php
http://ri###every.net/index.php
http://fi###eevery.net/index.php
http://th###hevery.net/index.php
http://pi####esingle.net/index.php
http://th####charge.net/index.php
http://fi#####ifference.net/index.php
http://th#####ifference.net/index.php
http://su#####ifference.net/index.php
http://fo#####difference.net/index.php
http://su###nevery.net/index.php
http://fo####nsingle.net/index.php
http://su####charge.net/index.php
http://fo####ncharge.net/index.php
http://wh####rcharge.net/index.php
http://ri###charge.net/index.php
http://wh#####difference.net/index.php
http://fo####nevery.net/index.php
http://wh####rsingle.net/index.php
http://ri###single.net/index.php
http://ei####single.net/index.php
http://en####hsingle.net/index.php
http://ei####charge.net/index.php
http://fa#####ifference.net/index.php
http://ch####enevery.net/index.php
http://fa###yevery.net/index.php
http://ei###revery.net/index.php
http://en####hevery.net/index.php
http://fr###should.net/index.php
http://en####hcharge.net/index.php
http://ei#####ifference.net/index.php
http://en#####difference.net/index.php
http://pi#####difference.net/index.php
http://ci#####tedifference.net/index.php
http://pi####eevery.net/index.php
http://ci####ttesingle.net/index.php
http://pi####echarge.net/index.php
http://ci####ttecharge.net/index.php
http://ch####encharge.net/index.php
http://fa####charge.net/index.php
http://ch#####ndifference.net/index.php
http://ci####tteevery.net/index.php
http://ch####ensingle.net/index.php
http://fa####single.net/index.php
http://ch####enchoose.net/index.php
http://fa####choose.net/index.php
http://ch#####nalthough.net/index.php
http://ci####tteperiod.net/index.php
http://pi####ehowever.net/index.php
http://ci#####tehowever.net/index.php
http://ch####enhowever.net/index.php
http://fa####however.net/index.php
http://ei####choose.net/index.php
http://fa####although.net/index.php
http://ch####enperiod.net/index.php
http://fa####period.net/index.php
http://fi####period.net/index.php
http://th####period.net/index.php
http://fi####however.net/index.php
http://th####choose.net/index.php
http://fi####although.net/index.php
http://th####although.net/index.php
http://pi####ealthough.net/index.php
http://ci#####tealthough.net/index.php
http://pi####eperiod.net/index.php
http://th####however.net/index.php
http://pi####echoose.net/index.php
http://ci####ttechoose.net/index.php
http://pe####single.net/index.php
http://ma####esingle.net/index.php
http://pe####charge.net/index.php
http://be#####difference.net/index.php
http://ex###tevery.net/index.php
http://be####eevery.net/index.php
http://pe###nevery.net/index.php
http://ma####eevery.net/index.php
http://su####single.net/index.php
http://ma####echarge.net/index.php
http://pe#####ifference.net/index.php
http://ma#####difference.net/index.php
http://ei####period.net/index.php
http://en####hperiod.net/index.php
http://ei####however.net/index.php
http://en####hchoose.net/index.php
http://ei####although.net/index.php
http://en####halthough.net/index.php
http://ex####charge.net/index.php
http://be####echarge.net/index.php
http://ex#####ifference.net/index.php
http://en####hhowever.net/index.php
http://ex####single.net/index.php
http://be####esingle.net/index.php

UDP:

DNS ASK fi####single.net
DNS ASK th####single.net
DNS ASK fi####charge.net
DNS ASK ri####ifference.net
DNS ASK wh####revery.net
DNS ASK ri###every.net
DNS ASK fi###eevery.net
DNS ASK th###hevery.net
DNS ASK pi####esingle.net
DNS ASK th####charge.net
DNS ASK fi#####ifference.net
DNS ASK th#####ifference.net
DNS ASK su#####ifference.net
DNS ASK fo#####difference.net
DNS ASK su###nevery.net
DNS ASK fo####nsingle.net
DNS ASK su####charge.net
DNS ASK fo####ncharge.net
DNS ASK wh####rcharge.net
DNS ASK ri###charge.net
DNS ASK wh#####difference.net
DNS ASK fo####nevery.net
DNS ASK wh####rsingle.net
DNS ASK ri###single.net
DNS ASK ei####single.net
DNS ASK en####hsingle.net
DNS ASK ei####charge.net
DNS ASK fa#####ifference.net
DNS ASK ch####enevery.net
DNS ASK fa###yevery.net
DNS ASK ei###revery.net
DNS ASK en####hevery.net
DNS ASK fr###should.net
DNS ASK en####hcharge.net
DNS ASK ei#####ifference.net
DNS ASK en#####difference.net
DNS ASK pi#####difference.net
DNS ASK ci#####tedifference.net
DNS ASK pi####eevery.net
DNS ASK ci####ttesingle.net
DNS ASK pi####echarge.net
DNS ASK ci####ttecharge.net
DNS ASK ch####encharge.net
DNS ASK fa####charge.net
DNS ASK ch#####ndifference.net
DNS ASK ci####tteevery.net
DNS ASK ch####ensingle.net
DNS ASK fa####single.net
DNS ASK ch####enchoose.net
DNS ASK fa####choose.net
DNS ASK ch#####nalthough.net
DNS ASK ci####tteperiod.net
DNS ASK pi####ehowever.net
DNS ASK ci#####tehowever.net
DNS ASK ch####enhowever.net
DNS ASK fa####however.net
DNS ASK ei####choose.net
DNS ASK fa####although.net
DNS ASK ch####enperiod.net
DNS ASK fa####period.net
DNS ASK fi####period.net
DNS ASK th####period.net
DNS ASK fi####however.net
DNS ASK th####choose.net
DNS ASK fi####although.net
DNS ASK th####although.net
DNS ASK pi####ealthough.net
DNS ASK ci#####tealthough.net
DNS ASK pi####eperiod.net
DNS ASK th####however.net
DNS ASK pi####echoose.net
DNS ASK ci####ttechoose.net
DNS ASK pe####single.net
DNS ASK ma####esingle.net
DNS ASK pe####charge.net
DNS ASK be#####difference.net
DNS ASK ex###tevery.net
DNS ASK be####eevery.net
DNS ASK pe###nevery.net
DNS ASK ma####eevery.net
DNS ASK su####single.net
DNS ASK ma####echarge.net
DNS ASK pe#####ifference.net
DNS ASK ma#####difference.net
DNS ASK ei####period.net
DNS ASK en####hperiod.net
DNS ASK ei####however.net
DNS ASK en####hchoose.net
DNS ASK ei####although.net
DNS ASK en####halthough.net
DNS ASK ex####charge.net
DNS ASK be####echarge.net
DNS ASK ex#####ifference.net
DNS ASK en####hhowever.net
DNS ASK ex####single.net
DNS ASK be####esingle.net

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней