Trojan.DownLoader22.46537

Добавлен в вирусную базу Dr.Web: 2016-09-21

Описание добавлено: 2016-09-20

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Disk Window Bluetooth WebClient Presentation' = '<SYSTEM32>\bsrlmkh.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Browser DCOM TP Storage Process Information] 'ImagePath' = '<SYSTEM32>\bsrlmkh.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Browser DCOM TP Storage Process Information] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\gxprmctkm.exe' "<SYSTEM32>\bsrlmkh.exe"
'%WINDIR%\Temp\nzabgyh3agbj7mr.exe' -r 31197 tcp
'%TEMP%\nzabgyh33p9j7mrqzxyrll.exe'
'<SYSTEM32>\bsrlmkh.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\vicpwpsajfwno\run
<SYSTEM32>\vicpwpsajfwno\rng
%WINDIR%\Temp\nzabgyh3agbj7mr.exe
<SYSTEM32>\vicpwpsajfwno\cfg
<SYSTEM32>\gxprmctkm.exe
%TEMP%\nzabgyh33p9j7mrqzxyrll.exe
<SYSTEM32>\vicpwpsajfwno\tst
<SYSTEM32>\bsrlmkh.exe
<SYSTEM32>\vicpwpsajfwno\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\gxprmctkm.exe
<SYSTEM32>\bsrlmkh.exe

Удаляет следующие файлы:

%WINDIR%\Temp\nzabgyh3agbj7mr.exe
<DRIVERS>\etc\hosts
%TEMP%\nzabgyh33p9j7mrqzxyrll.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'we###nto.net':80
'fe###lace.net':80
'we###hild.net':80
'fe###nto.net':80
'we###lace.net':80
'ta###child.net':80
'le###hild.net':80
'ta###about.net':80
'le###bout.net':80
'th###into.net':80
'li###nto.net':80
'th###child.net':80
'li###hild.net':80
'th###place.net':80
'we###bout.net':80
'fe###hild.net':80
'li###lace.net':80
'fe###bout.net':80
'ta###into.net':80
'no###bout.net':80
'no###hild.net':80
'po###place.net':80
'ca###lace.net':80
'no###nto.net':80
'fa###about.net':80
'ri###hild.net':80
'no###lace.net':80
'ri###bout.net':80
'le###lace.net':80
'po###about.net':80
'le###nto.net':80
'ta###place.net':80
'ca###bout.net':80
'po###into.net':80
'ca###nto.net':80
'po###child.net':80
'ca###hild.net':80
'al###being.net':80
'ri###nstorm.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'we####morrow.net':80
'no###ide.net':80
'we###iss.net':80
'no####morrow.net':80
'we###ide.net':80
'jo####ymeasure.net':80
'cr#####onaraminta.net':80
'ef###tbuilt.net':80
'th###while.net':80
'le###form.net':80
'ab###ell.net':80
'mo###olor.net':80
'mo###ugust.net':80
'mi###hown.net':80
'no###iss.net':80
'fi###child.net':80
'so###into.net':80
'fi###about.net':80
'so###child.net':80
'fi###into.net':80
'th###about.net':80
'li###bout.net':80
'so###place.net':80
'fi###place.net':80
'ri####morrow.net':80
'fa####omorrow.net':80
'ri###ower.net':80
'fa###lower.net':80
'ri###ide.net':80
'fa###kiss.net':80
'so###about.net':80
'fa###wide.net':80
'ri###iss.net':80

TCP:

Запросы HTTP GET:

http://we###nto.net/index.php
http://fe###lace.net/index.php
http://we###hild.net/index.php
http://fe###nto.net/index.php
http://we###lace.net/index.php
http://ta###child.net/index.php
http://le###hild.net/index.php
http://ta###about.net/index.php
http://le###bout.net/index.php
http://th###into.net/index.php
http://li###nto.net/index.php
http://th###child.net/index.php
http://li###hild.net/index.php
http://th###place.net/index.php
http://we###bout.net/index.php
http://fe###hild.net/index.php
http://li###lace.net/index.php
http://fe###bout.net/index.php
http://ta###into.net/index.php
http://no###bout.net/index.php
http://no###hild.net/index.php
http://po###place.net/index.php
http://ca###lace.net/index.php
http://no###nto.net/index.php
http://fa###about.net/index.php
http://ri###hild.net/index.php
http://no###lace.net/index.php
http://ri###bout.net/index.php
http://le###lace.net/index.php
http://po###about.net/index.php
http://le###nto.net/index.php
http://ta###place.net/index.php
http://ca###bout.net/index.php
http://po###into.net/index.php
http://ca###nto.net/index.php
http://po###child.net/index.php
http://ca###hild.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://we####morrow.net/index.php
http://no###ide.net/index.php
http://we###iss.net/index.php
http://no####morrow.net/index.php
http://we###ide.net/index.php
http://jo####ymeasure.net/index.php
http://cr#####onaraminta.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://mo###olor.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://no###iss.net/index.php
http://fi###child.net/index.php
http://so###into.net/index.php
http://fi###about.net/index.php
http://so###child.net/index.php
http://fi###into.net/index.php
http://th###about.net/index.php
http://li###bout.net/index.php
http://so###place.net/index.php
http://fi###place.net/index.php
http://ri####morrow.net/index.php
http://fa####omorrow.net/index.php
http://ri###ower.net/index.php
http://fa###lower.net/index.php
http://ri###ide.net/index.php
http://fa###kiss.net/index.php
http://so###about.net/index.php
http://fa###wide.net/index.php
http://ri###iss.net/index.php

UDP:

DNS ASK we###nto.net
DNS ASK fe###lace.net
DNS ASK we###hild.net
DNS ASK fe###nto.net
DNS ASK we###lace.net
DNS ASK ta###child.net
DNS ASK le###hild.net
DNS ASK ta###about.net
DNS ASK le###bout.net
DNS ASK th###into.net
DNS ASK li###nto.net
DNS ASK th###child.net
DNS ASK li###hild.net
DNS ASK th###place.net
DNS ASK we###bout.net
DNS ASK fe###hild.net
DNS ASK li###lace.net
DNS ASK fe###bout.net
DNS ASK ta###into.net
DNS ASK no###bout.net
DNS ASK no###hild.net
DNS ASK po###place.net
DNS ASK ca###lace.net
DNS ASK no###nto.net
DNS ASK fa###about.net
DNS ASK ri###hild.net
DNS ASK no###lace.net
DNS ASK ri###bout.net
DNS ASK le###lace.net
DNS ASK po###about.net
DNS ASK le###nto.net
DNS ASK ta###place.net
DNS ASK ca###bout.net
DNS ASK po###into.net
DNS ASK ca###nto.net
DNS ASK po###child.net
DNS ASK ca###hild.net
DNS ASK li###bout.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK we####morrow.net
DNS ASK no###ide.net
DNS ASK we###iss.net
DNS ASK no####morrow.net
DNS ASK we###ide.net
DNS ASK jo####ymeasure.net
DNS ASK cr#####onaraminta.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK mo###olor.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK so###child.net
DNS ASK fi###child.net
DNS ASK so###about.net
DNS ASK fi###about.net
DNS ASK so###into.net
DNS ASK fi###place.net
DNS ASK th###about.net
DNS ASK fi###into.net
DNS ASK so###place.net
DNS ASK fa###lower.net
DNS ASK ri####morrow.net
DNS ASK no###iss.net
DNS ASK ri###ower.net
DNS ASK fa####omorrow.net
DNS ASK ri###iss.net
DNS ASK fa###kiss.net
DNS ASK ri###ide.net
DNS ASK fa###wide.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней