Trojan.DownLoader22.62933

Добавлен в вирусную базу Dr.Web: 2016-10-13

Описание добавлено: 2016-10-13

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Builder Trap Device Source' = '<SYSTEM32>\xfsuucwsesbz.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Receiver Image Card] 'ImagePath' = '<SYSTEM32>\xfsuucwsesbz.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Receiver Image Card] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\ggclyrz.exe' "<SYSTEM32>\xfsuucwsesbz.exe"
'%WINDIR%\Temp\ylhumdx3lvsjsk.exe' -r 39784 tcp
'%TEMP%\ylhumdx3e8ljskjhtguo.exe'
'<SYSTEM32>\xfsuucwsesbz.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\biiniyjd\run
<SYSTEM32>\biiniyjd\rng
%WINDIR%\Temp\ylhumdx3lvsjsk.exe
<SYSTEM32>\biiniyjd\cfg
<SYSTEM32>\ggclyrz.exe
%TEMP%\ylhumdx3e8ljskjhtguo.exe
<SYSTEM32>\biiniyjd\tst
<SYSTEM32>\xfsuucwsesbz.exe
<SYSTEM32>\biiniyjd\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\ggclyrz.exe
<SYSTEM32>\xfsuucwsesbz.exe

Удаляет следующие файлы:

%WINDIR%\Temp\ylhumdx3lvsjsk.exe
<DRIVERS>\etc\hosts
%TEMP%\ylhumdx3e8ljskjhtguo.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'na###ther.net':80
'dr###wall.net':80
'na###orty.net':80
'dr###other.net':80
'tr###stood.net':80
'mi###ill.net':80
'na###all.net':80
'mi###tood.net':80
'dr###forty.net':80
'se###ther.net':80
'we####dayother.net':80
'se###orty.net':80
'we####dayforty.net':80
'dr###free.net':80
'na###ree.net':80
'se###all.net':80
'we####daywall.net':80
'tr###kill.net':80
'du###uess.net':80
'th###stood.net':80
'du###irst.net':80
'wi###uess.net':80
'si###kill.net':80
'th###first.net':80
'si###stood.net':80
'th###kill.net':80
'wi###irst.net':80
'mi###uess.net':80
'tr###guess.net':80
'mi###irst.net':80
'tr###first.net':80
'wi###ill.net':80
'du###ill.net':80
'wi###tood.net':80
'du###tood.net':80
'we####dayfree.net':80
'wa###ree.net':80
'mo###forty.net':80
'fa###all.net':80
'mo###free.net':80
'wa###ther.net':80
'mo###wall.net':80
'wa###orty.net':80
'mo###other.net':80
'le###wall.net':80
'be##lxc.com':80
'de###lxc.com':80
'ri###nstorm.net':80
'af###sllc.com':80
'le###other.net':80
'fa###ther.net':80
'le###forty.net':80
'fa###orty.net':80
'wa###all.net':80
'fo###forty.net':80
'af###other.net':80
'fo###free.net':80
'af###forty.net':80
'fo###wall.net':80
'se###ree.net':80
'fo###other.net':80
'af###wall.net':80
'af###free.net':80
'st###forty.net':80
'we###orty.net':80
'st###free.net':80
'we###ree.net':80
'st###wall.net':80
'we###all.net':80
'st###other.net':80
'we###ther.net':80

TCP:

Запросы HTTP GET:

http://na###ther.net/index.php
http://dr###wall.net/index.php
http://na###orty.net/index.php
http://dr###other.net/index.php
http://tr###stood.net/index.php
http://mi###ill.net/index.php
http://na###all.net/index.php
http://mi###tood.net/index.php
http://dr###forty.net/index.php
http://se###ther.net/index.php
http://we####dayother.net/index.php
http://se###orty.net/index.php
http://we####dayforty.net/index.php
http://dr###free.net/index.php
http://na###ree.net/index.php
http://se###all.net/index.php
http://we####daywall.net/index.php
http://tr###kill.net/index.php
http://du###uess.net/index.php
http://th###stood.net/index.php
http://du###irst.net/index.php
http://wi###uess.net/index.php
http://si###kill.net/index.php
http://th###first.net/index.php
http://si###stood.net/index.php
http://th###kill.net/index.php
http://wi###irst.net/index.php
http://mi###uess.net/index.php
http://tr###guess.net/index.php
http://mi###irst.net/index.php
http://tr###first.net/index.php
http://wi###ill.net/index.php
http://du###ill.net/index.php
http://wi###tood.net/index.php
http://du###tood.net/index.php
http://we####dayfree.net/index.php
http://wa###ree.net/index.php
http://mo###forty.net/index.php
http://fa###all.net/index.php
http://mo###free.net/index.php
http://wa###ther.net/index.php
http://mo###wall.net/index.php
http://wa###orty.net/index.php
http://mo###other.net/index.php
http://le###wall.net/index.php
http://be##lxc.com/index.php
http://de###lxc.com/index.php
http://ri###nstorm.net/index.php
http://af###sllc.com/index.php
http://le###other.net/index.php
http://fa###ther.net/index.php
http://le###forty.net/index.php
http://fa###orty.net/index.php
http://wa###all.net/index.php
http://fo###forty.net/index.php
http://af###other.net/index.php
http://fo###free.net/index.php
http://af###forty.net/index.php
http://fo###wall.net/index.php
http://se###ree.net/index.php
http://fo###other.net/index.php
http://af###wall.net/index.php
http://af###free.net/index.php
http://st###forty.net/index.php
http://we###orty.net/index.php
http://st###free.net/index.php
http://we###ree.net/index.php
http://st###wall.net/index.php
http://we###all.net/index.php
http://st###other.net/index.php
http://we###ther.net/index.php

UDP:

DNS ASK na###ther.net
DNS ASK dr###wall.net
DNS ASK na###orty.net
DNS ASK dr###other.net
DNS ASK na###all.net
DNS ASK mi###ill.net
DNS ASK tr###kill.net
DNS ASK mi###tood.net
DNS ASK tr###stood.net
DNS ASK se###ther.net
DNS ASK we####dayother.net
DNS ASK se###orty.net
DNS ASK we####dayforty.net
DNS ASK se###all.net
DNS ASK na###ree.net
DNS ASK dr###forty.net
DNS ASK we####daywall.net
DNS ASK dr###free.net
DNS ASK du###uess.net
DNS ASK th###stood.net
DNS ASK du###irst.net
DNS ASK wi###uess.net
DNS ASK si###stood.net
DNS ASK th###first.net
DNS ASK si###first.net
DNS ASK th###kill.net
DNS ASK si###kill.net
DNS ASK mi###uess.net
DNS ASK tr###guess.net
DNS ASK mi###irst.net
DNS ASK tr###first.net
DNS ASK wi###tood.net
DNS ASK du###ill.net
DNS ASK wi###irst.net
DNS ASK du###tood.net
DNS ASK wi###ill.net
DNS ASK we####dayfree.net
DNS ASK wa###ree.net
DNS ASK mo###forty.net
DNS ASK fa###all.net
DNS ASK mo###free.net
DNS ASK wa###ther.net
DNS ASK mo###wall.net
DNS ASK wa###orty.net
DNS ASK mo###other.net
DNS ASK le###wall.net
DNS ASK be##lxc.com
DNS ASK de###lxc.com
DNS ASK ri###nstorm.net
DNS ASK af###sllc.com
DNS ASK le###other.net
DNS ASK fa###ther.net
DNS ASK le###forty.net
DNS ASK fa###orty.net
DNS ASK wa###all.net
DNS ASK fo###forty.net
DNS ASK af###other.net
DNS ASK fo###free.net
DNS ASK af###forty.net
DNS ASK fo###wall.net
DNS ASK se###ree.net
DNS ASK fo###other.net
DNS ASK af###wall.net
DNS ASK af###free.net
DNS ASK st###forty.net
DNS ASK we###orty.net
DNS ASK st###free.net
DNS ASK we###ree.net
DNS ASK st###wall.net
DNS ASK we###all.net
DNS ASK st###other.net
DNS ASK we###ther.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней