Trojan.DownLoader23.3618

Добавлен в вирусную базу Dr.Web: 2016-10-25

Описание добавлено: 2016-10-25

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Level Awareness Detection Security Debugger' = '<SYSTEM32>\turqtwclsubs.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Logon Redirector Tools Debugger] 'ImagePath' = '<SYSTEM32>\turqtwclsubs.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Logon Redirector Tools Debugger] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Запускает на исполнение:

'<SYSTEM32>\zpanljgy.exe' "<SYSTEM32>\turqtwclsubs.exe"
'%WINDIR%\Temp\vzfiyg3jnhukucy.exe' -r 42971 tcp
'%TEMP%\vzfiyg3au7ukucyikvyxvyr.exe'
'<SYSTEM32>\turqtwclsubs.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\qpaiushvx\run
<SYSTEM32>\qpaiushvx\rng
%WINDIR%\Temp\vzfiyg3jnhukucy.exe
<SYSTEM32>\qpaiushvx\cfg
<SYSTEM32>\zpanljgy.exe
%TEMP%\vzfiyg3au7ukucyikvyxvyr.exe
<SYSTEM32>\qpaiushvx\tst
<SYSTEM32>\turqtwclsubs.exe
<SYSTEM32>\qpaiushvx\etc

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\zpanljgy.exe
<SYSTEM32>\turqtwclsubs.exe

Удаляет следующие файлы:

%WINDIR%\Temp\vzfiyg3jnhukucy.exe
<DRIVERS>\etc\hosts
%TEMP%\vzfiyg3au7ukucyikvyxvyr.exe

Подменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ju###uesday.net':80
'mo###eace.net':80
'ju###ift.net':80
'mo###uesday.net':80
'wh###ouse.net':80
'hi###ift.net':80
'ju###eace.net':80
'hi###ouse.net':80
'mo###ift.net':80
'ro###uesday.net':80
'si###uesday.net':80
'ro###ift.net':80
'si###ift.net':80
'mo###ouse.net':80
'ju###ouse.net':80
'ro###eace.net':80
'si###eace.net':80
'fe###eace.net':80
'lo###eace.net':80
'fe###uesday.net':80
'lo###uesday.net':80
'th####uesday.net':80
'th###peace.net':80
'th###house.net':80
'th###gift.net':80
'lo###ift.net':80
'wh###uesday.net':80
'hi###eace.net':80
'wh###ift.net':80
'hi###uesday.net':80
'lo###ouse.net':80
'fe###ift.net':80
'wh###eace.net':80
'fe###ouse.net':80
'si###ouse.net':80
'al###being.net':80
'ri###nstorm.net':80
'pr####tbottom.net':80
'ca####nbring.net':80
'dr###serve.net':80
'wi###erve.net':80
'dr###live.net':80
'wi###ive.net':80
'mo###olor.net':80
'jo####ymeasure.net':80
'cr#####onaraminta.net':80
'ef###tbuilt.net':80
'th###while.net':80
'mi###hown.net':80
'ab###ell.net':80
'le###form.net':80
'mo###ugust.net':80
'so###ift.net':80
'pi###uesday.net':80
'so###ouse.net':80
'pi###ift.net':80
'so###eace.net':80
'ro###ouse.net':80
'so###uesday.net':80
'pi###eace.net':80
'pi###ouse.net':80
'kn###ift.net':80
'ab###ift.net':80
'kn###ouse.net':80
'ab###ouse.net':80
'kn###eace.net':80
'ab###eace.net':80
'kn###uesday.net':80
'ab###uesday.net':80

TCP:

Запросы HTTP GET:

http://ju###uesday.net/index.php
http://mo###eace.net/index.php
http://ju###ift.net/index.php
http://mo###uesday.net/index.php
http://wh###ouse.net/index.php
http://hi###ift.net/index.php
http://ju###eace.net/index.php
http://hi###ouse.net/index.php
http://mo###ift.net/index.php
http://ro###uesday.net/index.php
http://si###uesday.net/index.php
http://ro###ift.net/index.php
http://si###ift.net/index.php
http://mo###ouse.net/index.php
http://ju###ouse.net/index.php
http://ro###eace.net/index.php
http://si###eace.net/index.php
http://fe###eace.net/index.php
http://lo###eace.net/index.php
http://fe###uesday.net/index.php
http://lo###uesday.net/index.php
http://th####uesday.net/index.php
http://th###peace.net/index.php
http://th###house.net/index.php
http://th###gift.net/index.php
http://lo###ift.net/index.php
http://wh###uesday.net/index.php
http://hi###eace.net/index.php
http://wh###ift.net/index.php
http://hi###uesday.net/index.php
http://lo###ouse.net/index.php
http://fe###ift.net/index.php
http://wh###eace.net/index.php
http://fe###ouse.net/index.php
http://si###ouse.net/index.php
http://al###being.net/index.php
http://ri###nstorm.net/index.php
http://pr####tbottom.net/index.php
http://ca####nbring.net/index.php
http://dr###serve.net/index.php
http://wi###erve.net/index.php
http://dr###live.net/index.php
http://wi###ive.net/index.php
http://mo###olor.net/index.php
http://jo####ymeasure.net/index.php
http://cr#####onaraminta.net/index.php
http://ef###tbuilt.net/index.php
http://th###while.net/index.php
http://mi###hown.net/index.php
http://ab###ell.net/index.php
http://le###form.net/index.php
http://mo###ugust.net/index.php
http://so###ift.net/index.php
http://pi###uesday.net/index.php
http://so###ouse.net/index.php
http://pi###ift.net/index.php
http://so###eace.net/index.php
http://ro###ouse.net/index.php
http://so###uesday.net/index.php
http://pi###eace.net/index.php
http://pi###ouse.net/index.php
http://kn###ift.net/index.php
http://ab###ift.net/index.php
http://kn###ouse.net/index.php
http://ab###ouse.net/index.php
http://kn###eace.net/index.php
http://ab###eace.net/index.php
http://kn###uesday.net/index.php
http://ab###uesday.net/index.php

UDP:

DNS ASK mo###uesday.net
DNS ASK ju###uesday.net
DNS ASK mo###ift.net
DNS ASK ju###ift.net
DNS ASK hi###ouse.net
DNS ASK wh###ouse.net
DNS ASK mo###eace.net
DNS ASK ju###eace.net
DNS ASK ju###ouse.net
DNS ASK si###ift.net
DNS ASK ro###uesday.net
DNS ASK si###ouse.net
DNS ASK ro###ift.net
DNS ASK si###eace.net
DNS ASK mo###ouse.net
DNS ASK si###uesday.net
DNS ASK ro###eace.net
DNS ASK hi###ift.net
DNS ASK fe###eace.net
DNS ASK lo###eace.net
DNS ASK fe###uesday.net
DNS ASK lo###uesday.net
DNS ASK th####uesday.net
DNS ASK th###peace.net
DNS ASK th###house.net
DNS ASK th###gift.net
DNS ASK lo###ift.net
DNS ASK wh###uesday.net
DNS ASK hi###eace.net
DNS ASK wh###ift.net
DNS ASK hi###uesday.net
DNS ASK lo###ouse.net
DNS ASK fe###ift.net
DNS ASK wh###eace.net
DNS ASK fe###ouse.net
DNS ASK al###being.net
DNS ASK ri###nstorm.net
DNS ASK pr####tbottom.net
DNS ASK ca####nbring.net
DNS ASK dr###serve.net
DNS ASK wi###erve.net
DNS ASK dr###live.net
DNS ASK wi###ive.net
DNS ASK mo###olor.net
DNS ASK jo####ymeasure.net
DNS ASK cr#####onaraminta.net
DNS ASK ef###tbuilt.net
DNS ASK th###while.net
DNS ASK mi###hown.net
DNS ASK ab###ell.net
DNS ASK le###form.net
DNS ASK mo###ugust.net
DNS ASK so###ift.net
DNS ASK pi###uesday.net
DNS ASK so###ouse.net
DNS ASK pi###ift.net
DNS ASK so###eace.net
DNS ASK ro###ouse.net
DNS ASK so###uesday.net
DNS ASK pi###eace.net
DNS ASK pi###ouse.net
DNS ASK kn###ift.net
DNS ASK ab###ift.net
DNS ASK kn###ouse.net
DNS ASK ab###ouse.net
DNS ASK kn###eace.net
DNS ASK ab###eace.net
DNS ASK kn###uesday.net
DNS ASK ab###uesday.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней