Trojan.DownLoader17.51790

Добавлен в вирусную базу Dr.Web: 2015-11-16

Описание добавлено: 2015-11-16

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Removal Extensible Port Drive' = '<SYSTEM32>\iufwmsxh.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Quality UPnP IKE Base Error] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\mgagjnj.exe' "<SYSTEM32>\iufwmsxh.exe"
'%WINDIR%\Temp\qukna52yi7byua.exe' -r 25468 tcp
'%TEMP%\qukna52pywbyuap8rqju.exe'
'<SYSTEM32>\iufwmsxh.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\hgdpnts\run
<SYSTEM32>\hgdpnts\rng
%WINDIR%\Temp\qukna52yi7byua.exe
<SYSTEM32>\hgdpnts\cfg
<SYSTEM32>\mgagjnj.exe
%TEMP%\qukna52pywbyuap8rqju.exe
<SYSTEM32>\hgdpnts\tst
<SYSTEM32>\iufwmsxh.exe
<SYSTEM32>\hgdpnts\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\mgagjnj.exe
<SYSTEM32>\iufwmsxh.exe

Deletes the following files:

%WINDIR%\Temp\qukna52yi7byua.exe
<DRIVERS>\etc\hosts
%TEMP%\qukna52pywbyuap8rqju.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'th###tate.net':80
'qu###broke.net':80
'he###ews.net':80
'qu###state.net':80
'th###roke.net':80
'qu###news.net':80
'th###ews.net':80
'qu###mark.net':80
'th###ark.net':80
'ca###tate.net':80
'he###tate.net':80
'th###news.net':80
'si###news.net':80
'ca###roke.net':80
'he###ark.net':80
'ca###ews.net':80
'he###roke.net':80
'ca###ark.net':80
'si###roke.net':80
'me###ark.net':80
'si###tate.net':80
'me###roke.net':80
'si###ark.net':80
'cl###state.net':80
'da###tate.net':80
'me###ews.net':80
'si###ews.net':80
'su###ybroke.net':80
'mo###roke.net':80
'su###ystate.net':80
'mo###tate.net':80
'su###ymark.net':80
'mo###ews.net':80
'me###tate.net':80
'mo###ark.net':80
'su###ynews.net':80
'si###mark.net':80
'cl###teach.net':80
'da###each.net':80
'ri###nstorm.net':80
'be##lxc.com':80
'cl###grave.net':80
'tr###state.net':80
'mi###roke.net':80
'da###rave.net':80
'mi###tate.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'ab###ell.net':80
'ca####nbring.net':80
'al###being.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'wi###ews.net':80
'du###ews.net':80
'wi###ark.net':80
'du###ark.net':80
'th###state.net':80
'si###broke.net':80
'th###mark.net':80
'si###state.net':80
'th###broke.net':80
'tr###mark.net':80
'mi###ews.net':80
'tr###broke.net':80
'mi###ark.net':80
'tr###news.net':80
'wi###roke.net':80
'du###roke.net':80
'wi###tate.net':80
'du###tate.net':80

TCP:

HTTP GET requests:

http://th###tate.net/index.php
http://qu###broke.net/index.php
http://he###ews.net/index.php
http://qu###state.net/index.php
http://th###roke.net/index.php
http://qu###news.net/index.php
http://th###ews.net/index.php
http://qu###mark.net/index.php
http://th###ark.net/index.php
http://ca###tate.net/index.php
http://he###tate.net/index.php
http://th###news.net/index.php
http://si###news.net/index.php
http://ca###roke.net/index.php
http://he###ark.net/index.php
http://ca###ews.net/index.php
http://he###roke.net/index.php
http://ca###ark.net/index.php
http://si###roke.net/index.php
http://me###ark.net/index.php
http://si###tate.net/index.php
http://me###roke.net/index.php
http://si###ark.net/index.php
http://cl###state.net/index.php
http://da###tate.net/index.php
http://me###ews.net/index.php
http://si###ews.net/index.php
http://su###ybroke.net/index.php
http://mo###roke.net/index.php
http://su###ystate.net/index.php
http://mo###tate.net/index.php
http://su###ymark.net/index.php
http://mo###ews.net/index.php
http://me###tate.net/index.php
http://mo###ark.net/index.php
http://su###ynews.net/index.php
http://si###mark.net/index.php
http://cl###teach.net/index.php
http://da###each.net/index.php
http://ri###nstorm.net/index.php
http://be##lxc.com/index.php
http://cl###grave.net/index.php
http://tr###state.net/index.php
http://mi###roke.net/index.php
http://da###rave.net/index.php
http://mi###tate.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://ca####nbring.net/index.php
http://al###being.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://wi###ews.net/index.php
http://du###ews.net/index.php
http://wi###ark.net/index.php
http://du###ark.net/index.php
http://th###state.net/index.php
http://si###broke.net/index.php
http://th###mark.net/index.php
http://si###state.net/index.php
http://th###broke.net/index.php
http://tr###mark.net/index.php
http://mi###ews.net/index.php
http://tr###broke.net/index.php
http://mi###ark.net/index.php
http://tr###news.net/index.php
http://wi###roke.net/index.php
http://du###roke.net/index.php
http://wi###tate.net/index.php
http://du###tate.net/index.php

UDP:

DNS ASK th###tate.net
DNS ASK qu###broke.net
DNS ASK he###ews.net
DNS ASK qu###state.net
DNS ASK th###roke.net
DNS ASK qu###news.net
DNS ASK th###ews.net
DNS ASK qu###mark.net
DNS ASK th###ark.net
DNS ASK ca###tate.net
DNS ASK he###tate.net
DNS ASK th###news.net
DNS ASK si###news.net
DNS ASK ca###roke.net
DNS ASK he###ark.net
DNS ASK ca###ews.net
DNS ASK he###roke.net
DNS ASK ca###ark.net
DNS ASK su###ystate.net
DNS ASK me###ark.net
DNS ASK si###ark.net
DNS ASK me###roke.net
DNS ASK si###roke.net
DNS ASK me###ews.net
DNS ASK da###tate.net
DNS ASK cl###broke.net
DNS ASK si###ews.net
DNS ASK cl###state.net
DNS ASK mo###roke.net
DNS ASK su###ymark.net
DNS ASK mo###tate.net
DNS ASK su###ybroke.net
DNS ASK mo###ark.net
DNS ASK me###tate.net
DNS ASK si###tate.net
DNS ASK su###ynews.net
DNS ASK mo###ews.net
DNS ASK si###mark.net
DNS ASK cl###teach.net
DNS ASK da###each.net
DNS ASK ri###nstorm.net
DNS ASK be##lxc.com
DNS ASK cl###grave.net
DNS ASK tr###state.net
DNS ASK mi###roke.net
DNS ASK da###rave.net
DNS ASK mi###tate.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK ca####nbring.net
DNS ASK al###being.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK wi###ews.net
DNS ASK du###ews.net
DNS ASK wi###ark.net
DNS ASK du###ark.net
DNS ASK th###state.net
DNS ASK si###broke.net
DNS ASK th###mark.net
DNS ASK si###state.net
DNS ASK th###broke.net
DNS ASK tr###mark.net
DNS ASK mi###ews.net
DNS ASK tr###broke.net
DNS ASK mi###ark.net
DNS ASK tr###news.net
DNS ASK wi###roke.net
DNS ASK du###roke.net
DNS ASK wi###tate.net
DNS ASK du###tate.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней