Trojan.DownLoader18.27482

Добавлен в вирусную базу Dr.Web: 2015-12-27

Описание добавлено: 2015-12-27

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Studio Launcher Engine User-mode Video Quality' = '<SYSTEM32>\nfrxubhnsbv.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Themes Transfer Plug Protected Level] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\ttwivmpfyhu.exe' "<SYSTEM32>\nfrxubhnsbv.exe"
'%WINDIR%\Temp\mjrzjobifq2pse.exe' -r 44515 tcp
'%TEMP%\mjrzjofk7apsseldgvp3.exe'
'<SYSTEM32>\nfrxubhnsbv.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\cniegkzaevi\run
<SYSTEM32>\cniegkzaevi\rng
%WINDIR%\Temp\mjrzjobifq2pse.exe
<SYSTEM32>\cniegkzaevi\cfg
%TEMP%\mjrzjofk7apsseldgvp3.exe
<SYSTEM32>\cniegkzaevi\tst
<SYSTEM32>\ttwivmpfyhu.exe
<SYSTEM32>\nfrxubhnsbv.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\ttwivmpfyhu.exe
<SYSTEM32>\nfrxubhnsbv.exe

Deletes the following files:

%WINDIR%\Temp\mjrzjobifq2pse.exe
%TEMP%\mjrzjofk7apsseldgvp3.exe

Network activity:

Connects to:

'li###arth.net':80
'th###allow.net':80
'th###earth.net':80
'th###taste.net':80
'li###aste.net':80
'li###llow.net':80
'we###aste.net':80
'fe###arth.net':80
'fe###aste.net':80
'th###gives.net':80
'li###ives.net':80
'so###taste.net':80
'fi###taste.net':80
'fa###guess.net':80
'fa###first.net':80
'ri###uess.net':80
'so###earth.net':80
'so###gives.net':80
'fi###gives.net':80
'fi###allow.net':80
'fi###earth.net':80
'so###allow.net':80
'ca###aste.net':80
'po###earth.net':80
'po###taste.net':80
'ta###gives.net':80
'le###ives.net':80
'ca###arth.net':80
'ca###ives.net':80
'no###aste.net':80
'po###gives.net':80
'po###allow.net':80
'ca###llow.net':80
'fe###ives.net':80
'we###ives.net':80
'we###llow.net':80
'we###arth.net':80
'fe###llow.net':80
'ta###taste.net':80
'ta###allow.net':80
'le###llow.net':80
'le###arth.net':80
'le###aste.net':80
'ta###earth.net':80
'le###ill.net':80
'ta###first.net':80
'ta###kill.net':80
'th###while.net':80
'le###tood.net':80
'le###irst.net':80
'ca###tood.net':80
'po###kill.net':80
'po###stood.net':80
'ta###guess.net':80
'le###uess.net':80
'se####strong.net':80
'si######edwerryhouse.net':80
'de####promise.net':80
'or###thrown.net':80
'jo####ymeasure.net':80
'mo####gduring.net':80
'ri###nstorm.net':80
'ef###tbuilt.net':80
'of####urprise.net':80
'ch####nother.net':80
'gw#####ynhuddleston.net':80
'we###ill.net':80
'we###irst.net':80
'we###tood.net':80
'no###uess.net':80
'li###uess.net':80
'we###uess.net':80
'fa###kill.net':80
'ri###irst.net':80
'ri###ill.net':80
'ri###tood.net':80
'fa###stood.net':80
'po###guess.net':80
'ca###uess.net':80
'ca###irst.net':80
'ca###ill.net':80
'po###first.net':80
'no###tood.net':80
'no###irst.net':80
'li###irst.net':80
'li###ill.net':80
'li###tood.net':80
'no###ill.net':80

TCP:

HTTP GET requests:

http://li###arth.net/index.php
http://th###allow.net/index.php
http://th###earth.net/index.php
http://th###taste.net/index.php
http://li###aste.net/index.php
http://li###llow.net/index.php
http://we###aste.net/index.php
http://fe###arth.net/index.php
http://fe###aste.net/index.php
http://th###gives.net/index.php
http://li###ives.net/index.php
http://so###taste.net/index.php
http://fi###taste.net/index.php
http://fa###guess.net/index.php
http://fa###first.net/index.php
http://ri###uess.net/index.php
http://so###earth.net/index.php
http://so###gives.net/index.php
http://fi###gives.net/index.php
http://fi###allow.net/index.php
http://fi###earth.net/index.php
http://so###allow.net/index.php
http://ca###aste.net/index.php
http://po###earth.net/index.php
http://po###taste.net/index.php
http://ta###gives.net/index.php
http://le###ives.net/index.php
http://ca###arth.net/index.php
http://ca###ives.net/index.php
http://no###aste.net/index.php
http://po###gives.net/index.php
http://po###allow.net/index.php
http://ca###llow.net/index.php
http://fe###ives.net/index.php
http://we###ives.net/index.php
http://we###llow.net/index.php
http://we###arth.net/index.php
http://fe###llow.net/index.php
http://ta###taste.net/index.php
http://ta###allow.net/index.php
http://le###llow.net/index.php
http://le###arth.net/index.php
http://le###aste.net/index.php
http://ta###earth.net/index.php
http://le###ill.net/index.php
http://ta###first.net/index.php
http://ta###kill.net/index.php
http://th###while.net/index.php
http://le###tood.net/index.php
http://le###irst.net/index.php
http://ca###tood.net/index.php
http://po###kill.net/index.php
http://po###stood.net/index.php
http://ta###guess.net/index.php
http://le###uess.net/index.php
http://se####strong.net/index.php
http://si######edwerryhouse.net/index.php
http://de####promise.net/index.php
http://or###thrown.net/index.php
http://jo####ymeasure.net/index.php
http://mo####gduring.net/index.php
http://ri###nstorm.net/index.php
http://ef###tbuilt.net/index.php
http://of####urprise.net/index.php
http://ch####nother.net/index.php
http://gw#####ynhuddleston.net/index.php
http://we###ill.net/index.php
http://we###irst.net/index.php
http://we###tood.net/index.php
http://no###uess.net/index.php
http://li###uess.net/index.php
http://we###uess.net/index.php
http://fa###kill.net/index.php
http://ri###irst.net/index.php
http://ri###ill.net/index.php
http://ri###tood.net/index.php
http://fa###stood.net/index.php
http://po###guess.net/index.php
http://ca###uess.net/index.php
http://ca###irst.net/index.php
http://ca###ill.net/index.php
http://po###first.net/index.php
http://no###tood.net/index.php
http://no###irst.net/index.php
http://li###irst.net/index.php
http://li###ill.net/index.php
http://li###tood.net/index.php
http://no###ill.net/index.php

UDP:

DNS ASK li###arth.net
DNS ASK th###allow.net
DNS ASK th###earth.net
DNS ASK th###taste.net
DNS ASK li###aste.net
DNS ASK li###llow.net
DNS ASK we###aste.net
DNS ASK fe###arth.net
DNS ASK fe###aste.net
DNS ASK th###gives.net
DNS ASK li###ives.net
DNS ASK so###taste.net
DNS ASK fi###taste.net
DNS ASK fa###guess.net
DNS ASK fa###first.net
DNS ASK ri###uess.net
DNS ASK so###earth.net
DNS ASK so###gives.net
DNS ASK fi###gives.net
DNS ASK fi###allow.net
DNS ASK fi###earth.net
DNS ASK so###allow.net
DNS ASK ca###aste.net
DNS ASK po###earth.net
DNS ASK po###taste.net
DNS ASK ta###gives.net
DNS ASK le###ives.net
DNS ASK ca###arth.net
DNS ASK ca###ives.net
DNS ASK no###aste.net
DNS ASK po###gives.net
DNS ASK po###allow.net
DNS ASK ca###llow.net
DNS ASK fe###ives.net
DNS ASK we###ives.net
DNS ASK we###llow.net
DNS ASK we###arth.net
DNS ASK fe###llow.net
DNS ASK ta###taste.net
DNS ASK ta###allow.net
DNS ASK le###llow.net
DNS ASK le###arth.net
DNS ASK le###aste.net
DNS ASK ta###earth.net
DNS ASK ri###irst.net
DNS ASK le###ill.net
DNS ASK ta###first.net
DNS ASK ta###kill.net
DNS ASK th###while.net
DNS ASK le###tood.net
DNS ASK po###stood.net
DNS ASK ca###tood.net
DNS ASK le###uess.net
DNS ASK le###irst.net
DNS ASK ta###guess.net
DNS ASK ef###tbuilt.net
DNS ASK se####strong.net
DNS ASK si######edwerryhouse.net
DNS ASK de####promise.net
DNS ASK or###thrown.net
DNS ASK jo####ymeasure.net
DNS ASK of####urprise.net
DNS ASK ri###nstorm.net
DNS ASK gw#####ynhuddleston.net
DNS ASK mo####gduring.net
DNS ASK ch####nother.net
DNS ASK po###kill.net
DNS ASK we###ill.net
DNS ASK we###irst.net
DNS ASK we###tood.net
DNS ASK no###uess.net
DNS ASK li###uess.net
DNS ASK ri###ill.net
DNS ASK fa###kill.net
DNS ASK fa###stood.net
DNS ASK we###uess.net
DNS ASK ri###tood.net
DNS ASK li###irst.net
DNS ASK po###guess.net
DNS ASK ca###uess.net
DNS ASK ca###irst.net
DNS ASK ca###ill.net
DNS ASK po###first.net
DNS ASK li###ill.net
DNS ASK no###irst.net
DNS ASK no###ill.net
DNS ASK no###tood.net
DNS ASK li###tood.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней