Trojan.DownLoader18.33890

Добавлен в вирусную базу Dr.Web: 2015-12-30

Описание добавлено: 2015-12-30

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Enumerator Client Telephony' = '<SYSTEM32>\gocyjil.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Transfer Encrypting Driver KtmRm Panel] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\jctmvdbjr.exe' "<SYSTEM32>\gocyjil.exe"
'%WINDIR%\Temp\jrj7tk3j5ormbs.exe' -r 25669 tcp
'%TEMP%\jrj7tk3cs3rmbsnaaqhug8.exe'
'<SYSTEM32>\gocyjil.exe'

Modifies file system :

Creates the following files:

<SYSTEM32>\znbvdkiyenwg\run
<SYSTEM32>\znbvdkiyenwg\rng
%WINDIR%\Temp\jrj7tk3j5ormbs.exe
<SYSTEM32>\znbvdkiyenwg\cfg
<SYSTEM32>\jctmvdbjr.exe
%TEMP%\jrj7tk3cs3rmbsnaaqhug8.exe
<SYSTEM32>\znbvdkiyenwg\tst
<SYSTEM32>\gocyjil.exe
<SYSTEM32>\znbvdkiyenwg\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\jctmvdbjr.exe
<SYSTEM32>\gocyjil.exe

Deletes the following files:

%WINDIR%\Temp\jrj7tk3j5ormbs.exe
<DRIVERS>\etc\hosts
%TEMP%\jrj7tk3cs3rmbsnaaqhug8.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'pl###kill.net':80
'fi###ill.net':80
'pl###stood.net':80
'fi###tood.net':80
'pl###first.net':80
'fi###uess.net':80
'se###stood.net':80
'fi###irst.net':80
'pl###guess.net':80
'vi###tood.net':80
'lr###kill.net':80
'yo###uess.net':80
'lr###stood.net':80
'vi###ill.net':80
'lr###guess.net':80
'vi###uess.net':80
'lr###first.net':80
'vi###irst.net':80
'to###irst.net':80
'fa###irst.net':80
'to###ill.net':80
'fa###ill.net':80
'to###uess.net':80
've###tood.net':80
'we###ill.net':80
'fa###uess.net':80
'we###tood.net':80
'le###kill.net':80
'se###first.net':80
'le###stood.net':80
'se###kill.net':80
'le###first.net':80
'to###tood.net':80
'fa###tood.net':80
'se###guess.net':80
'le###guess.net':80
'no###ctover.net':80
'li###ctover.net':80
'ri###nstorm.net':80
'be##lxc.com':80
'no###orse.net':80
'no###orld.net':80
'we###njoy.net':80
'li###orse.net':80
'we###orld.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'ab###ell.net':80
'ca####nbring.net':80
'al###being.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'tr###stood.net':80
'yo###tood.net':80
'ri###orse.net':80
'fa###horse.net':80
'tr###kill.net':80
'yo###irst.net':80
'tr###guess.net':80
'yo###ill.net':80
'tr###first.net':80
'we###orse.net':80
'ri###orld.net':80
'no###njoy.net':80
'we###ctover.net':80
'fa###world.net':80
'ri###ctover.net':80
'fa####ctover.net':80
'ri###njoy.net':80
'fa###enjoy.net':80

TCP:

HTTP GET requests:

http://pl###kill.net/index.php
http://fi###ill.net/index.php
http://pl###stood.net/index.php
http://fi###tood.net/index.php
http://pl###first.net/index.php
http://fi###uess.net/index.php
http://se###stood.net/index.php
http://fi###irst.net/index.php
http://pl###guess.net/index.php
http://vi###tood.net/index.php
http://lr###kill.net/index.php
http://yo###uess.net/index.php
http://lr###stood.net/index.php
http://vi###ill.net/index.php
http://lr###guess.net/index.php
http://vi###uess.net/index.php
http://lr###first.net/index.php
http://vi###irst.net/index.php
http://to###irst.net/index.php
http://fa###irst.net/index.php
http://to###ill.net/index.php
http://fa###ill.net/index.php
http://to###uess.net/index.php
http://ve###tood.net/index.php
http://we###ill.net/index.php
http://fa###uess.net/index.php
http://we###tood.net/index.php
http://le###kill.net/index.php
http://se###first.net/index.php
http://le###stood.net/index.php
http://se###kill.net/index.php
http://le###first.net/index.php
http://to###tood.net/index.php
http://fa###tood.net/index.php
http://se###guess.net/index.php
http://le###guess.net/index.php
http://no###ctover.net/index.php
http://li###ctover.net/index.php
http://ri###nstorm.net/index.php
http://be##lxc.com/index.php
http://no###orse.net/index.php
http://no###orld.net/index.php
http://we###njoy.net/index.php
http://li###orse.net/index.php
http://we###orld.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://ca####nbring.net/index.php
http://al###being.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://tr###stood.net/index.php
http://yo###tood.net/index.php
http://ri###orse.net/index.php
http://fa###horse.net/index.php
http://tr###kill.net/index.php
http://yo###irst.net/index.php
http://tr###guess.net/index.php
http://yo###ill.net/index.php
http://tr###first.net/index.php
http://we###orse.net/index.php
http://ri###orld.net/index.php
http://no###njoy.net/index.php
http://we###ctover.net/index.php
http://fa###world.net/index.php
http://ri###ctover.net/index.php
http://fa####ctover.net/index.php
http://ri###njoy.net/index.php
http://fa###enjoy.net/index.php

UDP:

DNS ASK pl###kill.net
DNS ASK fi###ill.net
DNS ASK pl###stood.net
DNS ASK fi###tood.net
DNS ASK pl###first.net
DNS ASK fi###uess.net
DNS ASK se###stood.net
DNS ASK fi###irst.net
DNS ASK pl###guess.net
DNS ASK vi###tood.net
DNS ASK lr###kill.net
DNS ASK yo###uess.net
DNS ASK lr###stood.net
DNS ASK vi###ill.net
DNS ASK lr###guess.net
DNS ASK vi###uess.net
DNS ASK lr###first.net
DNS ASK vi###irst.net
DNS ASK le###stood.net
DNS ASK fa###irst.net
DNS ASK to###uess.net
DNS ASK fa###ill.net
DNS ASK to###irst.net
DNS ASK fa###uess.net
DNS ASK we###ill.net
DNS ASK ve###ill.net
DNS ASK we###tood.net
DNS ASK ve###tood.net
DNS ASK se###first.net
DNS ASK le###first.net
DNS ASK se###kill.net
DNS ASK le###kill.net
DNS ASK se###guess.net
DNS ASK fa###tood.net
DNS ASK to###ill.net
DNS ASK le###guess.net
DNS ASK to###tood.net
DNS ASK no###ctover.net
DNS ASK li###ctover.net
DNS ASK ri###nstorm.net
DNS ASK be##lxc.com
DNS ASK no###orse.net
DNS ASK no###orld.net
DNS ASK we###njoy.net
DNS ASK li###orse.net
DNS ASK we###orld.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK ca####nbring.net
DNS ASK al###being.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK tr###stood.net
DNS ASK yo###tood.net
DNS ASK ri###orse.net
DNS ASK fa###horse.net
DNS ASK tr###kill.net
DNS ASK yo###irst.net
DNS ASK tr###guess.net
DNS ASK yo###ill.net
DNS ASK tr###first.net
DNS ASK we###orse.net
DNS ASK ri###orld.net
DNS ASK no###njoy.net
DNS ASK we###ctover.net
DNS ASK fa###world.net
DNS ASK ri###ctover.net
DNS ASK fa####ctover.net
DNS ASK ri###njoy.net
DNS ASK fa###enjoy.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней