Trojan.DownLoader19.30817

Добавлен в вирусную базу Dr.Web: 2016-02-21

Описание добавлено: 2016-02-21

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Profile PnP-X IP Bluetooth User-mode Service' = '<SYSTEM32>\asvljlx.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Distributed Counter Shadow] 'ImagePath' = '<SYSTEM32>\asvljlx.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Distributed Counter Shadow] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

'<SYSTEM32>\xlyxgrpckhe.exe' "<SYSTEM32>\asvljlx.exe"
'%WINDIR%\Temp\dylfk6y3iyqwp.exe' -r 45804 tcp
'%TEMP%\dylfk6y3dv5wpn5kpot.exe'
'<SYSTEM32>\asvljlx.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\nekialyocxsiech\run
<SYSTEM32>\nekialyocxsiech\rng
%WINDIR%\Temp\dylfk6y3iyqwp.exe
<SYSTEM32>\nekialyocxsiech\cfg
<SYSTEM32>\xlyxgrpckhe.exe
%TEMP%\dylfk6y3dv5wpn5kpot.exe
<SYSTEM32>\nekialyocxsiech\tst
<SYSTEM32>\asvljlx.exe
<SYSTEM32>\nekialyocxsiech\etc

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\xlyxgrpckhe.exe
<SYSTEM32>\asvljlx.exe

Deletes the following files:

%WINDIR%\Temp\dylfk6y3iyqwp.exe
<DRIVERS>\etc\hosts
%TEMP%\dylfk6y3dv5wpn5kpot.exe

Substitutes the HOSTS file.

Network activity:

Connects to:

'fe###roke.net':80
'we###roke.net':80
'fe###tate.net':80
'we###tate.net':80
'fe###ark.net':80
'we###ews.net':80
'ta###state.net':80
'we###ark.net':80
'fe###ews.net':80
'li###tate.net':80
'th###broke.net':80
'fi###news.net':80
'th###state.net':80
'li###roke.net':80
'th###news.net':80
'li###ews.net':80
'th###mark.net':80
'li###ark.net':80
'le###tate.net':80
'ca###ark.net':80
'po###news.net':80
'ca###roke.net':80
'po###mark.net':80
'ca###ews.net':80
'no###ark.net':80
'no###ews.net':80
'no###tate.net':80
'no###roke.net':80
'ta###mark.net':80
'le###ark.net':80
'ta###broke.net':80
'le###roke.net':80
'ta###news.net':80
'ca###tate.net':80
'po###broke.net':80
'le###ews.net':80
'po###state.net':80
'li###ould.net':80
'no###each.net':80
'ri###nstorm.net':80
'be##lxc.com':80
'li###each.net':80
'we###sual.net':80
'no###sual.net':80
'no###rave.net':80
'li###rave.net':80
'mo###ugust.net':80
'mi###hown.net':80
'cr#####onaraminta.net':80
'le###form.net':80
'ab###ell.net':80
'ca####nbring.net':80
'al###being.net':80
'mo###olor.net':80
'pr####tbottom.net':80
'we###ould.net':80
'so###state.net':80
'fi###state.net':80
'ri###rave.net':80
'fa###grave.net':80
'so###broke.net':80
'fi###mark.net':80
'so###news.net':80
'fi###broke.net':80
'so###mark.net':80
'we###rave.net':80
'ri###sual.net':80
'no###ould.net':80
'we###each.net':80
'fa###usual.net':80
'ri###each.net':80
'fa###teach.net':80
'ri###ould.net':80
'fa###could.net':80

TCP:

HTTP GET requests:

http://fe###roke.net/index.php
http://we###roke.net/index.php
http://fe###tate.net/index.php
http://we###tate.net/index.php
http://fe###ark.net/index.php
http://we###ews.net/index.php
http://ta###state.net/index.php
http://we###ark.net/index.php
http://fe###ews.net/index.php
http://li###tate.net/index.php
http://th###broke.net/index.php
http://fi###news.net/index.php
http://th###state.net/index.php
http://li###roke.net/index.php
http://th###news.net/index.php
http://li###ews.net/index.php
http://th###mark.net/index.php
http://li###ark.net/index.php
http://le###tate.net/index.php
http://ca###ark.net/index.php
http://po###news.net/index.php
http://ca###roke.net/index.php
http://po###mark.net/index.php
http://ca###ews.net/index.php
http://no###ark.net/index.php
http://no###ews.net/index.php
http://no###tate.net/index.php
http://no###roke.net/index.php
http://ta###mark.net/index.php
http://le###ark.net/index.php
http://ta###broke.net/index.php
http://le###roke.net/index.php
http://ta###news.net/index.php
http://ca###tate.net/index.php
http://po###broke.net/index.php
http://le###ews.net/index.php
http://po###state.net/index.php
http://li###ould.net/index.php
http://no###each.net/index.php
http://ri###nstorm.net/index.php
http://be##lxc.com/index.php
http://li###each.net/index.php
http://we###sual.net/index.php
http://no###sual.net/index.php
http://no###rave.net/index.php
http://li###rave.net/index.php
http://mo###ugust.net/index.php
http://mi###hown.net/index.php
http://cr#####onaraminta.net/index.php
http://le###form.net/index.php
http://ab###ell.net/index.php
http://ca####nbring.net/index.php
http://al###being.net/index.php
http://mo###olor.net/index.php
http://pr####tbottom.net/index.php
http://we###ould.net/index.php
http://so###state.net/index.php
http://fi###state.net/index.php
http://ri###rave.net/index.php
http://fa###grave.net/index.php
http://so###broke.net/index.php
http://fi###mark.net/index.php
http://so###news.net/index.php
http://fi###broke.net/index.php
http://so###mark.net/index.php
http://we###rave.net/index.php
http://ri###sual.net/index.php
http://no###ould.net/index.php
http://we###each.net/index.php
http://fa###usual.net/index.php
http://ri###each.net/index.php
http://fa###teach.net/index.php
http://ri###ould.net/index.php
http://fa###could.net/index.php

UDP:

DNS ASK fe###roke.net
DNS ASK we###roke.net
DNS ASK fe###tate.net
DNS ASK we###tate.net
DNS ASK fe###ark.net
DNS ASK we###ews.net
DNS ASK ta###state.net
DNS ASK we###ark.net
DNS ASK fe###ews.net
DNS ASK li###tate.net
DNS ASK th###broke.net
DNS ASK fi###news.net
DNS ASK th###state.net
DNS ASK li###roke.net
DNS ASK th###news.net
DNS ASK li###ews.net
DNS ASK th###mark.net
DNS ASK li###ark.net
DNS ASK le###tate.net
DNS ASK ca###ark.net
DNS ASK po###news.net
DNS ASK ca###roke.net
DNS ASK po###mark.net
DNS ASK ca###ews.net
DNS ASK no###ark.net
DNS ASK no###ews.net
DNS ASK no###tate.net
DNS ASK no###roke.net
DNS ASK ta###mark.net
DNS ASK le###ark.net
DNS ASK ta###broke.net
DNS ASK le###roke.net
DNS ASK ta###news.net
DNS ASK ca###tate.net
DNS ASK po###broke.net
DNS ASK le###ews.net
DNS ASK po###state.net
DNS ASK so###news.net
DNS ASK li###ould.net
DNS ASK no###each.net
DNS ASK ri###nstorm.net
DNS ASK be##lxc.com
DNS ASK li###each.net
DNS ASK we###sual.net
DNS ASK no###sual.net
DNS ASK no###rave.net
DNS ASK li###rave.net
DNS ASK mo###ugust.net
DNS ASK mi###hown.net
DNS ASK cr#####onaraminta.net
DNS ASK le###form.net
DNS ASK ab###ell.net
DNS ASK ca####nbring.net
DNS ASK al###being.net
DNS ASK mo###olor.net
DNS ASK pr####tbottom.net
DNS ASK fa###grave.net
DNS ASK so###state.net
DNS ASK fa###teach.net
DNS ASK ri###rave.net
DNS ASK fi###state.net
DNS ASK so###mark.net
DNS ASK fi###mark.net
DNS ASK so###broke.net
DNS ASK fi###broke.net
DNS ASK we###each.net
DNS ASK we###rave.net
DNS ASK we###ould.net
DNS ASK no###ould.net
DNS ASK ri###sual.net
DNS ASK fa###could.net
DNS ASK ri###each.net
DNS ASK fa###usual.net
DNS ASK ri###ould.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней