Trojan.DownLoader22.20969

Добавлен в вирусную базу Dr.Web: 2016-08-16

Описание добавлено: 2016-08-15

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TCP/IP Source Tablet BitLocker Link ActiveX' = 'C:\fhrdjwqvzh\qzjddcfq.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Web Service Portable Health Link] 'ImagePath' = 'C:\fhrdjwqvzh\qzjddcfq.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Web Service Portable Health Link] 'Start' = '00000002'

Malicious functions:

Executes the following:

'C:\fhrdjwqvzh\yabceqzdn.exe' "c:\fhrdjwqvzh\qzjddcfq.exe"
'C:\fhrdjwqvzh\qzjddcfq.exe'
'C:\fhrdjwqvzh\ibtd2s46n2etutzicno.exe'

Modifies file system:

Creates the following files:

C:\fhrdjwqvzh\qzjddcfq.exe
C:\fhrdjwqvzh\yabceqzdn.exe
C:\fhrdjwqvzh\ibtd2s46n2etutzicno.exe
%WINDIR%\fhrdjwqvzh\ncosx4gle0q
C:\fhrdjwqvzh\ncosx4gle0q

Sets the 'hidden' attribute to the following files:

C:\fhrdjwqvzh\yabceqzdn.exe
C:\fhrdjwqvzh\qzjddcfq.exe

Deletes the following files:

C:\fhrdjwqvzh\ibtd2s46n2etutzicno.exe
%WINDIR%\fhrdjwqvzh\ncosx4gle0q

Network activity:

Connects to:

'cr###smell.net':80
'su###rearly.net':80
'su###rsmell.net':80
'be###future.net':80
'kn###future.net':80
'su####future.net':80
'cr###future.net':80
'cr###safety.net':80
'cr###early.net':80
'su####safety.net':80
'me####future.net':80
'be###smell.net':80
'fo####future.net':80
'fo####safety.net':80
'me####safety.net':80
'be###safety.net':80
'kn###safety.net':80
'kn###early.net':80
'kn###smell.net':80
'be###early.net':80
'sm###safety.net':80
'wo###future.net':80
'wo###safety.net':80
'wo###early.net':80
'sm###early.net':80
'pa###early.net':80
'fi###early.net':80
'fi###smell.net':80
'sm###future.net':80
'pa###smell.net':80
'wa###early.net':80
'th####tsafety.net':80
'th####tearly.net':80
'th####tsmell.net':80
'wa###smell.net':80
'wo###smell.net':80
'sm###smell.net':80
'wa###future.net':80
'wa###safety.net':80
'th####tfuture.net':80
'me###rearly.net':80
'pa####aughter.net':80
'fi####aughter.net':80
'sm###friend.net':80
'sm####onsider.net':80
'wo###friend.net':80
'fi####onsider.net':80
'pa###friend.net':80
'pa####onsider.net':80
'pa###fancy.net':80
'fi###fancy.net':80
'th####tfriend.net':80
'wa###friend.net':80
'wa####onsider.net':80
'wa###fancy.net':80
'th####tconsider.net':80
'sm###fancy.net':80
'wo####onsider.net':80
'wo###fancy.net':80
'wo####aughter.net':80
'sm####aughter.net':80
'ge####mansafety.net':80
'al####ysafety.net':80
'al####yearly.net':80
'al####ysmell.net':80
'ge####manearly.net':80
'me###rsmell.net':80
'fo###wearly.net':80
'fo###wsmell.net':80
'ge####manfuture.net':80
'al####yfuture.net':80
'fr###early.net':80
'ex####enceearly.net':80
'ex####encesmell.net':80
'fi###friend.net':80
'fr###smell.net':80
'ex#####ncefuture.net':80
'ge####mansmell.net':80
'fr###future.net':80
'fr###safety.net':80
'ex#####ncesafety.net':80

TCP:

HTTP GET requests:

http://cr###smell.net/index.php
http://su###rearly.net/index.php
http://su###rsmell.net/index.php
http://be###future.net/index.php
http://kn###future.net/index.php
http://su####future.net/index.php
http://cr###future.net/index.php
http://cr###safety.net/index.php
http://cr###early.net/index.php
http://su####safety.net/index.php
http://me####future.net/index.php
http://be###smell.net/index.php
http://fo####future.net/index.php
http://fo####safety.net/index.php
http://me####safety.net/index.php
http://be###safety.net/index.php
http://kn###safety.net/index.php
http://kn###early.net/index.php
http://kn###smell.net/index.php
http://be###early.net/index.php
http://sm###safety.net/index.php
http://wo###future.net/index.php
http://wo###safety.net/index.php
http://wo###early.net/index.php
http://sm###early.net/index.php
http://pa###early.net/index.php
http://fi###early.net/index.php
http://fi###smell.net/index.php
http://sm###future.net/index.php
http://pa###smell.net/index.php
http://wa###early.net/index.php
http://th####tsafety.net/index.php
http://th####tearly.net/index.php
http://th####tsmell.net/index.php
http://wa###smell.net/index.php
http://wo###smell.net/index.php
http://sm###smell.net/index.php
http://wa###future.net/index.php
http://wa###safety.net/index.php
http://th####tfuture.net/index.php
http://me###rearly.net/index.php
http://pa####aughter.net/index.php
http://fi####aughter.net/index.php
http://sm###friend.net/index.php
http://sm####onsider.net/index.php
http://wo###friend.net/index.php
http://fi####onsider.net/index.php
http://pa###friend.net/index.php
http://pa####onsider.net/index.php
http://pa###fancy.net/index.php
http://fi###fancy.net/index.php
http://th####tfriend.net/index.php
http://wa###friend.net/index.php
http://wa####onsider.net/index.php
http://wa###fancy.net/index.php
http://th####tconsider.net/index.php
http://sm###fancy.net/index.php
http://wo####onsider.net/index.php
http://wo###fancy.net/index.php
http://wo####aughter.net/index.php
http://sm####aughter.net/index.php
http://ge####mansafety.net/index.php
http://al####ysafety.net/index.php
http://al####yearly.net/index.php
http://al####ysmell.net/index.php
http://ge####manearly.net/index.php
http://me###rsmell.net/index.php
http://fo###wearly.net/index.php
http://fo###wsmell.net/index.php
http://ge####manfuture.net/index.php
http://al####yfuture.net/index.php
http://fr###early.net/index.php
http://ex####enceearly.net/index.php
http://ex####encesmell.net/index.php
http://fi###friend.net/index.php
http://fr###smell.net/index.php
http://ex#####ncefuture.net/index.php
http://ge####mansmell.net/index.php
http://fr###future.net/index.php
http://fr###safety.net/index.php
http://ex#####ncesafety.net/index.php

UDP:

DNS ASK cr###smell.net
DNS ASK su###rearly.net
DNS ASK su###rsmell.net
DNS ASK be###future.net
DNS ASK kn###future.net
DNS ASK su####future.net
DNS ASK cr###future.net
DNS ASK cr###safety.net
DNS ASK cr###early.net
DNS ASK su####safety.net
DNS ASK me####future.net
DNS ASK be###smell.net
DNS ASK fo####future.net
DNS ASK fo####safety.net
DNS ASK me####safety.net
DNS ASK be###safety.net
DNS ASK kn###safety.net
DNS ASK kn###early.net
DNS ASK kn###smell.net
DNS ASK be###early.net
DNS ASK th####tsmell.net
DNS ASK wo###future.net
DNS ASK sm###future.net
DNS ASK sm###safety.net
DNS ASK sm###early.net
DNS ASK wo###safety.net
DNS ASK fi###early.net
DNS ASK pa###safety.net
DNS ASK pa###early.net
DNS ASK pa###smell.net
DNS ASK fi###smell.net
DNS ASK th####tsafety.net
DNS ASK wa###safety.net
DNS ASK wa###early.net
DNS ASK wa###smell.net
DNS ASK th####tearly.net
DNS ASK sm###smell.net
DNS ASK wo###early.net
DNS ASK wo###smell.net
DNS ASK th####tfuture.net
DNS ASK wa###future.net
DNS ASK pa####aughter.net
DNS ASK fi####aughter.net
DNS ASK sm###friend.net
DNS ASK sm####onsider.net
DNS ASK wo###friend.net
DNS ASK fi####onsider.net
DNS ASK pa###friend.net
DNS ASK pa####onsider.net
DNS ASK pa###fancy.net
DNS ASK fi###fancy.net
DNS ASK th####tfriend.net
DNS ASK wa###friend.net
DNS ASK wa####onsider.net
DNS ASK wa###fancy.net
DNS ASK th####tconsider.net
DNS ASK sm###fancy.net
DNS ASK wo####onsider.net
DNS ASK wo###fancy.net
DNS ASK wo####aughter.net
DNS ASK sm####aughter.net
DNS ASK fi###friend.net
DNS ASK al####ysafety.net
DNS ASK ge####manfuture.net
DNS ASK ge####mansafety.net
DNS ASK ge####manearly.net
DNS ASK al####yearly.net
DNS ASK fo###wearly.net
DNS ASK me###rearly.net
DNS ASK me###rsmell.net
DNS ASK al####yfuture.net
DNS ASK fo###wsmell.net
DNS ASK ex####enceearly.net
DNS ASK fr###safety.net
DNS ASK fr###early.net
DNS ASK fr###smell.net
DNS ASK ex####encesmell.net
DNS ASK ge####mansmell.net
DNS ASK al####ysmell.net
DNS ASK ex#####ncefuture.net
DNS ASK ex#####ncesafety.net
DNS ASK fr###future.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней