Trojan.DownLoader22.21067

Добавлен в вирусную базу Dr.Web: 2016-08-16

Описание добавлено: 2016-08-16

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Distributed List Interactive Multimedia' = '<SYSTEM32>\xgvnrtsxf.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Parental Plug Registrar ActiveX Video Office] 'ImagePath' = '<SYSTEM32>\xgvnrtsxf.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Parental Plug Registrar ActiveX Video Office] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Executes the following:

'<SYSTEM32>\okswcccte.exe' "<SYSTEM32>\xgvnrtsxf.exe"
'%WINDIR%\Temp\i5qjgztrikiigxq2lbu.exe' -r 26888 tcp
'%TEMP%\i5qjgztromvj4bq2lbuwcs65j.exe'
'<SYSTEM32>\xgvnrtsxf.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\qrxaxghzpljm\run
<SYSTEM32>\qrxaxghzpljm\rng
%WINDIR%\Temp\i5qjgztrikiigxq2lbu.exe
<SYSTEM32>\qrxaxghzpljm\cfg
%TEMP%\i5qjgztromvj4bq2lbuwcs65j.exe
<SYSTEM32>\qrxaxghzpljm\tst
<SYSTEM32>\okswcccte.exe
<SYSTEM32>\xgvnrtsxf.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\okswcccte.exe
<SYSTEM32>\xgvnrtsxf.exe

Deletes the following files:

%WINDIR%\Temp\i5qjgztrikiigxq2lbu.exe
%TEMP%\i5qjgztromvj4bq2lbuwcs65j.exe

Network activity:

Connects to:

'al###high.net':80
'de####erhigh.net':80
'de####erfeel.net':80
'fr###yonly.net':80
'al###feel.net':80
'de####eronly.net':80
'lo###alf.net':80
'al###only.net':80
'al###color.net':80
'de####ercolor.net':80
'pu###nly.net':80
'de###nly.net':80
'pu###eel.net':80
'sh###only.net':80
'sh###color.net':80
'de###olor.net':80
'pu###olor.net':80
'fr###ycolor.net':80
'fr###yhigh.net':80
'fr###yfeel.net':80
'pu###igh.net':80
'sa###ate.net':80
'st###half.net':80
'wh###late.net':80
'wh###guide.net':80
'sa###uide.net':80
'st###guide.net':80
'ba###uide.net':80
'ba###ame.net':80
'ba###alf.net':80
'st###name.net':80
'sa###ame.net':80
'lo###uide.net':80
'so###uide.net':80
'so###ame.net':80
'so###alf.net':80
'lo###ame.net':80
'sa###alf.net':80
'wh###name.net':80
'wh###half.net':80
'lo###ate.net':80
'so###ate.net':80
'de###igh.net':80
'sa###nly.net':80
'st###feel.net':80
'wh###only.net':80
'wh###color.net':80
'sa###olor.net':80
'st###color.net':80
'ba###olor.net':80
'ba###igh.net':80
'ba###eel.net':80
'st###high.net':80
'se####produce.net':80
'ca###tep.net':80
'wi###bout.net':80
'ge###eangry.net':80
'ri###nstorm.net':80
'wa###ing.net':80
'st####square.net':80
'cl####etween.net':80
're####needle.net':80
'si######edwerryhouse.net':80
'mo####gduring.net':80
'mo###color.net':80
'ti###olor.net':80
'ti###igh.net':80
'ti###eel.net':80
'mo###high.net':80
'de###eel.net':80
'sh###high.net':80
'sh###feel.net':80
'mo###only.net':80
'ti###nly.net':80
'mo###feel.net':80
'li###eel.net':80
'en###high.net':80
'en###feel.net':80
'st###only.net':80
'ba###nly.net':80
'en###only.net':80
'li###nly.net':80
'li###olor.net':80
'li###igh.net':80
'en###color.net':80

TCP:

HTTP GET requests:

http://al###high.net/index.php
http://de####erhigh.net/index.php
http://de####erfeel.net/index.php
http://fr###yonly.net/index.php
http://al###feel.net/index.php
http://de####eronly.net/index.php
http://lo###alf.net/index.php
http://al###only.net/index.php
http://al###color.net/index.php
http://de####ercolor.net/index.php
http://pu###nly.net/index.php
http://de###nly.net/index.php
http://pu###eel.net/index.php
http://sh###only.net/index.php
http://sh###color.net/index.php
http://de###olor.net/index.php
http://pu###olor.net/index.php
http://fr###ycolor.net/index.php
http://fr###yhigh.net/index.php
http://fr###yfeel.net/index.php
http://pu###igh.net/index.php
http://sa###ate.net/index.php
http://st###half.net/index.php
http://wh###late.net/index.php
http://wh###guide.net/index.php
http://sa###uide.net/index.php
http://st###guide.net/index.php
http://ba###uide.net/index.php
http://ba###ame.net/index.php
http://ba###alf.net/index.php
http://st###name.net/index.php
http://sa###ame.net/index.php
http://lo###uide.net/index.php
http://so###uide.net/index.php
http://so###ame.net/index.php
http://so###alf.net/index.php
http://lo###ame.net/index.php
http://sa###alf.net/index.php
http://wh###name.net/index.php
http://wh###half.net/index.php
http://lo###ate.net/index.php
http://so###ate.net/index.php
http://de###igh.net/index.php
http://sa###nly.net/index.php
http://st###feel.net/index.php
http://wh###only.net/index.php
http://wh###color.net/index.php
http://sa###olor.net/index.php
http://st###color.net/index.php
http://ba###olor.net/index.php
http://ba###igh.net/index.php
http://ba###eel.net/index.php
http://st###high.net/index.php
http://se####produce.net/index.php
http://ca###tep.net/index.php
http://wi###bout.net/index.php
http://ge###eangry.net/index.php
http://ri###nstorm.net/index.php
http://wa###ing.net/index.php
http://st####square.net/index.php
http://cl####etween.net/index.php
http://re####needle.net/index.php
http://si######edwerryhouse.net/index.php
http://mo####gduring.net/index.php
http://mo###color.net/index.php
http://ti###olor.net/index.php
http://ti###igh.net/index.php
http://ti###eel.net/index.php
http://mo###high.net/index.php
http://de###eel.net/index.php
http://sh###high.net/index.php
http://sh###feel.net/index.php
http://mo###only.net/index.php
http://ti###nly.net/index.php
http://mo###feel.net/index.php
http://li###eel.net/index.php
http://en###high.net/index.php
http://en###feel.net/index.php
http://st###only.net/index.php
http://ba###nly.net/index.php
http://en###only.net/index.php
http://li###nly.net/index.php
http://li###olor.net/index.php
http://li###igh.net/index.php
http://en###color.net/index.php

UDP:

DNS ASK al###high.net
DNS ASK de####erhigh.net
DNS ASK de####erfeel.net
DNS ASK fr###yonly.net
DNS ASK al###feel.net
DNS ASK de####eronly.net
DNS ASK lo###alf.net
DNS ASK al###only.net
DNS ASK al###color.net
DNS ASK de####ercolor.net
DNS ASK pu###nly.net
DNS ASK de###nly.net
DNS ASK pu###eel.net
DNS ASK sh###only.net
DNS ASK sh###color.net
DNS ASK de###olor.net
DNS ASK pu###olor.net
DNS ASK fr###ycolor.net
DNS ASK fr###yhigh.net
DNS ASK fr###yfeel.net
DNS ASK pu###igh.net
DNS ASK so###alf.net
DNS ASK st###half.net
DNS ASK ba###alf.net
DNS ASK sa###ate.net
DNS ASK sa###uide.net
DNS ASK wh###late.net
DNS ASK ba###uide.net
DNS ASK st###late.net
DNS ASK st###guide.net
DNS ASK st###name.net
DNS ASK ba###ame.net
DNS ASK wh###guide.net
DNS ASK so###uide.net
DNS ASK lo###ate.net
DNS ASK lo###uide.net
DNS ASK lo###ame.net
DNS ASK so###ame.net
DNS ASK wh###name.net
DNS ASK sa###ame.net
DNS ASK sa###alf.net
DNS ASK so###ate.net
DNS ASK wh###half.net
DNS ASK de###igh.net
DNS ASK sa###nly.net
DNS ASK st###feel.net
DNS ASK wh###only.net
DNS ASK wh###color.net
DNS ASK sa###olor.net
DNS ASK st###color.net
DNS ASK ba###olor.net
DNS ASK ba###igh.net
DNS ASK ba###eel.net
DNS ASK st###high.net
DNS ASK se####produce.net
DNS ASK ca###tep.net
DNS ASK wi###bout.net
DNS ASK ge###eangry.net
DNS ASK ri###nstorm.net
DNS ASK wa###ing.net
DNS ASK st####square.net
DNS ASK cl####etween.net
DNS ASK re####needle.net
DNS ASK si######edwerryhouse.net
DNS ASK mo####gduring.net
DNS ASK mo###color.net
DNS ASK ti###olor.net
DNS ASK ti###igh.net
DNS ASK ti###eel.net
DNS ASK mo###high.net
DNS ASK de###eel.net
DNS ASK sh###high.net
DNS ASK sh###feel.net
DNS ASK mo###only.net
DNS ASK ti###nly.net
DNS ASK mo###feel.net
DNS ASK li###eel.net
DNS ASK en###high.net
DNS ASK en###feel.net
DNS ASK st###only.net
DNS ASK ba###nly.net
DNS ASK en###only.net
DNS ASK li###nly.net
DNS ASK li###olor.net
DNS ASK li###igh.net
DNS ASK en###color.net
'23#.#55.255.250':1900

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней