Trojan.DownLoader23.5466

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Application WLAN Session Removal Bus Volume' = '<SYSTEM32>\nbxrbrz.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Debugger Files Cache Video Diagnostic] 'ImagePath' = '<SYSTEM32>\nbxrbrz.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Debugger Files Cache Video Diagnostic] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Executes the following:

'<SYSTEM32>\ismarfls.exe' "<SYSTEM32>\nbxrbrz.exe"
'%WINDIR%\Temp\vnegussv056uuxso.exe' -r 48697 tcp
'%TEMP%\vnegussl5bdw2xsojixcsr.exe'
'<SYSTEM32>\nbxrbrz.exe'

Modifies file system:

Creates the following files:

<SYSTEM32>\gyklkqauyrr\run
<SYSTEM32>\gyklkqauyrr\rng
%WINDIR%\Temp\vnegussv056uuxso.exe
<SYSTEM32>\gyklkqauyrr\cfg
%TEMP%\vnegussl5bdw2xsojixcsr.exe
<SYSTEM32>\gyklkqauyrr\tst
<SYSTEM32>\ismarfls.exe
<SYSTEM32>\nbxrbrz.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\ismarfls.exe
<SYSTEM32>\nbxrbrz.exe

Deletes the following files:

%WINDIR%\Temp\vnegussv056uuxso.exe
%TEMP%\vnegussl5bdw2xsojixcsr.exe

Network activity:

Connects to:

'gr###enjoy.net':80
'gr###world.net':80
'gl###orse.ru':80
'gr###enjoy.ru':80
'eq####ctover.net':80
'sp###enjoy.net':80
'vi###enjoy.net':80
'gr####ctover.net':80
'gr###horse.net':80
'ch###boris.ru':80
'ko###rpig.xyz':80
'lo####thepings.ru':80
'po###lols.ru':80
'la###aha.xyz':80
'bi###rfans.top':80
'ru##nds.top':80
'po###alal.site':80
'ri###nafap.site':80

TCP:

HTTP GET requests:

http://gr###enjoy.net/index.php
http://gr###world.net/index.php
http://gl###orse.ru/index.php
http://gr###enjoy.ru/index.php
http://eq####ctover.net/index.php
http://sp###enjoy.net/index.php
http://vi###enjoy.net/index.php
http://gr####ctover.net/index.php
http://gr###horse.net/index.php
http://ch###boris.ru/index.php
http://ko###rpig.xyz/index.php
http://lo####thepings.ru/index.php
http://po###lols.ru/index.php
http://la###aha.xyz/index.php
http://bi###rfans.top/index.php
http://ru##nds.top/index.php
http://po###alal.site/index.php
http://ri###nafap.site/index.php

UDP:

DNS ASK wi###irst.net
DNS ASK jo###irst.net
DNS ASK jo###uess.net
DNS ASK jo###uess.ru
DNS ASK wi###ill.net
DNS ASK wi###tood.ru
DNS ASK jo###tood.net
DNS ASK jo###ill.net
DNS ASK wi###tood.net
DNS ASK wi###uess.net
DNS ASK ro###irst.net
DNS ASK de###irst.net
DNS ASK ro###uess.net
DNS ASK de###uess.net
DNS ASK ro###ill.net
DNS ASK ro###tood.net
DNS ASK de###tood.net
DNS ASK ro##kill.ru
DNS ASK de###ill.net
DNS ASK se####berguess.net
DNS ASK of###stood.net
DNS ASK fr###stood.net
DNS ASK fr###kill.net
DNS ASK fr###kill.ru
DNS ASK sp###guess.net
DNS ASK sp###first.ru
DNS ASK we###irst.net
DNS ASK we###uess.net
DNS ASK sp###first.net
DNS ASK of###kill.net
DNS ASK se####berkill.net
DNS ASK se####berstood.net
DNS ASK se####berfirst.net
DNS ASK ha###irst.ru
DNS ASK of###guess.net
DNS ASK of###first.net
DNS ASK fr###first.net
DNS ASK of###guess.ru
DNS ASK fr###guess.net
DNS ASK mu###allow.net
DNS ASK ya###llow.net
DNS ASK mu###gives.net
DNS ASK ya###ives.net
DNS ASK ya###llow.ru
DNS ASK mu###taste.net
DNS ASK ya###aste.net
DNS ASK mu###earth.net
DNS ASK ya###arth.net
DNS ASK we###aste.net
DNS ASK we###ives.ru
DNS ASK sp###allow.net
DNS ASK sp###gives.net
DNS ASK we###ives.net
DNS ASK we###llow.net
DNS ASK sp###taste.net
DNS ASK sp###taste.ru
DNS ASK we###arth.net
DNS ASK sp###earth.net
DNS ASK ha###ives.net
DNS ASK ma###irst.ru
DNS ASK wr###first.net
DNS ASK wr###guess.net
DNS ASK ma###irst.net
DNS ASK ma###ill.net
DNS ASK wr###stood.net
DNS ASK wr###stood.ru
DNS ASK wr###kill.net
DNS ASK ma###tood.net
DNS ASK ma###uess.net
DNS ASK ha###llow.net
DNS ASK hu###allow.net
DNS ASK ha###ives.ru
DNS ASK hu###gives.net
DNS ASK ha###arth.net
DNS ASK ha###aste.net
DNS ASK hu###taste.net
DNS ASK hu###earth.net
DNS ASK hu###earth.ru
DNS ASK th###orld.net
DNS ASK ta###horse.net
DNS ASK wa###enjoy.net
DNS ASK vi####ctover.net
DNS ASK wa###world.net
DNS ASK wa###enjoy.ru
DNS ASK sp####ctover.net
DNS ASK vi###horse.net
DNS ASK ta####ctover.net
DNS ASK gl###ctover.net
DNS ASK dr###octover.ru
DNS ASK eq###horse.net
DNS ASK sp###world.ru
DNS ASK wa###horse.net
DNS ASK fa###orld.net
DNS ASK vi###octover.ru
DNS ASK fa###njoy.net
DNS ASK eq###enjoy.net
DNS ASK sp###horse.net
DNS ASK ri###nafap.site
DNS ASK po###alal.site
DNS ASK ru##nds.top
DNS ASK bi###rfans.top
DNS ASK la###aha.xyz
DNS ASK po###lols.ru
DNS ASK lo####thepings.ru
DNS ASK ko###rpig.xyz
DNS ASK ch###boris.ru
DNS ASK gl###orse.ru
DNS ASK sp###enjoy.net
DNS ASK gr###horse.net
DNS ASK vi###world.net
DNS ASK vi###enjoy.net
DNS ASK gr####ctover.net
DNS ASK gr###enjoy.net
DNS ASK gr###enjoy.ru
DNS ASK eq####ctover.net
DNS ASK gr###world.net
DNS ASK ta###enjoy.net
DNS ASK ya###ill.net
DNS ASK ya###tood.net
DNS ASK mu###kill.ru
DNS ASK mu###stood.net
DNS ASK ha###uess.net
DNS ASK ha###irst.net
DNS ASK hu###first.net
DNS ASK hu###guess.net
DNS ASK hu###guess.ru
DNS ASK mu###kill.net
DNS ASK we###ill.net
DNS ASK we###tood.net
DNS ASK sp###kill.net
DNS ASK sp###stood.net
DNS ASK we###tood.ru
DNS ASK mu###first.net
DNS ASK ya###irst.net
DNS ASK mu###guess.net
DNS ASK ya###uess.net
DNS ASK wa####ctover.net
DNS ASK fa###orse.net
DNS ASK dr###enjoy.net
DNS ASK gl###orse.net
DNS ASK sp###world.net
DNS ASK dr###world.net
DNS ASK fa###ctover.net
DNS ASK eq###world.net
DNS ASK fa###orse.ru
DNS ASK th###njoy.net
DNS ASK ha###tood.net
DNS ASK ha###tood.ru
DNS ASK ha###ill.net
DNS ASK hu###kill.net
DNS ASK hu###stood.net
DNS ASK th###ctover.net
DNS ASK dr####ctover.net
DNS ASK th###orse.net
DNS ASK dr###horse.net
'23#.#55.255.250':1900

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial