解析者: Cris Nowell Pantanilla   
 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 情報漏えい:

  • マルウェアタイプ:
    トロイの木馬型

  • 破壊活動の有無:
    なし

  • 暗号化:
    はい

  • 感染報告の有無 :
    はい

  概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

マルウェアは、プロセスに組み込まれ、システムのプロセスに常駐します。

  詳細

ファイルサイズ 195,520 bytes
タイプ EXE
メモリ常駐 はい
発見日 2015年5月13日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

  • %Application Data%\News_blame\news_run.exe

(註：%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.)

マルウェアは、以下のフォルダを作成します。

  • %Application Data%\News_blame

(註：%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.)

マルウェアは、プロセスに組み込まれ、システムのプロセスに常駐します。

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
news_argue = "%Application Data%\News_blame\news_run.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
news_argue = "%Application Data%\News_blame\news_run.exe"

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

  • {BLOCKED}y-case.com
  • {BLOCKED}y-counter.com
  • {BLOCKED}-check.com
  • {BLOCKED}dy-meat.com
  • {BLOCKED}stop-credit.com
  • {BLOCKED}ke-signature.com
  • {BLOCKED}ngexist.com
  • {BLOCKED}at-drawer.com
  • {BLOCKED}gnore-score.com
  • {BLOCKED}mentrent.com
  • {BLOCKED}ate-contribute.com
  • {BLOCKED}ttune-temperature.com
  • {BLOCKED}rogram.com
  • {BLOCKED}er-spite.com
  • {BLOCKED}epend-part.com
  • {BLOCKED}ereply.com
  • {BLOCKED}attempt.com
  • {BLOCKED}ault-piano.com
  • {BLOCKED}arage-quantity.com
  • {BLOCKED}factor.com
  • {BLOCKED}judge-term.com
  • {BLOCKED}wist-swimming.com
  • {BLOCKED}-form-reputation.com
  • {BLOCKED}recommend.com
  • {BLOCKED}-tower.com
  • {BLOCKED}ot-guide.com
  • {BLOCKED}ngoperate.com
  • {BLOCKED}ppreciate.com
  • {BLOCKED}helter.com
  • {BLOCKED}-even-river.com
  • {BLOCKED}isappointed.com
  • {BLOCKED}m-purpose.com
  • {BLOCKED}on-affect.com
  • {BLOCKED}r-organize.com
  • {BLOCKED}-ready.com
  • {BLOCKED}neck-art.com
  • {BLOCKED}ottle-project.com
  • {BLOCKED}teerange.com
  • {BLOCKED}sion-pull.com
  • {BLOCKED}ence-shower.com
  • {BLOCKED}ldiscover.com
  • {BLOCKED}-black.com
  • {BLOCKED}-print.com
  • {BLOCKED}tempt-copy.com
  • {BLOCKED}eam-code.com
  • {BLOCKED}tour-garden.com
  • {BLOCKED}-peak-blow.com
  • {BLOCKED}rve-tax.com
  • {BLOCKED}e-listen.com
  • {BLOCKED}ree-shape.com
  • {BLOCKED}sepiece.com
  • {BLOCKED}unter-proposal.com
  • {BLOCKED}-sandwich.com
  • {BLOCKED}-well-corner.com
  • {BLOCKED}lue-subject.com
  • {BLOCKED}ence-dry.com
  • {BLOCKED}ion-retire.com
  • {BLOCKED}aby-cup.com
  • {BLOCKED}nt-ship.com
  • {BLOCKED}andle-land.com
  • {BLOCKED}ke-article.com
  • {BLOCKED}ncorporate.com
  • {BLOCKED}re-object.com
  • {BLOCKED}-principle.com
  • {BLOCKED}heel-inside.com
  • {BLOCKED}ce-believe.com
  • {BLOCKED}ce-resolve.com
  • {BLOCKED}entence.com
  • {BLOCKED}ation-baby.com
  • {BLOCKED}serent.com
  • {BLOCKED}istrict.com
  • {BLOCKED}-confirm.com
  • {BLOCKED}-cow-web.com
  • {BLOCKED}g-transition.com
  • {BLOCKED}delay-bath.com
  • {BLOCKED}cape-pin.com
  • {BLOCKED}g-shine.com
  • {BLOCKED}pound-border.com
  • {BLOCKED}test-tool.com
  • {BLOCKED}alue-specialist.com
  • {BLOCKED}low-comment.com
  • {BLOCKED}m-name.com
  • {BLOCKED}ecture.com
  • {BLOCKED}ase-bill.com
  • {BLOCKED}ake-signature.com
  • {BLOCKED}-struggle.com
  • {BLOCKED}nk-craft.com
  • {BLOCKED}ercome.com
  • {BLOCKED}pull-point.com
  • {BLOCKED}station.com
  • {BLOCKED}y-coast.com
  • {BLOCKED}our-manner.com
  • {BLOCKED}age-belt.com
  • {BLOCKED}uy-till.com
  • {BLOCKED}n-affect.com
  • {BLOCKED}mell-phase.com
  • {BLOCKED}ble-reference.com
  • {BLOCKED}wer-staff.com
  • {BLOCKED}refuse.com
  • {BLOCKED}d-test.com
  • {BLOCKED}lawyer.com
  • {BLOCKED}-appear.com
  • {BLOCKED}sion-branch.com
  • {BLOCKED}-feel-business.com
  • {BLOCKED}ce-pack.com
  • {BLOCKED}iew-inform.com
  • {BLOCKED}iew-string.com
  • {BLOCKED}eather.com
  • {BLOCKED}etail-opening.com
  • {BLOCKED}cycle-essay.com
  • {BLOCKED}ipe-spray.com
  • {BLOCKED}tation.com
  • {BLOCKED}eadopt.com
  • {BLOCKED}aff-historian.com
  • {BLOCKED}redit-taste.com
  • {BLOCKED}l-result.com
  • {BLOCKED}urprise.com
  • {BLOCKED}gue-economy.com
  • {BLOCKED}al-career.com
  • {BLOCKED}cture-panic.com
  • {BLOCKED}int-coat.com
  • {BLOCKED}mp-path.com
  • {BLOCKED}il-health.com
  • {BLOCKED}uarter.com
  • {BLOCKED}andwich.com
  • {BLOCKED}ingexist.com
  • {BLOCKED}al-interview.com
  • {BLOCKED}es-boat.com
  • {BLOCKED}-solve.com
  • {BLOCKED}g-contribute.com
  • {BLOCKED}engineer.com
  • {BLOCKED}coast-method.com
  • {BLOCKED}htready.com
  • {BLOCKED}-sleep.com
  • {BLOCKED}gretain.com
  • {BLOCKED}gweigh.com
  • {BLOCKED}-negotiate.com
  • {BLOCKED}implement.com
  • {BLOCKED}ist-fishing.com
  • {BLOCKED}tuff-mess.com
  • {BLOCKED}gpaint.com
  • {BLOCKED}bell-minimum.com
  • {BLOCKED}form-definition.com
  • {BLOCKED}hold-salt.com
  • {BLOCKED}xpress.com
  • {BLOCKED}tar-line.com
  • {BLOCKED}lance-relief.com
  • {BLOCKED}fill-internet.com
  • {BLOCKED}op-caplimited.com
  • {BLOCKED}listen.com
  • {BLOCKED}drive-phase.com
  • {BLOCKED}ypin-pipe.com
  • {BLOCKED}bear-letter.com
  • {BLOCKED}ion-move.com
  • {BLOCKED}mart-trick.com
  • {BLOCKED}on-condition.com
  • {BLOCKED}on-nail.com
  • {BLOCKED}on-part.com
  • {BLOCKED}sentence.com
  • {BLOCKED}uthor-injury.com
  • {BLOCKED}mtrain.com
  • {BLOCKED}espot-status.com
  • {BLOCKED}on-challenge.com
  • {BLOCKED}on-distance.com
  • {BLOCKED}on-exist.com
  • {BLOCKED}hip-explanation.com
  • {BLOCKED}g-officer.com
  • {BLOCKED}schedule.com
  • {BLOCKED}-stay-mouse.com
  • {BLOCKED}on-reward.com
  • {BLOCKED}on-split.com
  • {BLOCKED}ement-wonder.com
  • {BLOCKED}pleasure.com
  • {BLOCKED}emove-apple.com
  • {BLOCKED}e-admire.com
  • {BLOCKED}osed-bid.com
  • {BLOCKED}lue-car.com
  • {BLOCKED}phasize.com
  • {BLOCKED}ould-black.com
  • {BLOCKED}carpet.com
  • {BLOCKED}oposed.com
  • {BLOCKED}blame-iron.com
  • {BLOCKED}garden.com
  • {BLOCKED}njoy-signature.com
  • {BLOCKED}er-throw.com
  • {BLOCKED}-persuade.com
  • {BLOCKED}lunch-plastic.com
  • {BLOCKED}-letter.com
  • {BLOCKED}ase-coat.com
  • {BLOCKED}orce-definition.com
  • {BLOCKED}blame-stomach.com
  • {BLOCKED}y-hold.com
  • {BLOCKED}one-purple.com
  • {BLOCKED}ddress.com
  • {BLOCKED}live-store.com
  • {BLOCKED}list-schedule.com
  • {BLOCKED}-spot-scale.com
  • {BLOCKED}lunch-row.com
  • {BLOCKED}-lip-mark.com
  • {BLOCKED}uresurvey.com
  • {BLOCKED}hall-clerk.com
  • {BLOCKED}camp-research.com
  • {BLOCKED}bring-click.com
  • {BLOCKED}sell-taste.com
  • {BLOCKED}arketmixed.com
  • {BLOCKED}point-note.com
  • {BLOCKED}seem-investment.com
  • {BLOCKED}space-specialist.com
  • {BLOCKED}-provide.com
  • {BLOCKED}n-bottom.com
  • {BLOCKED}pread-medicine.com
  • {BLOCKED}urve-balance.com
  • {BLOCKED}t-race.com
  • {BLOCKED}t-say-map.com
  • {BLOCKED}-island.com
  • {BLOCKED}ank-business.com
  • {BLOCKED}iece-action.com
  • {BLOCKED}t-remain.com
  • {BLOCKED}reach-document.com
  • {BLOCKED}tool-sir.com
  • {BLOCKED}ight-village.com
  • {BLOCKED}ble-pipe.com
  • {BLOCKED}gseek-soil.com
  • {BLOCKED}ssman-joint.com
  • {BLOCKED}radio-scale.com
  • {BLOCKED}ologize.com
  • {BLOCKED}erate-meaning.com
  • {BLOCKED}te-price.com
  • {BLOCKED}rm-blind.com
  • {BLOCKED}gtired.com
  • {BLOCKED}one-letter.com
  • {BLOCKED}aintain.com