TROJ_SKEEYAH.B
Windows
- マルウェアタイプ: トロイの木馬型
- 破壊活動の有無: なし
- 暗号化: はい
- 感染報告の有無: はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
マルウェアは、プロセスに組み込まれ、システムのプロセスに常駐します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。
- %Application Data%\News_blame\news_run.exe
(註:%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\<ユーザ名>\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\<ユーザ名>\AppData\Roaming" です。.)
マルウェアは、以下のフォルダを作成します。
- %Application Data%\News_blame
(註:%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\<ユーザ名>\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\<ユーザ名>\AppData\Roaming" です。.)
マルウェアは、プロセスに組み込まれ、システムのプロセスに常駐します。
自動実行方法
マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
news_argue = "%Application Data%\News_blame\news_run.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
news_argue = "%Application Data%\News_blame\news_run.exe"
その他
マルウェアは、以下の不正なWebサイトにアクセスします。
- {BLOCKED}y-case.com
- {BLOCKED}y-counter.com
- {BLOCKED}-check.com
- {BLOCKED}dy-meat.com
- {BLOCKED}stop-credit.com
- {BLOCKED}ke-signature.com
- {BLOCKED}ngexist.com
- {BLOCKED}at-drawer.com
- {BLOCKED}gnore-score.com
- {BLOCKED}mentrent.com
- {BLOCKED}ate-contribute.com
- {BLOCKED}ttune-temperature.com
- {BLOCKED}rogram.com
- {BLOCKED}er-spite.com
- {BLOCKED}epend-part.com
- {BLOCKED}ereply.com
- {BLOCKED}attempt.com
- {BLOCKED}ault-piano.com
- {BLOCKED}arage-quantity.com
- {BLOCKED}factor.com
- {BLOCKED}judge-term.com
- {BLOCKED}wist-swimming.com
- {BLOCKED}-form-reputation.com
- {BLOCKED}recommend.com
- {BLOCKED}-tower.com
- {BLOCKED}ot-guide.com
- {BLOCKED}ngoperate.com
- {BLOCKED}ppreciate.com
- {BLOCKED}helter.com
- {BLOCKED}-even-river.com
- {BLOCKED}isappointed.com
- {BLOCKED}m-purpose.com
- {BLOCKED}on-affect.com
- {BLOCKED}r-organize.com
- {BLOCKED}-ready.com
- {BLOCKED}neck-art.com
- {BLOCKED}ottle-project.com
- {BLOCKED}teerange.com
- {BLOCKED}sion-pull.com
- {BLOCKED}ence-shower.com
- {BLOCKED}ldiscover.com
- {BLOCKED}-black.com
- {BLOCKED}-print.com
- {BLOCKED}tempt-copy.com
- {BLOCKED}eam-code.com
- {BLOCKED}tour-garden.com
- {BLOCKED}-peak-blow.com
- {BLOCKED}rve-tax.com
- {BLOCKED}e-listen.com
- {BLOCKED}ree-shape.com
- {BLOCKED}sepiece.com
- {BLOCKED}unter-proposal.com
- {BLOCKED}-sandwich.com
- {BLOCKED}-well-corner.com
- {BLOCKED}lue-subject.com
- {BLOCKED}ence-dry.com
- {BLOCKED}ion-retire.com
- {BLOCKED}aby-cup.com
- {BLOCKED}nt-ship.com
- {BLOCKED}andle-land.com
- {BLOCKED}ke-article.com
- {BLOCKED}ncorporate.com
- {BLOCKED}re-object.com
- {BLOCKED}-principle.com
- {BLOCKED}heel-inside.com
- {BLOCKED}ce-believe.com
- {BLOCKED}ce-resolve.com
- {BLOCKED}entence.com
- {BLOCKED}ation-baby.com
- {BLOCKED}serent.com
- {BLOCKED}istrict.com
- {BLOCKED}-confirm.com
- {BLOCKED}-cow-web.com
- {BLOCKED}g-transition.com
- {BLOCKED}delay-bath.com
- {BLOCKED}cape-pin.com
- {BLOCKED}g-shine.com
- {BLOCKED}pound-border.com
- {BLOCKED}test-tool.com
- {BLOCKED}alue-specialist.com
- {BLOCKED}low-comment.com
- {BLOCKED}m-name.com
- {BLOCKED}ecture.com
- {BLOCKED}ase-bill.com
- {BLOCKED}ake-signature.com
- {BLOCKED}-struggle.com
- {BLOCKED}nk-craft.com
- {BLOCKED}ercome.com
- {BLOCKED}pull-point.com
- {BLOCKED}station.com
- {BLOCKED}y-coast.com
- {BLOCKED}our-manner.com
- {BLOCKED}age-belt.com
- {BLOCKED}uy-till.com
- {BLOCKED}n-affect.com
- {BLOCKED}mell-phase.com
- {BLOCKED}ble-reference.com
- {BLOCKED}wer-staff.com
- {BLOCKED}refuse.com
- {BLOCKED}d-test.com
- {BLOCKED}lawyer.com
- {BLOCKED}-appear.com
- {BLOCKED}sion-branch.com
- {BLOCKED}-feel-business.com
- {BLOCKED}ce-pack.com
- {BLOCKED}iew-inform.com
- {BLOCKED}iew-string.com
- {BLOCKED}eather.com
- {BLOCKED}etail-opening.com
- {BLOCKED}cycle-essay.com
- {BLOCKED}ipe-spray.com
- {BLOCKED}tation.com
- {BLOCKED}eadopt.com
- {BLOCKED}aff-historian.com
- {BLOCKED}redit-taste.com
- {BLOCKED}l-result.com
- {BLOCKED}urprise.com
- {BLOCKED}gue-economy.com
- {BLOCKED}al-career.com
- {BLOCKED}cture-panic.com
- {BLOCKED}int-coat.com
- {BLOCKED}mp-path.com
- {BLOCKED}il-health.com
- {BLOCKED}uarter.com
- {BLOCKED}andwich.com
- {BLOCKED}ingexist.com
- {BLOCKED}al-interview.com
- {BLOCKED}es-boat.com
- {BLOCKED}-solve.com
- {BLOCKED}g-contribute.com
- {BLOCKED}engineer.com
- {BLOCKED}coast-method.com
- {BLOCKED}htready.com
- {BLOCKED}-sleep.com
- {BLOCKED}gretain.com
- {BLOCKED}gweigh.com
- {BLOCKED}-negotiate.com
- {BLOCKED}implement.com
- {BLOCKED}ist-fishing.com
- {BLOCKED}tuff-mess.com
- {BLOCKED}gpaint.com
- {BLOCKED}bell-minimum.com
- {BLOCKED}form-definition.com
- {BLOCKED}hold-salt.com
- {BLOCKED}xpress.com
- {BLOCKED}tar-line.com
- {BLOCKED}lance-relief.com
- {BLOCKED}fill-internet.com
- {BLOCKED}op-caplimited.com
- {BLOCKED}listen.com
- {BLOCKED}drive-phase.com
- {BLOCKED}ypin-pipe.com
- {BLOCKED}bear-letter.com
- {BLOCKED}ion-move.com
- {BLOCKED}mart-trick.com
- {BLOCKED}on-condition.com
- {BLOCKED}on-nail.com
- {BLOCKED}on-part.com
- {BLOCKED}sentence.com
- {BLOCKED}uthor-injury.com
- {BLOCKED}mtrain.com
- {BLOCKED}espot-status.com
- {BLOCKED}on-challenge.com
- {BLOCKED}on-distance.com
- {BLOCKED}on-exist.com
- {BLOCKED}hip-explanation.com
- {BLOCKED}g-officer.com
- {BLOCKED}schedule.com
- {BLOCKED}-stay-mouse.com
- {BLOCKED}on-reward.com
- {BLOCKED}on-split.com
- {BLOCKED}ement-wonder.com
- {BLOCKED}pleasure.com
- {BLOCKED}emove-apple.com
- {BLOCKED}e-admire.com
- {BLOCKED}osed-bid.com
- {BLOCKED}lue-car.com
- {BLOCKED}phasize.com
- {BLOCKED}ould-black.com
- {BLOCKED}carpet.com
- {BLOCKED}oposed.com
- {BLOCKED}blame-iron.com
- {BLOCKED}garden.com
- {BLOCKED}njoy-signature.com
- {BLOCKED}er-throw.com
- {BLOCKED}-persuade.com
- {BLOCKED}lunch-plastic.com
- {BLOCKED}-letter.com
- {BLOCKED}ase-coat.com
- {BLOCKED}orce-definition.com
- {BLOCKED}blame-stomach.com
- {BLOCKED}y-hold.com
- {BLOCKED}one-purple.com
- {BLOCKED}ddress.com
- {BLOCKED}live-store.com
- {BLOCKED}list-schedule.com
- {BLOCKED}-spot-scale.com
- {BLOCKED}lunch-row.com
- {BLOCKED}-lip-mark.com
- {BLOCKED}uresurvey.com
- {BLOCKED}hall-clerk.com
- {BLOCKED}camp-research.com
- {BLOCKED}bring-click.com
- {BLOCKED}sell-taste.com
- {BLOCKED}arketmixed.com
- {BLOCKED}point-note.com
- {BLOCKED}seem-investment.com
- {BLOCKED}space-specialist.com
- {BLOCKED}-provide.com
- {BLOCKED}n-bottom.com
- {BLOCKED}pread-medicine.com
- {BLOCKED}urve-balance.com
- {BLOCKED}t-race.com
- {BLOCKED}t-say-map.com
- {BLOCKED}-island.com
- {BLOCKED}ank-business.com
- {BLOCKED}iece-action.com
- {BLOCKED}t-remain.com
- {BLOCKED}reach-document.com
- {BLOCKED}tool-sir.com
- {BLOCKED}ight-village.com
- {BLOCKED}ble-pipe.com
- {BLOCKED}gseek-soil.com
- {BLOCKED}ssman-joint.com
- {BLOCKED}radio-scale.com
- {BLOCKED}ologize.com
- {BLOCKED}erate-meaning.com
- {BLOCKED}te-price.com
- {BLOCKED}rm-blind.com
- {BLOCKED}gtired.com
- {BLOCKED}one-letter.com
- {BLOCKED}aintain.com