Trojan.DownLoader36.32013

• [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xnaz7gyxxq' = '<Full path to file>'

• <Current directory>\cached-consensus

• '94.#00.6.27':80
• '65.#9.20.12':443
• '10#.#89.10.27':443
• '18#.#03.118.27':443
• '37.##1.137.207':9998
• '18#.#20.101.199':30199
• '18#.#2.127.7':443
• '21#.#9.179.177':9001
• '21#.#7.48.152':9001
• '16#.#29.64.112':443
• '17#.#05.186.98':443
• '10#.#8.191.132':80
• '87.##8.122.30':443
• '82.##1.105.198':80
• '16#.#27.174.150':9001
• '15#.#9.63.54':80
• '93.##4.209.61':80
• '18#.#49.125.138':443
• '95.##1.83.155':80
• '19#.#49.230.116':80
• '13#.#48.33.141':80
• '19#.#49.230.148':80
• '17#.#3.172.13':80
• '14#.#35.115.212':80
• '18#.#.236.131':80
• '71.##4.56.208':9001
• '89.##3.220.112':443
• '21#.#11.40.177':9001
• '14#.#4.247.102':443
• '19#.#18.118.242':443
• '18#.#20.102.245':80
• '95.#53.31.8':80
• '83.##.20.248':80
• '17#.#49.8.113':80
• '17#.#04.208.190':80
• '10#.#48.149.168':443
• '10#.#49.129.210':443
• '94.##.121.91':443
• '90.##7.254.173':9001
• '85.##4.141.131':443
• '19#.#8.48.175':443
• '37.##7.49.139':9000
• '18#.#.134.104':9001
• '18#.#13.20.107':443
• '17#.#05.116.230':9001
• '18#.#20.234.26':80
• '52.##9.113.195':443
• '91.##2.103.44':9001
• '19#.#9.152.50':9001
• '13#.#9.134.27':9001
• '51.##.65.243':443
• '21#.#27.11.131':9001
• '38.#8.135.5':9001
• '94.##.122.65':443
• '91.##3.145.114':80

'14#.#39.82.142':9000

'14#.#17.80.80':443

'96.##5.209.36':9001

'71.##7.179.158':9001

'88.##8.70.88':443

'95.##7.248.169':9001

'18#.#5.51.202':9100

'17#.#3.146.230':443

'21#.#7.237.127':9001

'47.##.212.27':22528

'13.##1.32.165':9001

'18#.#65.240.126':443

'51.#5.54.84':443

'24.##4.118.245':9001

'51.##.129.204':443

'77.##.186.184':443

'18#.#40.53.3':443

'18#.#00.84.251':443

'45.##4.255.74':443

'82.##4.239.154':9001

'95.##.167.114':9292

'20#.#46.88.214':9001

'13#.#09.125.129':443

'51.##1.11.228':9001

'19#.#44.120.234':9001

'45.##.39.156':443

'18#.#20.100.248':9000

'85.##.88.174':443

'3.###.19.233':9001

'37.##0.173.173':9030

'21#.#27.8.137':9001

'18#.#20.100.240':9100

'14#.#52.120.51':9001

'18#.#17.82.68':9001

'5.###.61.111':9001

'18#.#42.113.242':1234

'46.##1.165.197':443

'91.##2.103.50':443

'12#.#99.245.252':21

'79.##.158.50':9001

'88.##.31.186':34746

'45.##.222.13':9001

'19#.#7.165.141':443

'15#.#7.137.237':9001

'64.#27.86.1':9001

'14#.#3.214.114':9001

'45.##.126.76':443

'96.##.82.104':9001

'19#.#9.34.48':443

'76.##9.92.122':9001

'11#.#02.155.223':443

'13#.#93.15.186':443

'19#.#21.44.26':9001

'37.#.231.195':443

'19#.#45.50.143':443

'19#.#49.230.89':443

'82.##2.94.125':443

'10#.#44.73.13':9100

'10#.#49.132.102':443

'62.##0.130.135':9001

'23.##9.64.191':443

'46.##.255.165':9001

'19#.#08.117.41':1080

'14#.#51.41.235':9001

'95.##6.145.1':1066

'46.##.143.139':443

'23.##9.64.184':443

'18#.#20.101.210':30210

'93.##5.91.66':443

'19#.#1.114.46':9003

'91.##8.166.18':9001

'21#.#73.161.104':9001

'16#.#19.59.185':9001

'51.##.80.237':443

'19#.#87.249.116':443

'11#.#03.234.246':443

'68.#7.32.33':9001

'17#.#8.121.159':9001

'10#.#95.166.188':9001

'89.#2.96.90':443

'15#.#9.138.162':9001

'19#.#84.215.11':9090

'82.##5.20.161':9001

'88.##7.121.65':9001

'21#.#.24.104':9001

'21#.#36.78.104':9001

'14#.#1.112.149':9001

'20#.#50.238.18':9090

'13#.#43.149.82':443

'19#.#0.123.70':443

'19#.#49.230.85':443

'91.##0.242.120':443

'10#.#0.100.12':443

'50.##.114.79':9001

'76.##.151.174':9001

'13#.#62.59.134':9001

'34.##4.199.147':443

'51.##4.35.151':9000

'78.##0.128.106':443

'51.##.77.244':443

'14#.#02.208.203':443

'13#.#4.32.28':9001

'14#.#3.155.189':9001

'18#.#91.124.152':9002

'10#.#89.10.143':9001

'46.##7.67.92':51505

'80.#0.39.25':443

'17#.#3.69.254':9001

'91.##3.145.116':443

'17#.#1.184.130':27015

'88.#.233.220':9001

'17#.#40.95.161':9001

'95.##7.183.200':443

'45.#56.22.9':9001

'16#.#8.97.122':5001

'46.##5.182.91':9001

'46.##8.243.239':990

'83.##.20.248':9001

'46.##4.166.250':9001

'20#.#0.45.116':9001

'81.##9.235.154':443

'17#.#05.163.222':443

'18#.#1.217.32':10042

'45.##.116.104':9001

'10#.#36.87.90':9001

'10#.#06.237.23':443

'76.##.40.183':9001

'13#.#62.117.43':9001

'86.##4.164.91':443

'46.##.110.244':443

'21#.#27.200.133':9001

'31.##0.1.169':443

'18#.#20.102.242':443

'16#.#72.139.104':443

'95.##0.225.48':9001

'45.##3.139.49':443

'51.##.213.32':443

'45.##.192.46':443

'18#.#14.128.157':443

'83.##6.106.223':443

'13#.#01.250.33':9011

'17#.#7.171.102':9001

'99.##1.45.143':443

'18#.#2.45.114':9090

'62.##1.48.177':443

'15#.4.70.21':443

'78.##.186.133':9001

'94.##4.74.134':9001

'86.##.32.199':9001

'91.##3.145.114':443

'21#.#29.4.84':9999

'45.#0.5.120':9001

'13#.#48.33.67':9001

'91.##9.223.22':443

'65.#9.20.10':9001

'52.##.230.13':9001

'19#.#49.230.66':443

'17#.#05.122.161':9001

'10#.#44.76.69':443

'91.##2.144.125':9001

'94.##.123.67':9001

'13#.#9.97.26':9001

'10#.#7.231.27':443