Trojan.DownLoader10.3464

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER717d.dir00\svchost.exe.mdmp 16325836412032928

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER717d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Deletes itself.

Network activity:

Connects to:

'19#.#32.31.188':445
'19#.#32.128.134':445
'19#.#32.7.117':445
'19#.#32.194.250':445
'19#.#32.147.97':445
'19#.#32.72.203':445
'19#.#32.105.156':445
'19#.#32.98.22':445
'19#.#32.99.24':445
'19#.#32.181.227':445
'19#.#32.110.107':445
'19#.#32.237.213':139
'19#.#32.10.70':445
'19#.#32.208.116':445
'19#.#32.89.143':445
'19#.#32.59.215':445
'19#.#32.116.170':445
'19#.#32.203.153':445
'19#.#32.134.142':445
'19#.#32.7.81':445
'19#.#32.154.7':445
'19#.#32.180.140':445
'19#.#32.11.90':445
'19#.#32.104.97':445
'19#.#32.207.212':445
'19#.#32.159.9':445
'19#.#32.17.138':445
'19#.#32.9.17':445
'19#.#32.157.164':445
'19#.#32.137.158':445
'19#.#32.54.191':445
'19#.#32.201.91':445
'19#.#32.29.93':445
'19#.#32.65.106':445
'19#.#32.155.161':139
'19#.#32.65.106':139
'19#.#32.54.191':139
'19#.#32.9.17':139
'19#.#32.29.93':139
'19#.#32.7.81':139
'19#.#32.154.7':139
'19#.#32.159.9':139
'19#.#32.201.91':139
'19#.#32.17.138':139
'19#.#32.105.156':139
'19#.#32.98.22':139
'19#.#32.31.188':139
'19#.#32.128.134':139
'19#.#32.157.164':139
'19#.#32.137.158':139
'19#.#32.147.97':139
'19#.#32.72.203':139
'19#.#32.189.182':139
'19#.#32.239.239':139
'19#.#32.235.69':139
'19#.#32.7.26':139
'19#.#32.230.237':139
'19#.#32.63.188':139
'19#.#32.202.48':139
'19#.#32.35.226':139
'19#.#32.69.79':139
'19#.#32.104.97':139
'19#.#32.207.212':139
'19#.#32.203.153':139
'19#.#32.134.142':139
'19#.#32.133.37':139
'19#.#32.79.75':139
'19#.#32.180.140':139
'19#.#32.11.90':139
'19#.#32.3.154':139
'19#.#32.136.46':139
'19#.#32.76.22':139
'19#.#32.3.168':139
'19#.#32.5.48':139
'19#.#32.220.14':139
'19#.#32.108.7':139
'19#.#32.243.90':139
'19#.#32.213.67':139
'19#.#32.16.99':139
'19#.#32.13.158':139
'19#.#32.42.54':139
'19#.#32.100.40':139
'19#.#32.156.112':139
'19#.#32.131.79':139
'19#.#32.16.14':139
'19#.#32.40.1':139
'19#.#32.47.116':139
'19#.#32.64.102':139
'19#.#32.85.143':139
'19#.#32.34.26':139
'19#.#32.73.203':139
'19#.#32.232.32':139
'19#.#32.63.215':139
'19#.#32.9.61':139
'19#.#32.90.177':139
'19#.#32.2.242':139
'19#.#32.239.104':139
'19#.#32.84.43':139
'19#.#32.106.120':139
'19#.#32.10.223':139
'19#.#32.46.11':139
'19#.#32.205.162':139
'19#.#32.223.31':139
'19#.#32.182.78':139
'19#.#32.155.161':445
'19#.#32.237.213':445
'19#.#32.230.237':445
'19#.#32.63.188':445
'19#.#32.162.133':139
'19#.#32.236.244':139
'19#.#32.190.227':139
'19#.#32.224.96':139
'19#.#32.35.226':445
'19#.#32.69.79':445
'19#.#32.235.69':445
'19#.#32.133.37':445
'19#.#32.79.75':445
'19#.#32.239.239':445
'19#.#32.202.48':445
'19#.#32.7.26':445
'19#.#32.189.182':445
'19#.#32.36.31':139
'19#.#32.138.229':139
'19#.#32.211.142':139
'19#.#32.30.212':139
'19#.#32.114.170':139
'19#.#32.98.174':139
'19#.#32.173.93':139
'19#.#32.171.18':139
'19#.#32.156.172':139
'19#.#32.224.96':445
'19#.#32.162.133':445
'19#.#32.27.125':139
'19#.#32.190.227':445
'19#.#32.137.135':139
'19#.#32.66.135':139
'19#.#32.236.244':445
'19#.#32.27.125':445
'19#.#32.194.250':139
'19#.#32.7.121':139
'19#.#32.123.224':139
'19#.#32.25.87':139
'19#.#32.46.28':139
'19#.#32.218.121':139
'19#.#32.246.107':445
'19#.#32.191.123':139
'19#.#32.233.191':139
'19#.#32.23.161':139
'19#.#32.185.197':139
'19#.#32.119.83':139
'19#.#32.207.190':139
'19#.#32.76.116':139
'19#.#32.192.109':139
'19#.#32.31.137':139
'19#.#32.108.223':139
'19#.#32.167.37':139
'19#.#32.235.139':445
'19#.#32.65.1':445
'19#.#32.53.169':445
'19#.#32.139.122':445
'19#.#32.245.181':445
'19#.#32.208.52':445
'19#.#32.111.86':445
'19#.#32.31.147':445
'19#.#32.71.17':445
'19#.#32.59.236':445
'19#.#32.39.247':445
'19#.#32.108.59':445
'19#.#32.235.233':445
'19#.#32.71.85':445
'19#.#32.68.90':445
'19#.#32.233.211':445
'19#.#32.212.111':445
'19#.#32.101.40':139
'19#.#32.139.122':139
'19#.#32.235.139':139
'19#.#32.71.17':139
'19#.#32.53.169':139
'19#.#32.31.147':139
'19#.#32.245.181':139
'19#.#32.65.1':139
'19#.#32.111.86':139
'19#.#32.68.90':139
'19#.#32.212.111':139
'19#.#32.39.247':139
'19#.#32.246.107':139
'19#.#32.108.59':139
'19#.#32.235.233':139
'19#.#32.71.85':139
'19#.#32.59.236':139
'19#.#32.233.211':139
'19#.#32.121.154':139
'19#.#32.24.234':139
'19#.#32.33.121':139
'19#.#32.17.195':139
'19#.#32.74.216':139
'19#.#32.54.116':139
'19#.#32.0.215':139
'19#.#32.114.168':139
'19#.#32.243.106':139
'19#.#32.208.48':139
'19#.#32.114.208':139
'19#.#32.208.52':139
'19#.#32.144.126':139
'19#.#32.125.141':139
'19#.#32.56.69':139
'19#.#32.187.116':139
'19#.#32.21.137':139
'19#.#32.53.169':9988
'19#.#32.185.197':9988
'19#.#32.108.59':9988
'19#.#32.76.116':9988
'19#.#32.33.95':139
'19#.#32.40.191':139
'19#.#32.108.223':9988
'19#.#32.23.161':9988
'19#.#32.65.1':9988
'19#.#32.246.107':9988
'19#.#32.56.69':9988
'19#.#32.31.147':9988
'19#.#32.208.48':9988
'19#.#32.139.122':9988
'19#.#32.71.85':9988
'19#.#32.187.116':9988
'19#.#32.71.17':9988
'19#.#32.59.215':139
'19#.#32.116.170':139
'19#.#32.181.227':139
'19#.#32.110.107':139
'19#.#32.99.24':139
'19#.#32.7.117':139
'19#.#32.208.116':139
'19#.#32.89.143':139
'19#.#32.10.70':139
'19#.132.8.6':139
'19#.#32.33.95':445
'19#.#32.19.59':139
'19#.#32.247.214':139
'19#.#32.247.214':445
'19#.132.8.6':445
'19#.#32.40.191':445
'19#.#32.19.59':445
'19#.#32.212.111':9988
'19#.#32.24.234':445
'19#.#32.0.215':445
'19#.#32.17.195':445
'19#.#32.121.154':445
'19#.#32.54.116':445
'19#.#32.101.40':445
'19#.#32.114.168':445
'19#.#32.74.216':445
'19#.#32.33.121':445
'19#.#32.114.208':445
'19#.#32.187.116':445
'19#.#32.144.126':445
'19#.#32.208.48':445
'19#.#32.56.69':445
'19#.#32.243.106':445
'19#.#32.21.137':445
'19#.#32.125.141':445
'19#.#32.7.121':445
'19#.#32.123.224':445
'19#.#32.46.28':445
'19#.#32.25.87':445
'19#.#32.218.121':445
'19#.#32.68.90':9988
'19#.#32.191.123':445
'19#.#32.233.191':445
'19#.#32.23.161':445
'19#.#32.185.197':445
'19#.#32.119.83':445
'19#.#32.207.190':445
'19#.#32.76.116':445
'19#.#32.192.109':445
'19#.#32.31.137':445
'19#.#32.108.223':445
'19#.#32.167.37':445

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней