Trojan.DownLoader12.29149

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERccac.dir00\svchost.exe.mdmp 16325836412032236

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'67.#1.4.252':139
'67.#1.82.5':139
'67.##.193.35':139
'67.##.184.211':139
'67.##.93.184':139
'67.##.178.100':139
'67.##.42.179':139
'67.##.101.103':139
'67.##.192.81':139
'67.##.103.192':139
'67.##.146.240':139
'67.##.82.121':139
'67.##.190.17':139
'67.##.108.49':139
'67.##.169.94':445
'67.##.46.116':445
'67.##.157.243':139
'67.#1.16.88':139
'67.##.31.176':139
'67.#1.60.40':139
'67.##.195.229':139
'67.##.103.60':139
'67.##.184.211':445
'67.##.93.184':445
'67.##.146.240':445
'67.##.157.243':445
'67.#1.16.88':445
'67.##.192.81':445
'67.##.103.192':445
'67.#1.82.5':445
'67.##.193.35':445
'67.#1.4.252':445
'67.##.31.176':445
'67.##.108.195':139
'67.##.71.154':139
'67.##.34.220':139
'67.#1.22.86':139
'67.#1.252.5':139
'67.#1.60.40':445
'67.##.195.229':445
'67.##.190.17':445
'67.##.108.49':445
'67.##.82.121':445
'67.##.209.213':139
'67.##.109.177':139
'67.#1.110.6':139
'67.##.110.94':139
'67.#1.9.0':139
'67.##.74.178':445
'67.#1.44.74':445
'67.##.46.116':139
'67.#1.62.92':139
'67.##.169.94':139
'67.#1.94.79':139
'67.##.121.43':139
'67.##.43.208':139
'67.##.201.148':139
'67.#1.44.53':139
'67.##.92.163':139
'67.##.103.173':139
'67.##.43.229':139
'67.#1.64.69':139
'67.##.32.155':139
'67.##.73.172':139
'67.##.177.44':445
'67.#1.94.79':445
'67.##.110.94':445
'67.##.43.229':445
'67.#1.64.69':445
'67.##.103.173':445
'67.##.109.177':445
'67.#1.62.92':445
'67.##.209.213':445
'67.#1.9.0':445
'67.#1.110.6':445
'67.##.73.172':445
'67.##.132.156':445
'67.#1.44.53':445
'67.##.122.124':445
'67.##.147.213':445
'67.##.17.111':445
'67.##.43.208':445
'67.##.32.155':445
'67.##.121.43':445
'67.##.92.163':445
'67.##.201.148':445
'67.##.201.63':445
'67.##.250.200':445
'67.##.64.172':445
'67.##.158.125':445
'67.#1.13.92':445
'67.##.175.87':139
'67.##.63.106':139
'67.#1.32.68':139
'67.##.93.163':445
'67.##.49.168':445
'67.##.116.106':445
'67.#1.60.13':445
'67.##.220.206':445
'67.#1.8.119':445
'67.##.156.119':445
'67.##.215.67':445
'67.##.104.145':445
'67.##.105.223':445
'67.##.130.165':445
'67.##.198.129':445
'67.##.222.106':445
'67.#1.90.84':139
'67.##.162.123':139
'67.##.183.51':139
'67.##.56.166':139
'67.##.186.50':139
'67.##.121.124':139
'67.##.120.63':139
'67.#1.1.186':139
'67.##.25.232':139
'67.##.92.177':139
'67.#1.9.158':139
'67.#1.8.23':139
'67.#1.40.30':139
'67.##.195.40':139
'67.#1.0.172':139
'67.#1.67.54':139
'67.##.179.226':139
'67.##.255.180':139
'67.##.39.205':139
'67.#1.78.20':139
'67.#1.3.30':139
'67.##.20.114':139
'67.##.79.228':139
'67.##.90.185':139
'67.##.200.218':139
'67.##.134.17':139
'67.#1.3.6':139
'67.#1.8.119':139
'67.#1.60.13':139
'67.##.215.67':139
'67.#1.25.90':139
'67.##.156.119':139
'67.#1.17.93':139
'67.##.103.60':445
'67.#1.22.86':445
'67.##.42.179':445
'67.##.101.103':445
'67.##.178.100':445
'67.##.71.154':445
'67.##.139.56':139
'67.##.108.195':445
'67.#1.252.5':445
'67.##.34.220':445
'67.##.220.206':139
'67.#1.17.93':445
'67.##.134.17':445
'67.##.139.56':445
'67.##.93.163':139
'67.##.49.168':139
'67.##.90.185':445
'67.#1.25.90':445
'67.##.79.228':445
'67.#1.3.6':445
'67.##.200.218':445
'67.##.250.200':139
'67.##.104.145':139
'67.##.105.223':139
'67.##.130.165':139
'67.##.198.129':139
'67.##.222.106':139
'67.##.64.172':139
'67.##.201.63':139
'67.#1.13.92':139
'67.##.116.106':139
'67.##.158.125':139
'67.##.224.62':445
'67.##.227.59':445
'67.##.200.167':445
'67.#1.1.213':445
'67.##.95.195':445
'67.##.11.126':445
'67.#1.50.35':445
'67.##.97.126':445
'67.#1.45.34':445
'67.#1.60.67':445
'67.##.10.195':445
'67.##.129.178':139
'67.##.146.130':139
'67.##.178.119':139
'67.##.168.163':139
'67.#1.43.53':139
'67.##.219.28':445
'67.##.153.166':445
'67.##.151.234':139
'67.##.86.146':139
'67.##.127.86':139
'67.##.114.35':445
'67.##.131.21':445
'67.##.35.131':445
'67.##.21.192':445
'67.##.91.196':445
'67.##.113.137':445
'67.#1.8.78':445
'67.#1.92.21':445
'67.##.93.224':445
'67.##.239.184':445
'67.##.93.136':445
'67.#1.223.3':445
'67.##.157.74':445
'67.##.125.210':445
'67.##.249.66':445
'67.##.190.221':445
'67.#1.67.3':445
'67.##.106.177':445
'67.##.129.203':445
'67.##.126.205':445
'67.##.86.166':445
'67.##.225.163':445
'67.##.190.221':139
'67.#1.67.3':139
'67.##.114.35':139
'67.##.11.126':139
'67.#1.50.35':139
'67.##.86.166':139
'67.##.225.163':139
'67.##.125.210':139
'67.##.249.66':139
'67.##.157.74':139
'67.##.97.126':139
'67.##.95.195':139
'67.#1.1.213':139
'67.##.219.28':139
'67.##.153.166':139
'67.##.10.195':139
'67.#1.45.34':139
'67.#1.60.67':139
'67.##.227.59':139
'67.##.200.167':139
'67.##.224.62':139
'67.##.126.205':139
'67.##.189.44':139
'67.##.125.189':139
'67.#1.45.92':139
'67.#1.8.78':139
'67.#1.92.21':139
'67.#1.13.74':139
'67.##.110.179':139
'67.##.109.211':139
'67.##.63.246':139
'67.#1.84.95':139
'67.##.93.224':139
'67.##.91.196':139
'67.##.113.137':139
'67.#1.223.3':139
'67.##.106.177':139
'67.##.129.203':139
'67.##.239.184':139
'67.##.93.136':139
'67.##.35.131':139
'67.##.21.192':139
'67.##.131.21':139
'67.##.212.51':445
'67.#1.4.107':445
'67.#1.40.50':445
'67.##.155.38':445
'67.##.95.233':445
'67.#1.21.67':445
'67.##.74.249':445
'67.##.63.174':445
'67.#1.248.4':445
'67.##.173.248':445
'67.#1.88.89':139
'67.##.50.218':139
'67.##.32.212':139
'67.##.137.199':139
'67.##.207.216':139
'67.#1.23.53':139
'67.##.228.149':139
'67.##.119.174':139
'67.#1.3.98':139
'67.##.116.184':139
'67.##.114.179':139
'67.##.170.209':445
'67.##.74.178':139
'67.#1.44.74':139
'67.#1.88.89':445
'67.##.228.149':445
'67.##.119.174':445
'67.##.122.124':139
'67.##.132.156':139
'67.##.17.111':139
'67.##.177.44':139
'67.##.147.213':139
'67.#1.3.98':445
'67.##.207.216':445
'67.#1.23.53':445
'67.##.35.166':445
'67.##.42.119':445
'67.#1.57.63':445
'67.##.116.184':445
'67.##.114.179':445
'67.##.32.212':445
'67.##.137.199':445
'67.##.50.218':445
'67.##.127.86':445
'67.##.151.234':445
'67.##.146.130':445
'67.##.129.178':445
'67.##.86.146':445
'67.##.200.167':9988
'67.##.11.126':9988
'67.##.219.28':9988
'67.##.10.195':9988
'67.#1.1.213':9988
'67.##.178.119':445
'67.##.63.246':445
'67.#1.84.95':445
'67.##.125.189':445
'67.#1.45.92':445
'67.##.189.44':445
'67.##.168.163':445
'67.#1.43.53':445
'67.##.110.179':445
'67.##.109.211':445
'67.#1.13.74':445
'67.##.86.166':9988
'67.##.63.174':139
'67.#1.21.67':139
'67.##.173.248':139
'67.#1.4.107':139
'67.#1.248.4':139
'67.#1.57.63':139
'67.##.35.166':139
'67.##.42.119':139
'67.##.74.249':139
'67.##.170.209':139
'67.##.212.51':139
'67.##.113.137':9988
'67.##.131.21':9988
'67.##.106.177':9988
'67.##.225.163':9988
'67.##.126.205':9988
'67.##.95.233':139
'67.#1.40.50':139
'67.##.155.38':139
'67.##.35.131':9988
'67.##.93.136':9988

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней