Trojan.DownLoader12.29156

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER5574.dir00\svchost.exe.mdmp 16325836412032120

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5574.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'24.##5.140.1':139
'24.##5.96.147':139
'24.##5.8.189':139
'24.##5.78.199':139
'24.##5.13.44':139
'24.##5.200.176':139
'24.##5.74.12':139
'24.##5.80.224':139
'24.##5.53.15':139
'24.##5.30.191':139
'24.##5.64.45':139
'24.##5.5.111':139
'24.##5.14.176':139
'24.##5.193.32':445
'24.##5.115.89':445
'24.##5.94.76':445
'24.##5.194.182':139
'24.##5.72.195':139
'24.##5.8.199':139
'24.#35.39.4':139
'24.##5.113.227':139
'24.##5.13.44':445
'24.##5.8.189':445
'24.##5.78.199':445
'24.##5.72.195':445
'24.##5.64.45':445
'24.##5.30.191':445
'24.##5.80.224':445
'24.##5.53.15':445
'24.##5.140.1':445
'24.##5.96.147':445
'24.##5.194.182':445
'24.##5.190.175':139
'24.##5.107.48':139
'24.##5.183.140':139
'24.##5.130.49':139
'24.##5.215.129':139
'24.##5.113.227':445
'24.##5.8.199':445
'24.#35.39.4':445
'24.##5.5.111':445
'24.##5.14.176':445
'24.##5.173.245':445
'24.##5.173.245':139
'24.##5.115.89':139
'24.##5.169.228':139
'24.##5.19.217':139
'24.##5.249.99':139
'24.##5.63.33':445
'24.##5.111.62':445
'24.##5.33.141':445
'24.##5.94.76':139
'24.##5.193.32':139
'24.##5.70.145':139
'24.##5.51.28':139
'24.##5.137.220':139
'24.##5.152.65':139
'24.##5.26.30':139
'24.##5.228.118':139
'24.##5.212.123':139
'24.##5.183.38':139
'24.##5.149.43':139
'24.##5.206.162':139
'24.##5.85.17':139
'24.##5.149.43':445
'24.##5.212.123':445
'24.##5.85.17':445
'24.##5.137.220':445
'24.##5.206.162':445
'24.##5.249.99':445
'24.##5.169.228':445
'24.##5.19.217':445
'24.##5.183.38':445
'24.##5.70.145':445
'24.##5.51.28':445
'24.##5.11.203':445
'24.##5.153.156':445
'24.##5.232.76':445
'24.##5.135.110':445
'24.##5.122.135':445
'24.##5.228.118':445
'24.##5.152.65':445
'24.##5.26.30':445
'24.##5.185.31':445
'24.##5.219.184':445
'24.##5.200.176':445
'24.##5.127.145':445
'24.##5.144.110':445
'24.##5.47.31':445
'24.##5.61.227':445
'24.##5.13.62':445
'24.##5.91.247':139
'24.#35.82.8':139
'24.##5.81.66':445
'24.##5.176.36':445
'24.##5.120.208':445
'24.##5.73.30':445
'24.##5.98.121':445
'24.##5.14.198':445
'24.##5.121.109':445
'24.##5.30.34':445
'24.##5.84.38':445
'24.##5.200.20':445
'24.##5.54.128':445
'24.##5.59.118':445
'24.##5.19.212':445
'24.##5.161.34':445
'24.##5.109.45':139
'24.##5.43.159':139
'24.##5.145.227':139
'24.##5.95.92':139
'24.##5.83.162':139
'24.##5.71.60':139
'24.##5.247.108':139
'24.##5.126.180':139
'24.##5.142.183':139
'24.##5.124.161':139
'24.##5.8.186':139
'24.##5.192.178':139
'24.##5.133.104':139
'24.##5.110.198':139
'24.##5.250.81':139
'24.##5.170.250':139
'24.##5.243.52':139
'24.##5.245.119':139
'24.##5.14.136':139
'24.##5.194.47':139
'24.##5.56.180':139
'24.##5.7.144':445
'24.##5.7.144':139
'24.##5.30.34':139
'24.##5.161.230':139
'24.##5.98.92':139
'24.##5.195.139':139
'24.##5.14.198':139
'24.##5.19.212':139
'24.##5.98.121':139
'24.##5.84.38':139
'24.##5.121.109':139
'24.##5.50.94':139
'24.##5.183.140':445
'24.##5.190.175':445
'24.##5.215.129':445
'24.##5.74.12':445
'24.##5.130.49':445
'24.##5.70.72':139
'24.##5.192.148':139
'24.##5.72.138':139
'24.##5.107.48':445
'24.##5.27.243':139
'24.##5.72.138':445
'24.##5.70.72':445
'24.##5.27.243':445
'24.##5.120.208':139
'24.##5.81.66':139
'24.##5.195.139':445
'24.##5.161.230':445
'24.##5.98.92':445
'24.##5.192.148':445
'24.##5.50.94':445
'24.##5.176.36':139
'24.##5.54.128':139
'24.##5.73.30':139
'24.##5.200.20':139
'24.##5.161.34':139
'24.##5.59.118':139
'24.##5.127.145':139
'24.##5.144.110':139
'24.##5.47.31':139
'24.##5.61.227':139
'24.##5.13.62':139
'24.##5.219.184':139
'24.#35.3.70':445
'24.##5.206.181':445
'24.##5.176.197':445
'24.##5.91.207':445
'24.##5.62.188':445
'24.##5.10.158':445
'24.##5.214.32':445
'24.##5.175.137':445
'24.##5.95.254':445
'24.##5.139.95':445
'24.##5.142.215':445
'24.##5.227.184':139
'24.##5.64.239':139
'24.##5.138.171':139
'24.##5.151.127':139
'24.##5.171.240':139
'24.##5.115.47':445
'24.##5.88.236':445
'24.##5.117.83':139
'24.##5.133.9':139
'24.##5.81.216':139
'24.##5.114.212':445
'24.##5.150.10':445
'24.##5.177.244':445
'24.##5.82.212':445
'24.##5.28.238':445
'24.##5.11.15':445
'24.##5.127.11':445
'24.##5.15.145':445
'24.##5.224.149':445
'24.##5.144.225':445
'24.##5.77.83':445
'24.##5.14.115':445
'24.##5.118.171':445
'24.##5.157.153':445
'24.##5.232.214':445
'24.##5.186.252':445
'24.##5.132.62':445
'24.##5.64.14':445
'24.##5.216.6':445
'24.##5.29.119':445
'24.##5.38.224':445
'24.##5.97.188':139
'24.##5.186.252':139
'24.##5.157.153':139
'24.##5.232.214':139
'24.##5.10.158':139
'24.##5.214.32':139
'24.##5.38.224':139
'24.##5.216.6':139
'24.##5.29.119':139
'24.##5.14.115':139
'24.##5.118.171':139
'24.##5.175.137':139
'24.##5.142.215':139
'24.##5.62.188':139
'24.##5.88.236':139
'24.##5.91.207':139
'24.##5.115.47':139
'24.##5.95.254':139
'24.##5.139.95':139
'24.##5.206.181':139
'24.##5.176.197':139
'24.#35.3.70':139
'24.##5.80.251':139
'24.##5.113.9':139
'24.##5.176.126':139
'24.##5.11.15':139
'24.##5.127.11':139
'24.##5.169.197':139
'24.##5.113.175':139
'24.##5.65.11':139
'24.##5.130.138':139
'24.##5.197.43':139
'24.##5.15.145':139
'24.##5.77.83':139
'24.##5.28.238':139
'24.##5.82.212':139
'24.##5.132.62':139
'24.##5.64.14':139
'24.##5.224.149':139
'24.##5.144.225':139
'24.##5.150.10':139
'24.##5.177.244':139
'24.##5.114.212':139
'24.##5.176.126':445
'24.##5.33.116':445
'24.##5.89.190':445
'24.##5.28.171':445
'24.##5.29.121':445
'24.##5.31.69':445
'24.##5.151.188':445
'24.##5.37.69':445
'24.##5.164.71':445
'24.##5.190.82':445
'24.##5.165.163':445
'24.##5.135.60':445
'24.##5.217.24':139
'24.##5.37.31':139
'24.##5.24.227':139
'24.#35.1.61':139
'24.##5.115.210':139
'24.##5.224.252':139
'24.##5.27.17':139
'24.##5.174.119':139
'24.##5.126.201':139
'24.##5.222.134':139
'24.##5.111.62':139
'24.##5.135.110':139
'24.##5.63.33':139
'24.##5.27.17':445
'24.##5.33.141':139
'24.##5.153.156':139
'24.##5.185.31':139
'24.##5.11.203':139
'24.##5.122.135':139
'24.##5.232.76':139
'24.##5.224.252':445
'24.##5.115.210':445
'24.##5.24.227':445
'24.#35.1.61':445
'24.##5.75.138':445
'24.##5.61.40':445
'24.##5.222.134':445
'24.##5.174.119':445
'24.##5.126.201':445
'24.##5.217.24':445
'24.##5.37.31':445
'24.##5.61.40':139
'24.##5.81.216':445
'24.##5.117.83':445
'24.##5.133.9':445
'24.##5.227.184':445
'24.##5.64.239':445
'24.##5.142.215':9988
'24.##5.95.254':9988
'24.##5.115.47':9988
'24.##5.88.236':9988
'24.##5.91.207':9988
'24.##5.138.171':445
'24.##5.65.11':445
'24.##5.197.43':445
'24.##5.130.138':445
'24.##5.113.9':445
'24.##5.80.251':445
'24.##5.151.127':445
'24.##5.171.240':445
'24.##5.97.188':445
'24.##5.169.197':445
'24.##5.113.175':445
'24.##5.89.190':139
'24.##5.190.82':139
'24.##5.33.116':139
'24.##5.31.69':139
'24.##5.28.171':139
'24.##5.37.69':139
'24.##5.75.138':139
'24.##5.151.188':139
'24.##5.165.163':139
'24.##5.164.71':139
'24.##5.29.121':139
'24.##5.232.214':9988
'24.##5.186.252':9988
'24.##5.214.32':9988
'24.##5.139.95':9988
'24.##5.10.158':9988
'24.##5.216.6':9988
'24.##5.135.60':139
'24.##5.118.171':9988
'24.##5.157.153':9988
'24.##5.14.115':9988

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней