Trojan.DownLoader12.29168

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER71c3.dir00\svchost.exe.mdmp 16325836412032144

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER71c3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'19#.#.201.43':445
'19#.1.48.19':445
'19#.#.117.222':445
'19#.#.136.99':445
'19#.#.19.237':445
'19#.#.179.139':139
'19#.#.129.210':139
'19#.#.111.81':445
'19#.#.127.100':139
'19#.1.15.50':445
'19#.1.79.5':445
'19#.#.143.154':445
'19#.1.41.63':445
'19#.1.35.41':445
'19#.#.27.249':445
'19#.#.135.237':445
'19#.#.21.135':445
'19#.#.33.136':445
'19#.#.107.200':445
'19#.#.91.155':139
'19#.#.155.55':139
'19#.#.13.206':139
'19#.#.234.94':139
'19#.#.178.204':139
'19#.1.38.2':139
'19#.#.207.113':139
'19#.#.105.98':139
'19#.#.247.73':139
'19#.#.133.247':139
'19#.#.42.169':139
'19#.#.225.225':139
'19#.#.26.244':139
'19#.1.5.77':139
'19#.#.225.122':139
'19#.#.48.125':139
'19#.#.24.194':139
'19#.#.168.205':139
'19#.#.16.167':139
'19#.#.126.124':139
'19#.#.139.75':445
'19#.#.227.238':445
'19#.1.131.6':445
'19#.#.163.104':445
'19#.#.78.204':445
'19#.#.31.196':445
'19#.#.188.93':445
'19#.#.167.207':445
'19#.#.160.250':445
'19#.#.93.160':445
'19#.#.222.252':445
'19#.1.48.19':139
'19#.#.19.237':139
'19#.#.136.99':139
'19#.#.201.43':139
'19#.#.111.81':139
'19#.#.161.235':445
'19#.#.148.93':445
'19#.#.240.204':445
'19#.#.235.240':445
'19#.#.103.24':445
'19#.1.89.36':445
'19#.1.92.65':445
'19#.1.29.42':445
'19#.#.219.216':445
'19#.#.115.29':445
'19#.1.22.50':445
'19#.#.44.235':445
'19#.#.50.179':445
'19#.#.24.122':445
'19#.#.150.192':445
'19#.#.230.81':445
'19#.#.85.169':445
'19#.1.57.87':445
'19#.#.17.106':445
'19#.#.253.151':445
'19#.#.158.236':445
'19#.1.98.11':445
'19#.#.193.104':445
'19#.#.16.214':445
'19#.1.99.55':445
'19#.#.201.99':445
'19#.#.105.98':445
'19#.#.225.223':445
'19#.#.25.210':445
'19#.#.142.36':445
'19#.#.71.126':445
'19#.1.93.16':445
'19#.#.238.92':445
'19#.#.207.113':445
'19#.#.234.94':445
'19#.#.178.204':445
'19#.#.168.205':445
'19#.#.42.169':445
'19#.#.155.55':445
'19#.#.247.73':445
'19#.#.133.247':445
'19#.#.13.206':445
'19#.1.38.2':445
'19#.#.163.86':445
'19#.#.11.203':445
'19#.#.75.139':445
'19#.#.121.224':445
'19#.1.93.33':445
'19#.#.60.218':445
'19#.#.93.116':445
'19#.1.79.94':445
'19#.#.93.156':445
'19#.1.172.8':445
'19#.#.224.32':445
'19#.#.24.146':445
'19#.#.211.198':445
'19#.#.31.222':445
'19#.#.158.81':445
'19#.#.123.212':445
'19#.#.178.140':445
'19#.1.32.56':445
'19#.1.30.25':445
'19#.1.14.85':445
'19#.#.24.194':445
'19#.#.211.198':139
'19#.#.123.212':139
'19#.#.158.81':139
'19#.#.24.146':139
'19#.1.30.25':139
'19#.1.32.56':139
'19#.#.224.32':139
'19#.1.14.85':139
'19#.#.178.140':139
'19#.#.31.222':139
'19#.#.201.99':139
'19#.#.25.210':139
'19#.#.225.223':139
'19#.1.99.55':139
'19#.1.93.16':139
'19#.#.71.126':139
'19#.#.163.86':139
'19#.#.238.92':139
'19#.#.142.36':139
'19#.#.121.224':139
'19#.1.5.77':445
'19#.#.225.122':445
'19#.#.129.210':445
'19#.#.91.155':445
'19#.#.225.225':445
'19#.#.16.167':445
'19#.#.126.124':445
'19#.#.26.244':445
'19#.#.48.125':445
'19#.#.179.139':445
'19#.#.75.139':139
'19#.#.60.218':139
'19#.1.93.33':139
'19#.#.11.203':139
'19#.#.93.156':139
'19#.1.79.94':139
'19#.#.127.100':445
'19#.1.172.8':139
'19#.#.93.116':139
'19#.#.117.222':139
'19#.#.10.225':445
'19#.1.19.35':445
'19#.#.105.183':139
'19#.#.225.194':445
'19#.#.155.84':445
'19#.1.84.11':445
'19#.1.53.34':445
'19#.1.45.57':445
'19#.#.88.155':445
'19#.#.96.103':139
'19#.#.189.141':139
'19#.#.250.133':139
'19#.#.171.37':139
'19#.#.100.210':139
'19#.#.42.150':139
'19#.#.246.183':139
'19#.#.117.136':139
'19#.#.218.246':139
'19#.#.160.54':139
'19#.1.21.36':445
'19#.1.60.41':445
'19#.#.59.215':445
'19#.#.148.107':445
'19#.1.29.7':445
'19#.1.82.0':445
'19#.1.34.16':445
'19#.#.109.53':445
'19#.#.173.152':445
'19#.#.119.30':445
'19#.#.218.82':445
'19#.#.237.208':445
'19#.#.113.238':445
'19#.#.173.145':445
'19#.#.225.32':445
'19#.#.65.130':445
'19#.#.86.154':445
'19#.1.32.33':445
'19#.#.120.224':445
'19#.1.201.9':445
'19#.1.53.1':139
'19#.#.113.238':139
'19#.#.65.130':139
'19#.#.225.32':139
'19#.#.237.208':139
'19#.#.120.224':139
'19#.1.32.33':139
'19#.#.218.82':139
'19#.1.201.9':139
'19#.#.86.154':139
'19#.1.21.36':139
'19#.1.19.35':139
'19#.#.10.225':139
'19#.1.45.57':139
'19#.1.84.11':139
'19#.#.225.194':139
'19#.1.53.34':139
'19#.#.173.145':139
'19#.#.155.84':139
'19#.#.88.155':139
'19#.#.148.107':139
'19#.#.48.200':139
'19#.#.173.242':139
'19#.#.55.122':139
'19#.1.67.55':139
'19#.#.226.174':139
'19#.1.9.249':139
'19#.#.105.145':139
'19#.#.220.226':139
'19#.1.0.164':139
'19#.#.122.134':139
'19#.#.59.215':139
'19#.1.82.0':139
'19#.1.29.7':139
'19#.1.60.41':139
'19#.#.173.152':139
'19#.#.109.53':139
'19#.#.134.108':139
'19#.1.34.16':139
'19#.#.119.30':139
'19#.#.85.169':139
'19#.#.253.151':139
'19#.#.17.106':139
'19#.#.230.81':139
'19#.#.193.104':139
'19#.1.98.11':139
'19#.#.150.192':139
'19#.#.16.214':139
'19#.#.158.236':139
'19#.1.57.87':139
'19#.1.131.6':139
'19#.#.31.196':139
'19#.#.78.204':139
'19#.#.227.238':139
'19#.#.160.250':139
'19#.#.167.207':139
'19#.#.103.24':139
'19#.#.93.160':139
'19#.#.188.93':139
'19#.1.29.42':139
'19#.#.143.154':139
'19#.#.27.249':139
'19#.1.35.41':139
'19#.1.79.5':139
'19#.#.33.136':139
'19#.#.21.135':139
'19#.1.15.50':139
'19#.#.107.200':139
'19#.#.135.237':139
'19#.1.41.63':139
'19#.1.92.65':139
'19#.#.115.29':139
'19#.#.219.216':139
'19#.1.89.36':139
'19#.#.50.179':139
'19#.#.44.235':139
'19#.#.139.75':139
'19#.#.24.122':139
'19#.1.22.50':139
'19#.#.163.104':139
'19#.#.100.210':445
'19#.#.171.37':445
'19#.#.105.145':445
'19#.1.53.1':445
'19#.#.189.141':445
'19#.#.218.246':445
'19#.#.160.54':445
'19#.#.250.133':445
'19#.#.42.150':445
'19#.1.9.249':445
'19#.#.55.122':445
'19#.1.67.55':445
'19#.#.134.108':445
'19#.#.122.134':445
'19#.#.48.200':445
'19#.#.220.226':445
'19#.1.0.164':445
'19#.#.173.242':445
'19#.#.226.174':445
'19#.#.246.183':445
'19#.1.82.0':9988
'19#.#.134.108':9988
'19#.1.29.7':9988
'19#.1.60.41':9988
'19#.#.240.204':139
'19#.#.148.93':139
'19#.#.222.252':139
'19#.#.235.240':139
'19#.#.161.235':139
'19#.#.218.82':9988
'19#.#.105.183':445
'19#.1.19.35':9988
'19#.#.117.136':445
'19#.#.96.103':445
'19#.#.88.155':9988
'19#.#.86.154':9988
'19#.1.32.33':9988
'19#.#.155.84':9988
'19#.#.120.224':9988

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней