Trojan.DownLoader12.29214

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'12.##6.22.132':445
'12.##6.171.24':445
'12.##6.238.138':139
'12.##6.31.121':445
'12.##6.37.150':445
'12.##6.203.173':445
'12.##6.248.237':139
'12.##6.124.103':139
'12.##6.155.169':139
'12.##6.59.157':139
'12.##6.64.249':139
'12.##6.236.60':139
'12.##6.210.12':139
'12.##6.72.183':445
'12.##6.155.36':445
'12.##6.46.157':445
'12.##6.30.83':445
'12.##6.51.153':445
'12.##6.186.35':445
'12.##6.90.209':445
'12.##6.55.49':445
'12.##6.227.41':445
'12.##6.14.20':445
'12.##6.70.103':445
'12.##6.208.70':445
'12.##6.48.208':445
'12.##6.55.192':445
'12.##6.210.213':445
'12.##6.197.86':445
'12.##6.59.157':445
'12.##6.106.111':445
'12.##6.17.100':445
'12.##6.177.109':445
'12.##6.225.221':139
'12.##6.107.154':139
'12.##6.205.30':139
'12.##6.209.230':139
'12.##6.19.26':139
'12.##6.2.122':139
'12.##6.210.213':139
'12.##6.197.86':139
'12.##6.177.109':139
'12.##6.106.111':139
'12.##6.17.100':139
'12.##6.55.192':139
'12.##6.238.138':445
'12.##6.210.12':445
'12.##6.124.103':445
'12.##6.155.169':445
'12.##6.248.237':445
'12.##6.64.249':445
'12.##6.236.60':445
'12.##6.190.127':445
'12.##6.30.83':139
'12.##6.51.153':139
'12.##6.186.35':139
'12.##6.46.161':139
'12.##6.35.39':139
'12.##6.190.127':139
'12.##6.72.183':139
'12.##6.70.103':139
'12.##6.208.70':139
'12.##6.48.208':139
'12.##6.155.36':139
'12.##6.46.157':139
'12.##6.90.209':139
'12.##6.87.54':139
'12.##6.29.36':139
'12.##6.64.85':139
'12.##6.228.103':139
'12.##6.142.163':139
'12.##6.54.142':139
'12.##6.10.195':139
'12.##6.66.227':139
'12.##6.119.209':139
'12.##6.42.160':139
'12.##6.106.78':139
'12.##6.162.250':139
'12.##6.39.38':139
'12.##6.64.85':445
'12.##6.10.195':445
'12.##6.106.78':445
'12.##6.54.142':445
'12.##6.87.54':445
'12.##6.29.36':445
'12.##6.162.250':445
'12.##6.42.160':445
'12.##6.46.161':445
'12.##6.35.39':445
'12.##6.39.38':445
'12.##6.66.227':445
'12.##6.119.209':445
'12.##6.31.121':139
'12.##6.37.150':139
'12.##6.203.173':139
'12.##6.55.49':139
'12.##6.227.41':139
'12.##6.14.20':139
'12.##6.22.132':139
'12.##6.89.126':445
'12.##6.228.103':445
'12.##6.142.163':445
'12.##6.171.24':139
'12.##6.96.220':445
'12.##6.154.43':445
'12.##6.77.220':139
'12.##6.32.162':139
'12.##6.165.56':139
'12.##6.247.218':139
'12.##6.149.148':445
'12.##6.74.149':139
'12.##6.226.128':139
'12.##6.39.180':139
'12.##6.145.203':139
'12.##6.0.236':139
'12.##6.100.141':139
'12.##6.58.238':139
'12.##6.18.107':139
'12.##6.134.18':139
'12.#06.0.65':445
'12.##6.214.15':445
'12.##6.239.157':445
'12.##6.113.227':445
'12.##6.222.71':445
'12.##6.81.222':445
'12.##6.184.28':445
'12.##6.53.111':445
'12.##6.158.52':445
'12.##6.209.190':445
'12.##6.120.10':445
'12.##6.185.119':445
'12.##6.247.102':445
'12.##6.138.160':139
'12.##6.155.138':139
'12.##6.245.155':139
'12.##6.100.141':445
'12.##6.175.178':445
'12.##6.21.248':445
'12.##6.18.245':139
'12.##6.254.133':139
'12.##6.91.168':139
'12.##6.103.67':139
'12.##6.223.158':139
'12.##6.151.38':139
'12.##6.156.89':139
'12.##6.226.128':445
'12.##6.32.162':445
'12.##6.165.56':445
'12.##6.175.178':139
'12.##6.21.248':139
'12.##6.74.149':445
'12.##6.247.218':445
'12.##6.134.18':445
'12.##6.145.203':445
'12.##6.0.236':445
'12.##6.39.180':445
'12.##6.58.238':445
'12.##6.18.107':445
'12.##6.111.26':445
'12.##6.113.227':139
'12.##6.222.71':139
'12.##6.81.222':139
'12.##6.202.126':139
'12.##6.95.202':139
'12.##6.111.26':139
'12.#06.0.65':139
'12.##6.120.10':139
'12.##6.185.119':139
'12.##6.247.102':139
'12.##6.214.15':139
'12.##6.239.157':139
'12.##6.184.28':139
'12.##6.237.138':139
'12.##6.46.243':139
'12.##6.72.199':139
'12.##6.39.86':139
'12.##6.93.39':139
'12.##6.130.52':139
'12.##6.148.15':139
'12.##6.34.211':139
'12.##6.133.31':139
'12.##6.232.218':139
'12.##6.92.218':139
'12.##6.126.96':139
'12.##6.208.233':139
'12.##6.72.199':445
'12.##6.148.15':445
'12.##6.92.218':445
'12.##6.130.52':445
'12.##6.237.138':445
'12.##6.46.243':445
'12.##6.126.96':445
'12.##6.232.218':445
'12.##6.202.126':445
'12.##6.95.202':445
'12.##6.208.233':445
'12.##6.34.211':445
'12.##6.133.31':445
'12.##6.149.148':139
'12.##6.209.230':445
'12.##6.19.26':445
'12.##6.53.111':139
'12.##6.158.52':139
'12.##6.209.190':139
'12.##6.2.122':445
'12.##6.77.220':445
'12.##6.39.86':445
'12.##6.93.39':445
'12.##6.225.221':445
'12.##6.107.154':445
'12.##6.205.30':445
'12.##6.7.106':445
'12.##6.28.37':445
'12.##6.181.14':445
'12.##6.178.174':445
'12.##6.60.229':445
'12.##6.182.57':445
'12.##6.138.180':445
'12.##6.66.145':445
'12.##6.229.210':445
'12.##6.52.234':445
'12.##6.169.24':445
'12.##6.149.46':445
'12.##6.30.91':445
'12.##6.159.18':445
'12.##6.208.84':445
'12.##6.245.34':445
'12.##6.135.254':445
'12.##6.168.129':445
'12.##6.132.100':445
'12.##6.16.125':445
'12.##6.220.7':445
'12.##6.52.10':445
'12.##6.127.213':445
'12.##6.54.63':445
'12.#06.6.47':445
'12.##6.88.97':445
'12.##6.204.118':445
'12.##6.104.44':445
'12.##6.151.97':445
'12.##6.34.157':445
'12.##6.154.153':445
'12.##6.67.239':445
'12.##6.73.121':445
'12.##6.135.254':9988
'12.##6.168.129':9988
'12.##6.16.125':9988
'12.##6.4.150':445
'12.##6.123.159':445
'12.##6.97.18':445
'12.##6.192.78':445
'12.##6.99.245':445
'12.##6.236.144':445
'12.##6.106.113':445
'12.##6.251.80':445
'12.##6.78.180':445
'12.##6.19.20':445
'12.##6.165.88':445
'12.##6.62.195':445
'12.##6.157.155':445
'12.##6.54.75':445
'12.##6.5.239':445
'12.##6.119.243':445
'12.##6.34.132':445
'12.##6.60.229':139
'12.##6.182.57':139
'12.##6.7.106':139
'12.##6.220.7':139
'12.##6.127.213':139
'12.##6.178.174':139
'12.##6.28.37':139
'12.##6.149.46':139
'12.##6.30.91':139
'12.##6.66.145':139
'12.##6.181.14':139
'12.##6.138.180':139
'12.##6.169.24':139
'12.##6.135.254':139
'12.##6.132.100':139
'12.##6.159.18':139
'12.##6.208.84':139
'12.##6.34.132':139
'12.##6.202.115':139
'12.##6.245.34':139
'12.#06.6.47':139
'12.##6.88.97':139
'12.##6.52.10':139
'12.##6.168.129':139
'12.##6.16.125':139
'12.##6.54.63':139
'12.##6.154.153':139
'12.##6.67.239':139
'12.##6.204.118':139
'12.##6.165.88':139
'12.##6.157.155':139
'12.##6.34.157':139
'12.##6.104.44':139
'12.##6.123.159':139
'12.##6.97.18':139
'12.##6.202.115':445
'12.##6.151.97':139
'12.##6.73.121':139
'12.##6.4.150':139
'12.##6.251.80':139
'12.##6.78.180':139
'12.##6.192.78':139
'12.##6.52.234':139
'12.##6.229.210':139
'12.##6.106.113':139
'12.##6.99.245':139
'12.##6.5.239':139
'12.##6.119.243':139
'12.##6.62.195':139
'12.##6.236.144':139
'12.##6.19.20':139
'12.##6.54.75':139
'12.##6.178.174':9988
'12.##6.135.160':445
'12.##6.18.243':445
'12.##6.233.134':445
'12.##6.140.221':445
'12.##6.141.18':445
'12.##6.16.142':445
'12.##6.21.40':445
'12.##6.226.254':139
'12.#06.11.7':139
'12.##6.124.107':139
'12.##6.230.9':445
'12.##6.215.137':139
'12.##6.254.214':139
'12.##6.249.83':445
'12.##6.26.229':445
'12.##6.113.138':445
'12.##6.45.202':445
'12.##6.196.12':445
'12.##6.230.195':445
'12.##6.38.25':445
'12.##6.172.143':445
'12.##6.246.171':445
'12.##6.1.207':445
'12.##6.248.43':445
'12.##6.134.236':445
'12.##6.143.18':445
'12.##6.194.90':445
'12.#06.65.4':445
'12.##6.63.245':445
'12.##6.124.107':445
'12.##6.28.239':445
'12.##6.40.29':445
'12.##6.72.106':445
'12.##6.96.220':139
'12.##6.154.43':139
'12.##6.89.126':139
'12.##6.140.196':445
'12.##6.163.240':445
'12.##6.19.242':445
'12.#06.65.4':139
'12.##6.63.245':139
'12.##6.72.106':139
'12.##6.28.239':139
'12.##6.40.29':139
'12.##6.194.90':139
'12.##6.140.196':139
'12.##6.254.214':445
'12.##6.226.254':445
'12.#06.11.7':445
'12.##6.163.240':139
'12.##6.19.242':139
'12.##6.215.137':445
'12.##6.224.2':445
'12.#06.2.62':139
'12.##6.224.2':139
'12.##6.45.202':139
'12.##6.242.134':139
'12.#06.24.7':139
'12.##6.121.210':139
'12.##6.196.12':139
'12.##6.113.138':139
'12.##6.38.25':139
'12.##6.248.43':139
'12.##6.230.195':139
'12.##6.249.83':139
'12.##6.26.229':139
'12.##6.54.75':9988
'12.##6.104.202':139
'12.##6.15.105':139
'12.##6.182.57':9988
'12.##6.149.46':9988
'12.##6.192.78':9988
'12.##6.88.141':139
'12.##6.70.22':139
'12.##6.81.38':139
'12.##6.58.99':139
'12.##6.51.71':139
'12.##6.95.167':139
'12.##6.45.36':139
'12.##6.51.71':445
'12.##6.95.167':445
'12.##6.45.36':445
'12.##6.104.202':445
'12.##6.15.105':445
'12.##6.88.141':445
'12.##6.70.22':445
'12.#06.24.7':445
'12.##6.121.210':445
'12.#06.2.62':445
'12.##6.81.38':445
'12.##6.58.99':445
'12.##6.242.134':445
'12.##6.246.171':139
'12.##6.1.207':139
'12.##6.140.221':139
'12.##6.134.236':139
'12.##6.143.18':139
'12.##6.172.143':139
'12.##6.141.18':139
'12.##6.233.134':139
'12.##6.21.40':139
'12.##6.230.9':139
'12.##6.16.142':139
'12.##6.135.160':139
'12.##6.18.243':139

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней