Trojan.DownLoader12.29171

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER1614.dir00\svchost.exe.mdmp 16325836412029740

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1614.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'19#.#0.222.82':139
'19#.#0.51.94':139
'19#.#0.221.69':139
'19#.#0.188.234':139
'19#.#0.5.111':139
'19#.#0.120.53':139
'19#.#0.148.218':139
'19#.#0.20.106':139
'19#.#0.77.93':139
'19#.#0.33.221':139
'19#.#0.100.75':139
'19#.#0.188.89':139
'19#.#0.120.127':139
'19#.#0.75.179':445
'19#.#0.56.171':445
'19#.#0.103.119':445
'19#.#0.102.117':139
'19#.#0.189.94':139
'19#.#0.31.113':139
'19#.#0.94.189':139
'19#.#0.57.113':139
'19#.#0.5.111':445
'19#.#0.221.69':445
'19#.#0.188.234':445
'19#.#0.189.94':445
'19#.#0.100.75':445
'19#.#0.33.221':445
'19#.#0.20.106':445
'19#.#0.77.93':445
'19#.#0.222.82':445
'19#.#0.51.94':445
'19#.#0.102.117':445
'19#.#0.203.77':139
'19#.#0.50.203':139
'19#.#0.37.12':139
'19#.#0.33.143':139
'19#.#0.187.193':139
'19#.#0.57.113':445
'19#.#0.31.113':445
'19#.#0.94.189':445
'19#.#0.188.89':445
'19#.#0.120.127':445
'19#.#0.63.74':445
'19#.#0.63.74':139
'19#.#0.56.171':139
'19#.#0.39.121':139
'19#.#0.252.7':139
'19#.#0.241.251':139
'19#.#0.238.131':445
'19#.#0.210.163':445
'19#.#0.121.146':445
'19#.#0.103.119':139
'19#.#0.75.179':139
'19#.#0.119.62':139
'19#.#0.16.241':139
'19#.#0.131.190':139
'19#.#0.123.43':139
'19#.#0.93.198':139
'19#.#0.138.205':139
'19#.#0.227.254':139
'19#.#0.151.136':139
'19#.#0.142.196':139
'19#.#0.80.145':139
'19#.#0.3.250':139
'19#.#0.142.196':445
'19#.#0.227.254':445
'19#.#0.3.250':445
'19#.#0.131.190':445
'19#.#0.80.145':445
'19#.#0.241.251':445
'19#.#0.39.121':445
'19#.#0.252.7':445
'19#.#0.151.136':445
'19#.#0.119.62':445
'19#.#0.16.241':445
'19#.#0.44.129':445
'19#.#0.162.91':445
'19#.#0.159.227':445
'19#.#0.28.220':445
'19#.#0.33.118':445
'19#.#0.138.205':445
'19#.#0.123.43':445
'19#.#0.93.198':445
'19#.#0.141.188':445
'19#.#0.3.251':445
'19#.#0.120.53':445
'19#.#0.237.42':445
'19#.#0.155.35':445
'19#.#0.162.212':445
'19#.#0.190.94':445
'19#.#0.33.115':445
'19#.#0.101.216':139
'19#.#0.242.68':139
'19#.#0.50.144':445
'19#.#0.121.232':445
'19#.#0.17.185':445
'19#.#0.70.193':445
'19#.#0.33.139':445
'19#.#0.72.60':445
'19#.#0.100.210':445
'19#.#0.215.237':445
'19#.#0.140.189':445
'19#.#0.10.175':445
'19#.#0.248.10':445
'19#.#0.144.111':445
'19#.#0.192.11':445
'19#.#0.208.70':445
'19#.#0.201.142':139
'19#.#0.29.28':139
'19#.#0.143.85':139
'19#.#0.251.87':139
'19#.#0.61.168':139
'19#.#0.109.5':139
'19#.#0.24.109':139
'19#.70.5.89':139
'19#.#0.149.191':139
'19#.#0.88.141':139
'19#.#0.70.128':139
'19#.#0.37.39':139
'19#.#0.103.36':139
'19#.#0.251.115':139
'19#.#0.110.47':139
'19#.#0.166.140':139
'19#.#0.1.210':139
'19#.#0.38.34':139
'19#.#0.49.40':139
'19#.#0.128.102':139
'19#.#0.124.199':139
'19#.#0.237.127':445
'19#.#0.237.127':139
'19#.#0.215.237':139
'19#.#0.127.158':139
'19#.#0.178.160':139
'19#.#0.240.101':139
'19#.#0.72.60':139
'19#.#0.192.11':139
'19#.#0.33.139':139
'19#.#0.140.189':139
'19#.#0.100.210':139
'19#.#0.194.168':139
'19#.#0.37.12':445
'19#.#0.203.77':445
'19#.#0.187.193':445
'19#.#0.148.218':445
'19#.#0.33.143':445
'19#.#0.3.106':139
'19#.#0.89.113':139
'19#.#0.213.138':139
'19#.#0.50.203':445
'19#.70.72.8':139
'19#.#0.213.138':445
'19#.#0.3.106':445
'19#.70.72.8':445
'19#.#0.17.185':139
'19#.#0.50.144':139
'19#.#0.240.101':445
'19#.#0.127.158':445
'19#.#0.178.160':445
'19#.#0.89.113':445
'19#.#0.194.168':445
'19#.#0.121.232':139
'19#.#0.248.10':139
'19#.#0.70.193':139
'19#.#0.10.175':139
'19#.#0.208.70':139
'19#.#0.144.111':139
'19#.#0.237.42':139
'19#.#0.155.35':139
'19#.#0.162.212':139
'19#.#0.190.94':139
'19#.#0.33.115':139
'19#.#0.3.251':139
'19#.#0.56.145':445
'19#.#0.96.47':445
'19#.#0.194.190':445
'19#.#0.128.30':445
'19#.#0.63.54':445
'19#.#0.45.151':445
'19#.#0.165.230':445
'19#.#0.13.211':445
'19#.#0.79.133':445
'19#.#0.205.22':445
'19#.#0.12.48':445
'19#.#0.246.188':139
'19#.#0.61.110':139
'19#.#0.142.44':139
'19#.#0.107.33':139
'19#.#0.24.241':139
'19#.#0.139.153':445
'19#.#0.177.139':445
'19#.#0.133.45':139
'19#.#0.18.168':139
'19#.#0.226.18':139
'19#.#0.15.130':445
'19#.#0.166.20':445
'19#.#0.130.211':445
'19#.#0.121.235':445
'19#.#0.67.206':445
'19#.#0.150.22':445
'19#.#0.56.164':445
'19#.#0.95.187':445
'19#.#0.198.55':445
'19#.70.28.0':445
'19#.#0.221.178':445
'19#.#0.241.17':445
'19#.#0.81.41':445
'19#.#0.110.166':445
'19#.#0.58.49':445
'19#.#0.36.94':445
'19#.#0.69.243':445
'19#.#0.19.157':445
'19#.#0.159.148':445
'19#.#0.168.80':445
'19#.#0.176.32':445
'19#.#0.146.251':139
'19#.#0.36.94':139
'19#.#0.110.166':139
'19#.#0.58.49':139
'19#.#0.45.151':139
'19#.#0.165.230':139
'19#.#0.176.32':139
'19#.#0.159.148':139
'19#.#0.168.80':139
'19#.#0.241.17':139
'19#.#0.81.41':139
'19#.#0.13.211':139
'19#.#0.128.30':139
'19#.#0.63.54':139
'19#.#0.12.48':139
'19#.#0.139.153':139
'19#.#0.177.139':139
'19#.#0.79.133':139
'19#.#0.205.22':139
'19#.#0.96.47':139
'19#.#0.194.190':139
'19#.#0.56.145':139
'19#.#0.168.189':139
'19#.#0.55.153':139
'19#.70.4.33':139
'19#.#0.150.22':139
'19#.#0.56.164':139
'19#.#0.225.82':139
'19#.#0.251.193':139
'19#.#0.179.62':139
'19#.#0.158.134':139
'19#.#0.169.176':139
'19#.#0.95.187':139
'19#.#0.121.235':139
'19#.#0.67.206':139
'19#.#0.221.178':139
'19#.#0.69.243':139
'19#.#0.19.157':139
'19#.#0.198.55':139
'19#.70.28.0':139
'19#.#0.166.20':139
'19#.#0.130.211':139
'19#.#0.15.130':139
'19#.70.4.33':445
'19#.#0.90.52':445
'19#.#0.73.85':445
'19#.#0.56.155':445
'19#.#0.64.221':445
'19#.#0.71.58':445
'19#.#0.154.212':445
'19#.#0.103.190':445
'19#.#0.106.53':445
'19#.70.8.98':445
'19#.#0.145.138':445
'19#.#0.217.122':445
'19#.#0.21.59':139
'19#.#0.241.247':139
'19#.#0.20.149':139
'19#.#0.243.237':139
'19#.#0.138.96':139
'19#.#0.243.210':139
'19#.#0.86.198':139
'19#.#0.61.32':139
'19#.#0.179.117':139
'19#.#0.32.79':139
'19#.#0.210.163':139
'19#.#0.28.220':139
'19#.#0.238.131':139
'19#.#0.86.198':445
'19#.#0.121.146':139
'19#.#0.162.91':139
'19#.#0.141.188':139
'19#.#0.44.129':139
'19#.#0.33.118':139
'19#.#0.159.227':139
'19#.#0.243.210':445
'19#.#0.138.96':445
'19#.#0.20.149':445
'19#.#0.243.237':445
'19#.#0.254.102':445
'19#.#0.57.111':445
'19#.#0.32.79':445
'19#.#0.61.32':445
'19#.#0.179.117':445
'19#.#0.21.59':445
'19#.#0.241.247':445
'19#.#0.57.111':139
'19#.#0.226.18':445
'19#.#0.133.45':445
'19#.#0.18.168':445
'19#.#0.246.188':445
'19#.#0.61.110':445
'19#.#0.177.139':9988
'19#.#0.63.54':9988
'19#.#0.128.30':9988
'19#.#0.139.153':9988
'19#.#0.12.48':9988
'19#.#0.142.44':445
'19#.#0.169.176':445
'19#.#0.179.62':445
'19#.#0.158.134':445
'19#.#0.168.189':445
'19#.#0.55.153':445
'19#.#0.107.33':445
'19#.#0.24.241':445
'19#.#0.146.251':445
'19#.#0.225.82':445
'19#.#0.251.193':445
'19#.#0.73.85':139
'19#.70.8.98':139
'19#.#0.90.52':139
'19#.#0.71.58':139
'19#.#0.56.155':139
'19#.#0.103.190':139
'19#.#0.254.102':139
'19#.#0.154.212':139
'19#.#0.145.138':139
'19#.#0.106.53':139
'19#.#0.64.221':139
'19#.#0.165.230':9988
'19#.#0.58.49':9988
'19#.#0.96.47':9988
'19#.#0.194.190':9988
'19#.#0.56.145':9988
'19#.#0.150.22':9988
'19#.#0.217.122':139
'19#.#0.67.206':9988
'19#.#0.241.17':9988
'19#.#0.168.80':9988

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней