Trojan.DownLoader12.29245

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2856.dir00\svchost.exe.mdmp 16325836412032288

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2856.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'14.##1.238.183':139
'14.##1.20.128':139
'14.##1.183.239':139
'14.##1.31.244':139
'14.##1.81.222':139
'14.##1.89.187':139
'14.##1.180.156':139
'14.##1.115.19':139
'14.##1.212.246':139
'14.##1.210.85':139
'14.##1.152.135':139
'14.##1.12.99':445
'14.##1.226.12':445
'14.##1.224.60':445
'14.#01.4.87':445
'14.##1.189.158':445
'14.##1.132.38':139
'14.##1.149.112':139
'14.##1.65.232':139
'14.##1.8.226':445
'14.##1.164.9':139
'14.##1.212.246':445
'14.##1.210.85':445
'14.##1.20.128':445
'14.##1.183.239':445
'14.##1.238.183':445
'14.##1.222.34':445
'14.##1.17.58':445
'14.##1.180.156':445
'14.##1.115.19':445
'14.##1.89.187':445
'14.##1.81.222':445
'14.##1.21.178':139
'14.##1.164.9':445
'14.##1.152.41':139
'14.##1.222.34':139
'14.##1.17.58':139
'14.##1.152.135':445
'14.##1.31.244':445
'14.##1.149.112':445
'14.##1.65.232':445
'14.##1.132.38':445
'14.##1.93.146':445
'14.##1.12.99':139
'14.##1.226.12':139
'14.##1.224.60':139
'14.#01.4.87':139
'14.##1.189.158':139
'14.##1.216.62':445
'14.##1.88.211':445
'14.##1.168.128':445
'14.##1.8.226':139
'14.##1.9.249':445
'14.##1.93.146':139
'14.##1.185.83':139
'14.##1.111.185':139
'14.##1.83.74':139
'14.##1.89.15':139
'14.##1.74.89':139
'14.##1.157.120':139
'14.##1.140.29':139
'14.##1.151.220':139
'14.##1.162.153':139
'14.##1.11.117':139
'14.##1.185.83':445
'14.##1.111.185':445
'14.##1.83.74':445
'14.##1.89.15':445
'14.##1.74.89':445
'14.##1.157.120':445
'14.##1.140.29':445
'14.##1.151.220':445
'14.##1.162.153':445
'14.##1.11.117':445
'14.##1.131.8':445
'14.##1.111.6':445
'14.##1.78.26':445
'14.##1.141.99':445
'14.##1.15.88':445
'14.##1.45.16':445
'14.##1.87.95':445
'14.##1.145.194':445
'14.##1.40.240':445
'14.##1.238.88':445
'14.##1.240.237':445
'14.##1.144.165':445
'14.##1.182.227':445
'14.##1.47.152':445
'14.#01.18.0':445
'14.##1.55.151':445
'14.##1.243.189':445
'14.#01.1.28':445
'14.##1.55.16':445
'14.##1.110.48':445
'14.##1.96.97':445
'14.##1.98.222':445
'14.#01.2.53':445
'14.##1.54.19':445
'14.##1.131.129':445
'14.##1.63.64':445
'14.##1.136.218':445
'14.##1.143.69':445
'14.##1.132.142':445
'14.##1.208.118':445
'14.##1.99.54':445
'14.##1.67.99':445
'14.##1.33.69':139
'14.##1.205.184':139
'14.##1.171.161':139
'14.##1.108.88':139
'14.##1.162.35':139
'14.##1.156.9':139
'14.##1.77.72':139
'14.##1.0.171':139
'14.##1.145.53':139
'14.##1.109.61':139
'14.##1.175.0':139
'14.##1.124.163':139
'14.##1.29.153':139
'14.##1.82.14':139
'14.##1.122.110':445
'14.##1.14.241':445
'14.##1.39.37':139
'14.##1.169.39':139
'14.#01.95.5':139
'14.##1.76.29':139
'14.##1.191.76':139
'14.##1.154.249':445
'14.#01.2.53':139
'14.##1.54.19':139
'14.##1.131.129':139
'14.##1.63.64':139
'14.##1.136.218':139
'14.##1.143.69':139
'14.##1.132.142':139
'14.##1.208.118':139
'14.##1.99.54':139
'14.##1.67.99':139
'14.##1.154.249':139
'14.##1.112.205':139
'14.#01.8.85':139
'14.##1.212.90':139
'14.##1.152.41':445
'14.##1.21.178':445
'14.##1.131.47':139
'14.##1.116.186':139
'14.##1.100.30':139
'14.##1.34.180':139
'14.##1.206.172':139
'14.##1.112.205':445
'14.#01.8.85':445
'14.##1.212.90':445
'14.##1.122.110':139
'14.##1.14.241':139
'14.##1.131.47':445
'14.##1.116.186':445
'14.##1.100.30':445
'14.##1.34.180':445
'14.##1.206.172':445
'14.#01.1.28':139
'14.##1.47.152':139
'14.##1.144.165':139
'14.##1.55.151':139
'14.##1.98.222':139
'14.#01.18.0':139
'14.##1.55.16':139
'14.##1.243.189':139
'14.##1.96.97':139
'14.##1.182.227':139
'14.##1.110.48':139
'14.##1.131.8':139
'14.##1.172.215':445
'14.##1.178.172':445
'14.##1.215.1':445
'14.##1.226.167':445
'14.##1.88.21':445
'14.##1.68.197':445
'14.##1.255.68':445
'14.##1.194.207':445
'14.##1.34.178':445
'14.##1.215.205':445
'14.#01.2.88':445
'14.##1.244.186':139
'14.##1.74.245':139
'14.##1.54.35':139
'14.##1.227.14':139
'14.##1.86.199':139
'14.##1.20.230':445
'14.##1.51.108':445
'14.##1.142.4':139
'14.##1.87.49':139
'14.##1.155.130':139
'14.##1.5.190':445
'14.##1.120.200':445
'14.##1.34.122':445
'14.##1.128.214':445
'14.##1.181.174':445
'14.##1.54.198':445
'14.##1.210.228':445
'14.##1.52.214':445
'14.##1.70.77':445
'14.##1.168.15':445
'14.##1.214.246':445
'14.#01.7.17':445
'14.##1.113.212':445
'14.#01.99.3':445
'14.##1.97.122':445
'14.##1.3.230':445
'14.##1.48.215':445
'14.##1.149.51':445
'14.##1.191.66':445
'14.##1.2.235':445
'14.##1.118.73':445
'14.##1.185.99':139
'14.##1.3.230':139
'14.#01.99.3':139
'14.##1.97.122':139
'14.##1.68.197':139
'14.##1.255.68':139
'14.##1.118.73':139
'14.##1.191.66':139
'14.##1.2.235':139
'14.#01.7.17':139
'14.##1.113.212':139
'14.##1.194.207':139
'14.##1.20.230':139
'14.#01.2.88':139
'14.##1.226.167':139
'14.##1.88.21':139
'14.##1.51.108':139
'14.##1.34.178':139
'14.##1.215.205':139
'14.##1.178.172':139
'14.##1.215.1':139
'14.##1.172.215':139
'14.##1.118.244':139
'14.##1.76.214':139
'14.##1.199.67':139
'14.##1.54.198':139
'14.##1.210.228':139
'14.##1.201.41':139
'14.##1.89.59':139
'14.##1.133.65':139
'14.##1.101.205':139
'14.##1.142.74':139
'14.##1.52.214':139
'14.##1.128.214':139
'14.##1.181.174':139
'14.##1.214.246':139
'14.##1.48.215':139
'14.##1.149.51':139
'14.##1.70.77':139
'14.##1.168.15':139
'14.##1.120.200':139
'14.##1.34.122':139
'14.##1.5.190':139
'14.##1.67.15':445
'14.##1.103.52':445
'14.##1.197.19':445
'14.##1.243.12':445
'14.##1.191.97':445
'14.##1.95.131':445
'14.##1.46.102':445
'14.##1.18.29':445
'14.##1.137.220':445
'14.##1.104.20':445
'14.##1.12.173':445
'14.##1.247.64':139
'14.##1.192.178':139
'14.##1.82.184':139
'14.##1.95.131':139
'14.##1.46.102':139
'14.##1.124.239':139
'14.##1.224.251':445
'14.##1.239.46':139
'14.##1.133.31':139
'14.##1.46.133':139
'14.##1.111.6':139
'14.##1.78.26':139
'14.##1.141.99':139
'14.##1.15.88':139
'14.##1.45.16':139
'14.##1.87.95':139
'14.##1.145.194':139
'14.##1.40.240':139
'14.##1.238.88':139
'14.##1.240.237':139
'14.##1.88.211':139
'14.##1.133.31':445
'14.##1.46.133':445
'14.##1.192.178':445
'14.##1.82.184':445
'14.##1.247.64':445
'14.##1.168.128':139
'14.##1.216.62':139
'14.##1.9.249':139
'14.##1.239.46':445
'14.##1.124.239':445
'14.##1.18.29':139
'14.##1.87.49':445
'14.##1.155.130':445
'14.##1.74.245':445
'14.##1.54.35':445
'14.##1.244.186':445
'14.##1.178.172':9988
'14.##1.215.205':9988
'14.##1.88.21':9988
'14.##1.142.4':445
'14.#01.2.88':9988
'14.##1.86.199':445
'14.##1.101.205':445
'14.##1.142.74':445
'14.##1.76.214':445
'14.##1.199.67':445
'14.##1.118.244':445
'14.##1.185.99':445
'14.##1.227.14':445
'14.##1.89.59':445
'14.##1.133.65':445
'14.##1.201.41':445
'14.##1.243.12':139
'14.##1.191.97':139
'14.##1.12.173':139
'14.##1.70.77':9988
'14.##1.224.251':139
'14.##1.137.220':139
'14.##1.104.20':139
'14.##1.103.52':139
'14.##1.197.19':139
'14.##1.67.15':139
'14.##1.5.190':9988
'14.##1.97.122':9988
'14.##1.113.212':9988
'14.##1.255.68':9988
'14.##1.194.207':9988
'14.##1.68.197':9988
'14.##1.128.214':9988
'14.##1.181.174':9988
'14.##1.191.66':9988
'14.##1.2.235':9988
'14.##1.118.73':9988

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial