Trojan.DownLoader10.7558

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERfdbc.dir00\svchost.exe.mdmp 16325836412033072

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe

Deletes itself.

Network activity:

Connects to:

'12#.#68.16.170':139
'12#.#68.170.78':139
'12#.#68.133.65':139
'12#.#68.237.15':139
'12#.#68.43.37':445
'12#.#68.73.42':445
'12#.#68.78.130':445
'12#.#68.18.204':445
'12#.#68.156.181':139
'12#.#68.48.241':139
'12#.168.5.0':139
'12#.#68.243.10':139
'12#.#68.38.220':139
'12#.#68.97.61':445
'12#.#68.97.61':139
'12#.#68.112.228':139
'12#.#68.25.249':139
'12#.#68.97.154':445
'12#.#68.17.224':445
'12#.#68.134.233':445
'12#.#68.150.121':445
'12#.#68.98.146':445
'12#.#68.36.110':445
'12#.#68.6.147':445
'12#.#68.243.97':445
'12#.#68.19.84':445
'12#.#68.107.157':445
'12#.#68.88.204':445
'12#.#68.247.141':445
'12#.#68.158.239':445
'12#.#68.114.80':445
'12#.#68.254.77':445
'12#.#68.139.222':445
'12#.#68.136.104':445
'12#.#68.54.134':139
'12#.#68.54.134':445
'12#.#68.243.10':445
'12#.#68.51.61':445
'12#.#68.81.224':445
'12#.168.5.0':445
'12#.#68.112.228':445
'12#.#68.38.220':445
'12#.#68.48.241':445
'12#.#68.125.225':445
'12#.#68.144.172':445
'12#.#68.155.239':445
'12#.#68.252.243':139
'12#.#68.215.239':445
'12#.#68.117.214':445
'12#.#68.254.125':445
'12#.#68.82.214':445
'12#.#68.29.7':445
'12#.#68.124.29':139
'12#.#68.254.125':139
'12#.#68.164.134':139
'12#.#68.117.214':139
'12#.#68.51.61':139
'12#.#68.81.224':139
'12#.#68.126.100':139
'12#.#68.125.225':139
'12#.#68.164.134':445
'12#.#68.215.239':139
'12#.#68.144.172':139
'12#.#68.156.181':445
'12#.#68.170.78':445
'12#.#68.29.7':139
'12#.#68.86.3':139
'12#.#68.155.239':139
'12#.#68.82.214':139
'12#.#68.211.88':445
'12#.#68.235.28':445
'12#.#68.158.152':445
'12#.#68.152.131':445
'12#.#68.132.99':445
'12#.#68.145.37':445
'12#.#68.8.63':445
'12#.#68.219.16':445
'12#.#68.65.80':445
'12#.#68.158.3':445
'12#.#68.50.32':445
'12#.#68.31.66':139
'12#.#68.251.133':139
'12#.#68.154.77':445
'12#.#68.77.234':445
'12#.#68.67.83':445
'12#.#68.228.5':445
'12#.#68.126.52':139
'12#.#68.154.77':139
'12#.#68.151.182':139
'12#.#68.126.52':445
'12#.#68.65.80':139
'12#.#68.136.250':139
'12#.#68.77.234':139
'12#.#68.136.250':445
'12#.#68.228.5':139
'12#.#68.48.223':445
'12#.#68.45.16':445
'12#.#68.76.145':445
'12#.#68.174.137':445
'12#.#68.67.83':139
'12#.#68.94.189':139
'12#.#68.158.3':139
'12#.#68.50.32':139
'12#.#68.18.143':139
'12#.#68.124.21':445
'12#.#68.21.30':139
'12#.#68.247.141':139
'12#.#68.158.239':139
'12#.#68.139.222':139
'12#.#68.95.244':445
'12#.#68.107.157':139
'12#.#68.88.204':139
'12#.#68.73.42':139
'12#.#68.18.143':445
'12#.#68.251.133':445
'12#.#68.105.200':445
'12#.#68.62.60':445
'12#.#68.43.37':139
'12#.#68.80.121':139
'12#.#68.78.130':139
'12#.#68.18.204':139
'12#.#68.6.147':139
'12#.#68.243.97':139
'12#.#68.97.154':139
'12#.#68.17.224':139
'12#.#68.105.200':139
'12#.#68.62.60':139
'12#.#68.98.146':139
'12#.#68.36.110':139
'12#.#68.150.121':139
'12#.#68.114.80':139
'12#.#68.254.77':139
'12#.#68.95.244':139
'12#.#68.136.104':139
'12#.#68.134.233':139
'12#.#68.128.69':139
'12#.#68.26.169':139
'12#.#68.19.84':139
'12#.#68.207.192':445
'12#.#68.174.54':445
'12#.#68.126.170':445
'12#.#68.88.24':445
'12#.#68.5.43':445
'12#.#68.55.179':445
'12#.#68.177.47':445
'12#.#68.173.235':445
'12#.#68.116.126':445
'12#.#68.93.46':139
'12#.#68.46.189':139
'12#.#68.126.27':139
'12#.#68.186.10':139
'12#.#68.34.135':445
'12#.#68.197.33':445
'12#.#68.189.170':139
'12#.#68.163.170':139
'12#.#68.37.103':139
'12#.#68.206.240':445
'12#.#68.207.192':139
'12#.#68.174.54':139
'12#.#68.173.235':139
'12#.#68.111.197':139
'12#.#68.206.240':139
'12#.#68.177.47':139
'12#.#68.88.24':139
'12#.#68.191.224':139
'12#.#68.32.55':139
'12#.#68.34.135':139
'12#.#68.191.224':445
'12#.#68.116.126':139
'12#.#68.126.170':139
'12#.#68.197.33':139
'12#.#68.110.240':139
'12#.#68.141.193':139
'12#.#68.252.144':139
'12#.#68.240.245':139
'12#.#68.231.75':139
'12#.#68.22.211':139
'12#.#68.29.98':139
'12#.#68.109.197':139
'12#.#68.168.253':139
'12#.#68.203.44':139
'12#.#68.254.254':139
'12#.#68.29.118':139
'12#.#68.159.223':139
'12#.#68.4.12':139
'12#.#68.236.237':139
'12#.#68.30.101':139
'12#.#68.50.11':139
'12#.#68.71.108':139
'12#.#68.250.187':139
'12#.#68.187.24':139
'12#.#68.1.240':139
'12#.#68.42.159':139
'12#.#68.97.212':139
'12#.#68.12.214':139
'12#.#68.107.108':139
'12#.#68.195.224':139
'12#.#68.196.196':139
'12#.#68.103.54':139
'12#.#68.233.27':139
'12#.#68.252.130':139
'12#.#68.109.24':139
'12#.#68.23.242':139
'12#.#68.10.116':139
'12#.#68.73.103':139
'12#.#68.123.186':139
'12#.#68.4.133':139
'12#.#68.165.18':139
'12#.#68.181.215':139
'12#.#68.222.144':139
'12#.#68.15.131':139
'12#.#68.102.1':139
'12#.#68.81.13':139
'12#.#68.30.103':139
'12#.#68.16.54':139
'12#.#68.218.16':139
'12#.#68.136.14':139
'12#.#68.68.11':139
'12#.#68.252.243':445
'12#.#68.64.41':139
'12#.#68.65.30':139
'12#.#68.79.77':139
'12#.#68.11.214':139
'12#.#68.132.131':139
'12#.#68.196.133':139
'12#.#68.175.214':139
'12#.#68.241.143':139
'12#.#68.143.183':139
'12#.#68.136.2':139
'12#.#68.173.114':139
'12#.#68.22.108':139
'12#.#68.182.151':139
'12#.#68.91.241':139
'12#.#68.142.134':139
'12#.#68.134.187':139
'12#.#68.217.24':139
'12#.#68.43.143':139
'12#.#68.141.224':139
'12#.#68.76.121':139
'12#.#68.187.246':139
'12#.#68.133.116':139
'12#.#68.173.114':445
'12#.#68.15.131':445
'12#.#68.165.18':445
'12#.#68.218.16':445
'12#.#68.222.144':445
'12#.#68.16.54':445
'12#.#68.102.1':445
'12#.#68.181.215':445
'12#.#68.30.103':445
'12#.#68.79.77':445
'12#.#68.64.41':445
'12#.#68.136.14':445
'12#.#68.5.43':139
'12#.#68.55.179':139
'12#.#68.132.131':445
'12#.#68.65.30':445
'12#.#68.68.11':445
'12#.#68.11.214':445
'12#.#68.143.183':445
'12#.#68.196.133':445
'12#.#68.91.241':445
'12#.#68.241.143':445
'12#.#68.182.151':445
'12#.#68.136.2':445
'12#.#68.175.214':445
'12#.#68.22.108':445
'12#.#68.76.121':445
'12#.#68.43.143':445
'12#.#68.142.134':445
'12#.#68.81.13':445
'12#.#68.217.24':445
'12#.#68.133.116':445
'12#.#68.141.224':445
'12#.#68.134.187':445
'12#.#68.187.246':445
'12#.#68.137.234':445
'12#.#68.43.128':445
'12#.#68.80.42':445
'12#.#68.79.110':445
'12#.#68.21.72':445
'12#.#68.130.136':445
'12#.#68.135.95':445
'12#.#68.128.212':445
'12#.#68.59.216':445
'12#.#68.8.90':445
'12#.#68.181.140':445
'12#.#68.18.206':9988
'12#.#68.142.18':445
'12#.#68.24.254':445
'12#.#68.109.70':445
'12#.#68.140.64':445
'12#.#68.142.61':445
'12#.#68.90.54':445
'12#.#68.46.212':445
'12#.#68.185.157':445
'12#.#68.157.169':445
'12#.#68.40.215':445
'12#.#68.30.226':445
'12#.#68.211.247':445
'12#.#68.248.5':445
'12#.#68.190.18':445
'12#.#68.62.39':445
'12#.#68.199.11':445
'12#.#68.137.107':445
'12#.#68.130.29':445
'12#.#68.95.97':445
'12#.#68.196.240':445
'12#.#68.221.237':445
'12#.#68.241.178':445
'12#.#68.216.14':9988
'12#.#68.133.21':139
'12#.#68.79.102':139
'12#.#68.32.249':139
'12#.#68.80.87':445
'12#.#68.220.52':445
'12#.#68.220.52':139
'12#.#68.80.87':139
'12#.#68.87.157':139
'12#.#68.128.9':139
'12#.#68.11.51':139
'12#.#68.91.155':139
'12#.#68.222.111':139
'12#.#68.132.71':139
'12#.#68.24.73':139
'12#.#68.5.231':139
'12#.#68.188.79':139
'12#.#68.88.230':139
'12#.#68.190.18':9988
'12#.#68.157.169':9988
'12#.#68.62.39':9988
'12#.#68.196.240':9988
'12#.#68.211.247':9988
'12#.#68.192.84':9988
'12#.#68.90.54':9988
'12#.#68.46.212':9988
'12#.#68.135.95':9988
'12#.#68.36.76':9988
'12#.#68.37.160':9988
'12#.#68.87.142':139
'12#.#68.142.18':9988
'12#.#68.137.234':9988
'12#.#68.43.128':9988
'12#.#68.59.216':9988
'12#.#68.79.110':9988
'12#.#68.46.212':139
'12#.#68.211.247':139
'12#.#68.157.169':139
'12#.#68.90.54':139
'12#.#68.30.226':139
'12#.#68.37.160':139
'12#.#68.248.5':139
'12#.#68.40.215':139
'12#.#68.185.157':139
'12#.#68.199.11':139
'12#.#68.221.237':139
'12#.#68.130.29':139
'12#.#68.62.39':139
'12#.#68.196.240':139
'12#.#68.190.18':139
'12#.#68.241.178':139
'12#.#68.95.97':139
'12#.#68.199.213':139
'12#.#68.42.108':139
'12#.#68.18.72':139
'12#.#68.18.206':139
'12#.#68.36.76':139
'12#.#68.216.14':139
'12#.#68.91.41':139
'12#.#68.141.135':139
'12#.#68.193.17':139
'12#.#68.2.58':139
'12#.#68.94.208':139
'12#.#68.192.84':139
'12#.#68.63.182':139
'12#.#68.47.233':139
'12#.#68.38.215':139
'12#.#68.76.51':139
'12#.#68.51.48':139
'12#.#68.137.107':139
'12#.#68.18.206':445
'12#.#68.199.213':445
'12#.#68.193.17':445
'12#.#68.18.72':445
'12#.#68.91.41':445
'12#.#68.141.135':445
'12#.#68.42.108':445
'12#.#68.36.76':445
'12#.#68.38.215':445
'12#.#68.63.182':445
'12#.#68.2.58':445
'12#.#68.37.160':445
'12#.#68.192.84':445
'12#.#68.51.48':445
'12#.#68.47.233':445
'12#.#68.94.208':445
'12#.#68.76.51':445
'12#.#68.137.234':139
'12#.#68.43.128':139
'12#.#68.80.42':139
'12#.#68.79.110':139
'12#.#68.21.72':139
'12#.#68.130.136':139
'12#.#68.135.95':139
'12#.#68.128.212':139
'12#.#68.59.216':139
'12#.#68.8.90':139
'12#.#68.181.140':139
'12#.#68.216.14':445
'12#.#68.142.18':139
'12#.#68.24.254':139
'12#.#68.109.70':139
'12#.#68.140.64':139
'12#.#68.142.61':139
'12#.#68.254.180':139
'12#.#68.24.132':139
'12#.#68.140.123':139
'12#.#68.111.194':139
'12#.#68.98.53':139
'12#.#68.72.181':445
'12#.#68.112.115':139
'12#.#68.119.98':139
'12#.#68.115.5':139
'12#.#68.140.1':139
'12#.#68.123.222':139
'12#.#68.194.148':445
'12#.#68.20.95':445
'12#.#68.177.181':139
'12#.#68.8.51':139
'12#.#68.216.178':139
'12#.#68.144.87':139
'12#.#68.115.227':139
'12#.#68.56.93':139
'12#.#68.135.147':139
'12#.#68.217.113':139
'12#.#68.20.95':139
'12#.#68.192.188':445
'12#.#68.194.148':139
'12#.#68.58.76':139
'12#.#68.229.54':139
'12#.#68.147.80':445
'12#.#68.147.80':139
'12#.#68.72.181':139
'12#.#68.55.0':139
'12#.#68.87.42':139
'12#.#68.216.130':139
'12#.#68.130.78':139
'12#.#68.243.1':139
'12#.#68.56.93':445
'12#.#68.136.95':139
'12#.#68.244.136':445
'12#.#68.11.101':139
'12#.#68.76.145':139
'12#.#68.173.166':445
'12#.#68.48.223':139
'12#.#68.244.136':139
'12#.#68.174.137':139
'12#.#68.145.37':139
'12#.#68.152.131':139
'12#.#68.211.88':139
'12#.#68.16.44':139
'12#.#68.158.152':139
'12#.#68.219.16':139
'12#.#68.132.99':139
'12#.#68.235.28':139
'12#.#68.8.63':139
'12#.#68.130.78':445
'12#.#68.243.1':445
'12#.#68.98.53':445
'12#.#68.55.0':445
'12#.#68.217.113':445
'12#.#68.115.227':445
'12#.#68.87.42':445
'12#.#68.229.54':445
'12#.#68.119.98':445
'12#.#68.144.87':445
'12#.#68.216.178':445
'12#.#68.45.16':139
'12#.#68.140.1':445
'12#.#68.24.132':445
'12#.#68.112.115':445
'12#.#68.177.181':445
'12#.#68.111.194':445
'12#.#68.24.73':445
'12#.#68.128.9':445
'12#.#68.91.155':445
'12#.#68.88.230':445
'12#.#68.87.157':445
'12#.#68.87.142':445
'12#.#68.32.249':445
'12#.#68.79.102':445
'12#.#68.5.231':445
'12#.#68.183.173':445
'12#.#68.110.130':445
'12#.#68.235.20':445
'12#.#68.178.56':445
'12#.#68.132.71':445
'12#.#68.11.51':445
'12#.#68.72.131':445
'12#.#68.222.111':445
'12#.#68.176.166':139
'12#.#68.76.30':139
'12#.#68.235.20':139
'12#.#68.76.30':445
'12#.#68.72.131':139
'12#.#68.110.130':139
'12#.#68.178.56':139
'12#.#68.183.173':139
'12#.#68.176.166':445
'12#.#68.224.178':445
'12#.#68.171.229':139
'12#.#68.242.69':139
'12#.#68.69.191':139
'12#.#68.205.188':139
'12#.#68.223.234':139
'12#.#68.224.178':139
'12#.#68.55.176':139
'12#.#68.205.188':445
'12#.#68.175.241':445
'12#.#68.192.188':139
'12#.#68.159.214':445
'12#.#68.118.176':445
'12#.#68.8.220':139
'12#.#68.20.202':139
'12#.#68.138.140':139
'12#.#68.118.39':139
'12#.#68.88.66':445
'12#.#68.46.181':445
'12#.#68.219.195':445
'12#.#68.8.220':445
'12#.#68.20.202':445
'12#.#68.97.224':445
'12#.#68.126.223':445
'12#.#68.45.229':445
'12#.168.6.1':445
'12#.#68.159.214':139
'12#.#68.118.176':139
'12#.#68.88.66':139
'12#.#68.159.185':139
'12#.#68.69.191':445
'12#.#68.55.176':445
'12#.#68.175.241':139
'12#.#68.242.69':445
'12#.#68.126.223':139
'12#.#68.195.45':139
'12#.#68.45.229':139
'12#.#68.46.181':139
'12#.#68.219.195':139
'12#.#68.63.164':139
'12#.#68.97.224':139
'12#.168.6.1':139
'12#.#68.63.164':445

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial