Trojan.Packed.30134

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER398d.dir00\svchost.exe.mdmp 16325836412032304

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER398d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'21#.#88.246.197':139
'21#.#88.60.48':139
'21#.#88.212.133':139
'21#.#88.68.56':139
'21#.#88.211.67':139
'21#.#88.21.146':139
'21#.#88.247.158':139
'21#.#88.189.164':139
'21#.#88.181.97':139
'21#.#88.165.99':139
'21#.#88.56.30':139
'21#.#88.117.118':139
'21#.#88.172.12':139
'21#.#88.165.177':139
'21#.#88.93.22':139
'21#.#88.177.183':139
'21#.#88.201.38':139
'21#.#88.100.220':139
'21#.#88.141.142':139
'21#.#88.43.116':139
'21#.#88.6.127':139
'21#.#88.248.197':139
'21#.#88.141.142':445
'21#.#88.201.38':445
'21#.#88.6.127':445
'21#.#88.172.12':445
'21#.#88.43.116':445
'21#.#88.211.67':445
'21#.#88.212.133':445
'21#.#88.68.56':445
'21#.#88.100.220':445
'21#.#88.56.30':445
'21#.#88.117.118':445
'21#.#88.17.232':139
'21#.#88.118.129':139
'21#.#88.40.219':139
'21#.#88.97.5':139
'21#.#88.2.223':139
'21#.#88.177.183':445
'21#.#88.165.177':445
'21#.#88.93.22':445
'21#.#88.18.198':139
'21#.#88.39.101':445
'21#.#88.103.140':139
'21#.#88.98.212':139
'21#.#88.132.144':139
'21#.#88.47.202':139
'21#.#88.145.47':139
'21#.#88.198.141':139
'21#.#88.166.197':445
'21#.#88.8.245':139
'21#.#88.128.233':139
'21#.#88.138.134':139
'21#.#88.202.2':139
'21#.#88.202.197':139
'21#.#88.80.20':139
'21#.#88.36.99':139
'21#.#88.98.171':139
'21#.#88.78.216':139
'21#.#88.3.157':139
'21#.#88.105.122':139
'21#.#88.62.68':139
'21#.#88.109.169':139
'21#.#88.125.32':139
'21#.#88.142.167':445
'21#.#88.103.140':445
'21#.#88.98.212':445
'21#.#88.132.144':445
'21#.#88.47.202':445
'21#.#88.145.47':445
'21#.#88.198.141':445
'21#.#88.39.101':139
'21#.#88.8.245':445
'21#.#88.128.233':445
'21#.#88.138.134':445
'21#.#88.202.2':445
'21#.#88.202.197':445
'21#.#88.80.20':445
'21#.#88.36.99':445
'21#.#88.98.171':445
'21#.#88.78.216':445
'21#.#88.3.157':445
'21#.#88.105.122':445
'21#.#88.62.68':445
'21#.#88.109.169':445
'21#.#88.125.32':445
'21#.#88.246.197':445
'21#.#88.228.244':139
'21#.#88.66.76':139
'21#.#88.133.69':445
'21#.#88.165.236':445
'21#.#88.105.106':445
'21#.#88.56.203':139
'21#.#88.101.186':139
'21#.#88.66.103':139
'21#.#88.121.251':139
'21#.#88.29.50':139
'21#.#88.61.8':445
'21#.#88.159.118':445
'21#.#88.97.159':445
'21#.#88.58.151':445
'21#.#88.175.182':445
'21#.#88.216.74':445
'21#.#88.2.175':445
'21#.#88.7.238':445
'21#.#88.26.183':445
'21#.#88.14.229':445
'21#.#88.162.117':445
'21#.#88.51.101':139
'21#.#88.22.234':139
'21#.#88.4.148':139
'21#.#88.204.174':139
'21#.#88.55.233':139
'21#.#88.36.22':139
'21#.#88.150.76':139
'21#.#88.72.150':139
'21#.#88.39.172':139
'21#.#88.204.187':139
'21#.#88.86.60':139
'21#.#88.55.147':139
'21#.#88.42.20':139
'21#.#88.169.200':139
'21#.#88.181.91':139
'21#.#88.182.25':139
'21#.#88.243.42':139
'21#.#88.231.235':139
'21#.#88.47.232':139
'21#.#88.235.112':139
'21#.#88.112.34':139
'21#.#88.39.161':139
'21#.#88.254.72':139
'21#.#88.182.107':139
'21#.#88.240.200':139
'21#.#88.118.129':445
'21#.#88.18.198':445
'21#.#88.113.144':139
'21#.#88.73.243':139
'21#.#88.18.181':139
'21#.#88.209.226':139
'21#.#88.71.45':139
'21#.#88.17.232':445
'21#.#88.189.164':445
'21#.#88.21.146':445
'21#.#88.165.99':445
'21#.#88.60.48':445
'21#.#88.181.97':445
'21#.#88.2.223':445
'21#.#88.40.219':445
'21#.#88.97.5':445
'21#.#88.247.158':445
'21#.#88.248.197':445
'21#.#88.175.182':139
'21#.#88.254.72':445
'21#.#88.182.107':445
'21#.#88.240.200':445
'21#.#88.105.106':139
'21#.#88.133.69':139
'21#.#88.113.144':445
'21#.#88.73.243':445
'21#.#88.18.181':445
'21#.#88.209.226':445
'21#.#88.71.45':445
'21#.#88.165.236':139
'21#.#88.97.159':139
'21#.#88.14.229':139
'21#.#88.159.118':139
'21#.#88.216.74':139
'21#.#88.58.151':139
'21#.#88.7.238':139
'21#.#88.61.8':139
'21#.#88.2.175':139
'21#.#88.162.117':139
'21#.#88.26.183':139
'21#.#88.40.57':445
'21#.#88.237.71':445
'21#.#88.61.104':445
'21#.#88.13.53':445
'21#.#88.166.23':445
'21#.#88.181.42':445
'21#.#88.157.9':445
'21#.#88.101.124':445
'21#.#88.64.174':445
'21#.#88.124.100':445
'21#.#88.146.182':445
'21#.#88.228.207':139
'21#.#88.15.34':139
'21#.#88.39.35':139
'21#.#88.39.211':139
'21#.#88.57.39':139
'21#.#88.223.119':445
'21#.#88.157.161':445
'21#.#88.117.22':139
'21#.#88.8.173':139
'21#.#88.233.180':139
'21#.#88.158.224':445
'21#.#88.53.69':445
'21#.#88.76.0':445
'21#.#88.120.33':445
'21#.#88.124.249':445
'21#.#88.45.72':445
'21#.#88.93.237':445
'21#.#88.133.170':445
'21#.#88.230.217':445
'21#.#88.58.48':445
'21#.#88.53.144':445
'21#.#88.44.131':445
'21#.#88.75.237':445
'21#.#88.72.34':445
'21#.#88.90.223':445
'21#.#88.209.158':445
'21#.#88.12.138':445
'21#.#88.28.93':445
'21#.#88.78.164':445
'21#.#88.20.45':445
'21#.#88.27.244':445
'21#.#88.178.13':445
'21#.#88.209.158':139
'21#.#88.12.138':139
'21#.#88.158.224':139
'21#.#88.181.42':139
'21#.#88.157.9':139
'21#.#88.27.244':139
'21#.#88.178.13':139
'21#.#88.72.34':139
'21#.#88.90.223':139
'21#.#88.75.237':139
'21#.#88.101.124':139
'21#.#88.166.23':139
'21#.#88.61.104':139
'21#.#88.223.119':139
'21#.#88.157.161':139
'21#.#88.146.182':139
'21#.#88.64.174':139
'21#.#88.124.100':139
'21#.#88.237.71':139
'21#.#88.13.53':139
'21#.#88.40.57':139
'21#.#88.20.45':139
'21#.#88.184.128':139
'21#.#88.102.181':139
'21#.#88.191.169':139
'21#.#88.93.237':139
'21#.#88.133.170':139
'21#.#88.141.121':139
'21#.#88.178.190':139
'21#.#88.156.45':139
'21#.#88.226.14':139
'21#.#88.62.143':139
'21#.#88.230.217':139
'21#.#88.124.249':139
'21#.#88.45.72':139
'21#.#88.44.131':139
'21#.#88.28.93':139
'21#.#88.78.164':139
'21#.#88.58.48':139
'21#.#88.53.144':139
'21#.#88.76.0':139
'21#.#88.120.33':139
'21#.#88.53.69':139
'21#.#88.191.169':445
'21#.#88.196.61':445
'21#.#88.200.195':445
'21#.#88.224.23':445
'21#.#88.173.153':139
'21#.#88.248.158':445
'21#.#88.46.11':445
'21#.#88.227.45':445
'21#.#88.120.43':445
'21#.#88.27.154':445
'21#.#88.68.1':445
'21#.#88.133.127':139
'21#.#88.12.139':139
'21#.#88.7.217':139
'21#.#88.36.240':139
'21#.#88.148.51':139
'21#.#88.48.240':139
'21#.#88.33.254':139
'21#.#88.231.115':139
'21#.#88.120.193':139
'21#.#88.5.228':139
'21#.#88.28.193':139
'21#.#88.187.167':445
'21#.#88.120.193':445
'21#.#88.33.254':445
'21#.#88.28.193':445
'21#.#88.7.217':445
'21#.#88.5.228':445
'21#.#88.166.197':139
'21#.#88.142.167':139
'21#.#88.173.153':445
'21#.#88.231.115':445
'21#.#88.133.127':445
'21#.#88.12.139':445
'21#.#88.222.241':445
'21#.#88.31.158':445
'21#.#88.118.14':445
'21#.#88.89.137':445
'21#.#88.215.241':445
'21#.#88.48.240':445
'21#.#88.36.240':445
'21#.#88.148.51':445
'21#.#88.2.43':445
'21#.#88.140.105':445
'21#.#88.117.22':445
'21#.#88.40.57':9988
'21#.#88.233.180':445
'21#.#88.15.34':445
'21#.#88.8.173':445
'21#.#88.157.9':9988
'21#.#88.158.224':9988
'21#.#88.64.174':9988
'21#.#88.157.161':9988
'21#.#88.61.104':9988
'21#.#88.228.207':445
'21#.#88.62.143':445
'21#.#88.156.45':445
'21#.#88.226.14':445
'21#.#88.184.128':445
'21#.#88.102.181':445
'21#.#88.57.39':445
'21#.#88.39.35':445
'21#.#88.39.211':445
'21#.#88.141.121':445
'21#.#88.178.190':445
'21#.#88.75.237':9988
'21#.#88.89.137':139
'21#.#88.215.241':139
'21#.#88.187.167':139
'21#.#88.46.11':139
'21#.#88.227.45':139
'21#.#88.2.43':139
'21#.#88.140.105':139
'21#.#88.31.158':139
'21#.#88.118.14':139
'21#.#88.222.241':139
'21#.#88.120.43':139
'21#.#88.58.48':9988
'21#.#88.248.158':139
'21#.#88.28.93':9988
'21#.#88.178.13':9988
'21#.#88.20.45':9988
'21#.#88.27.154':139
'21#.#88.68.1':139
'21#.#88.200.195':139
'21#.#88.224.23':139
'21#.#88.196.61':139

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial