Trojan.DownLoader12.28924

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'21#.#6.148.80':445
'21#.#6.176.60':445
'21#.#6.8.173':445
'21#.#6.15.245':445
'21#.#6.173.15':445
'21#.#6.31.50':139
'21#.#6.206.30':139
'21#.#6.22.112':139
'21#.#6.105.85':445
'21#.#6.113.166':139
'21#.#6.21.142':445
'21#.#6.134.21':445
'21#.#6.141.244':445
'21#.#6.162.104':445
'21#.#6.171.122':445
'21#.#6.110.76':445
'21#.#6.153.129':445
'21#.#6.66.93':445
'21#.#6.89.134':445
'21#.#6.136.138':445
'21#.#6.78.78':139
'21#.#6.151.228':139
'21#.#6.239.202':139
'21#.#6.228.8':139
'21#.#6.96.110':139
'21#.#6.8.172':139
'21#.#6.62.242':139
'21#.#6.140.114':139
'21#.#6.191.210':139
'21#.#6.159.104':139
'21#.#6.77.159':139
'21#.#6.22.112':445
'21#.#6.31.50':445
'21#.#6.113.166':445
'21#.#6.141.235':139
'21#.#6.36.73':139
'21#.#6.36.73':445
'21#.#6.103.229':139
'21#.#6.141.235':445
'21#.#6.206.30':445
'21#.#6.78.78':445
'21#.#6.75.218':445
'21#.#6.105.85':139
'21#.#6.80.224':445
'21#.#6.176.60':139
'21#.#6.8.173':139
'21#.#6.148.80':139
'21#.#6.245.89':445
'21#.#6.73.245':445
'21#.#6.105.239':445
'21#.#6.48.187':445
'21#.#6.80.212':445
'21#.#6.89.134':139
'21#.#6.136.138':139
'21#.#6.134.21':139
'21#.#6.141.244':139
'21#.#6.21.142':139
'21#.#6.15.245':139
'21#.#6.173.15':139
'21#.#6.153.129':139
'21#.#6.66.93':139
'21#.#6.110.76':139
'21#.#6.143.74':445
'21#.#6.69.182':445
'21#.#6.183.152':445
'21#.#6.57.30':445
'21#.#6.82.99':445
'21#.#6.51.127':445
'21#.#6.255.1':445
'21#.#6.218.82':445
'21#.#6.217.15':445
'21#.#6.110.183':445
'21#.#6.29.220':445
'21#.#6.58.100':445
'21#.#6.207.220':445
'21#.#6.222.235':445
'21#.76.1.8':445
'21#.#6.17.210':445
'21#.#6.23.62':445
'21#.#6.99.23':445
'21#.#6.137.209':445
'21#.#6.219.158':445
'21#.#6.40.158':445
'21#.#6.130.140':139
'21#.#6.238.60':445
'21#.#6.140.70':445
'21#.#6.60.160':445
'21#.#6.221.40':445
'21#.#6.34.227':445
'21#.#6.210.220':445
'21#.#6.255.220':445
'21#.#6.159.209':445
'21#.#6.223.90':445
'21#.#6.209.87':445
'21#.#6.37.79':445
'21#.#6.243.37':445
'21#.#6.50.135':445
'21#.#6.140.114':445
'21#.#6.130.140':445
'21#.#6.166.84':445
'21#.#6.253.166':445
'21#.#6.68.169':445
'21#.#6.243.242':445
'21#.#6.99.168':445
'21#.#6.195.29':445
'21#.#6.168.55':139
'21#.#6.192.187':139
'21#.#6.55.35':445
'21#.#6.48.124':445
'21#.#6.34.119':445
'21#.#6.53.11':139
'21#.#6.118.91':139
'21#.#6.9.233':139
'21#.#6.114.229':139
'21#.#6.62.70':139
'21#.#6.221.201':445
'21#.#6.56.208':445
'21#.#6.131.104':445
'21#.#6.142.195':445
'21#.#6.135.142':445
'21#.#6.69.24':445
'21#.76.2.43':445
'21#.#6.25.54':445
'21#.#6.5.169':445
'21#.#6.54.63':445
'21#.#6.62.242':445
'21#.#6.223.90':139
'21#.#6.209.87':139
'21#.#6.140.70':139
'21#.#6.60.160':139
'21#.#6.238.60':139
'21#.#6.195.29':139
'21#.#6.142.195':139
'21#.#6.255.220':139
'21#.#6.159.209':139
'21#.#6.210.220':139
'21#.#6.243.242':139
'21#.#6.99.168':139
'21#.#6.243.37':139
'21#.#6.50.135':139
'21#.#6.37.79':139
'21#.#6.221.40':139
'21#.#6.34.227':139
'21#.#6.253.166':139
'21#.#6.68.169':139
'21#.#6.166.84':139
'21#.#6.135.142':139
'21#.#6.8.172':445
'21#.#6.228.8':445
'21#.#6.96.110':445
'21#.#6.55.35':139
'21#.#6.103.229':445
'21#.#6.77.159':445
'21#.#6.191.210':445
'21#.#6.159.104':445
'21#.#6.151.228':445
'21#.#6.239.202':445
'21#.#6.5.169':139
'21#.#6.54.63':139
'21#.#6.56.208':139
'21#.#6.131.104':139
'21#.#6.221.201':139
'21#.#6.48.124':139
'21#.#6.34.119':139
'21#.76.2.43':139
'21#.#6.25.54':139
'21#.#6.69.24':139
'21#.#6.171.122':139
'21#.#6.5.132':445
'21#.#6.4.168':445
'21#.#6.52.153':445
'21#.#6.73.198':445
'21#.#6.22.210':445
'21#.#6.50.25':445
'21#.#6.135.34':445
'21#.#6.177.219':445
'21#.#6.62.174':445
'21#.#6.170.62':445
'21#.#6.158.30':139
'21#.#6.143.158':139
'21#.#6.101.156':139
'21#.#6.204.72':139
'21#.#6.255.95':139
'21#.#6.205.178':139
'21#.#6.57.227':445
'21#.#6.205.175':139
'21#.#6.30.144':139
'21#.#6.157.30':139
'21#.#6.123.87':445
'21#.#6.27.254':445
'21#.#6.37.26':445
'21#.#6.227.161':445
'21#.#6.139.218':445
'21#.#6.157.182':445
'21#.#6.35.215':445
'21#.#6.148.112':445
'21#.#6.31.47':445
'21#.#6.55.11':445
'21#.#6.174.30':445
'21#.#6.59.33':445
'21#.#6.22.110':445
'21#.#6.32.154':445
'21#.#6.174.10':445
'21#.#6.224.20':445
'21#.#6.187.174':445
'21#.#6.125.17':445
'21#.#6.224.253':445
'21#.#6.88.60':445
'21#.#6.183.16':445
'21#.#6.141.46':139
'21#.#6.224.20':139
'21#.#6.32.154':139
'21#.#6.174.10':139
'21#.#6.135.34':139
'21#.#6.123.87':139
'21#.#6.183.16':139
'21#.#6.224.253':139
'21#.#6.88.60':139
'21#.#6.59.33':139
'21#.#6.22.110':139
'21#.#6.5.132':139
'21#.#6.4.168':139
'21#.#6.52.153':139
'21#.#6.73.198':139
'21#.#6.57.227':139
'21#.#6.177.219':139
'21#.#6.50.25':139
'21#.#6.170.62':139
'21#.#6.22.210':139
'21#.#6.62.174':139
'21#.#6.187.174':139
'21#.#6.212.19':139
'21#.#6.180.33':139
'21#.#6.57.43':139
'21#.#6.148.112':139
'21#.#6.6.199':139
'21#.#6.85.181':139
'21#.#6.207.139':139
'21#.#6.195.114':139
'21#.#6.186.86':139
'21#.#6.166.161':139
'21#.#6.227.161':139
'21#.#6.27.254':139
'21#.#6.157.182':139
'21#.#6.125.17':139
'21#.#6.139.218':139
'21#.#6.31.47':139
'21#.#6.35.215':139
'21#.#6.174.30':139
'21#.#6.37.26':139
'21#.#6.55.11':139
'21#.#6.6.199':445
'21#.#6.48.187':139
'21#.#6.80.212':139
'21#.#6.80.224':139
'21#.#6.157.196':445
'21#.#6.147.2':445
'21#.#6.143.74':139
'21#.76.1.8':139
'21#.#6.73.245':139
'21#.#6.105.239':139
'21#.#6.245.89':139
'21#.#6.157.196':139
'21#.#6.147.2':139
'21#.#6.148.0':139
'21#.#6.133.228':139
'21#.#6.234.94':139
'21#.#6.234.94':445
'21#.#6.148.0':445
'21#.#6.133.228':445
'21#.#6.115.122':445
'21#.#6.165.51':445
'21#.#6.17.210':139
'21#.#6.110.183':139
'21#.#6.29.220':139
'21#.#6.183.152':139
'21#.#6.57.30':139
'21#.#6.69.182':139
'21#.#6.75.218':139
'21#.#6.162.104':139
'21#.#6.218.82':139
'21#.#6.217.15':139
'21#.#6.255.1':139
'21#.#6.219.158':139
'21#.#6.40.158':139
'21#.#6.207.220':139
'21#.#6.222.235':139
'21#.#6.58.100':139
'21#.#6.82.99':139
'21#.#6.51.127':139
'21#.#6.99.23':139
'21#.#6.137.209':139
'21#.#6.23.62':139
'21#.#6.165.51':139
'21#.#6.143.158':445
'21#.#6.30.144':445
'21#.#6.158.30':445
'21#.#6.255.95':445
'21#.#6.101.156':445
'21#.#6.170.62':9988
'21#.#6.4.168':9988
'21#.#6.205.178':445
'21#.#6.157.30':445
'21#.#6.205.175':445
'21#.#6.186.86':445
'21#.#6.166.161':445
'21#.#6.180.33':445
'21#.#6.57.43':445
'21#.#6.212.19':445
'21#.#6.141.46':445
'21#.#6.204.72':445
'21#.#6.207.139':445
'21#.#6.195.114':445
'21#.#6.85.181':445
'21#.#6.73.198':9988
'21#.#6.35.215':9988
'21#.#6.57.43':9988
'21#.#6.31.47':9988
'21#.#6.187.174':9988
'21#.#6.125.17':9988
'21#.#6.227.161':9988
'21#.#6.115.122':139
'21#.#6.174.30':9988
'21#.#6.139.218':9988
'21#.#6.27.254':9988
'21#.#6.135.34':9988
'21#.#6.174.10':9988
'21#.#6.177.219':9988
'21#.#6.5.132':9988
'21#.#6.22.210':9988
'21#.#6.22.110':9988
'21#.#6.183.16':9988
'21#.#6.59.33':9988
'21#.#6.123.87':9988
'21#.#6.224.20':9988

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial