Trojan.DownLoader12.28944

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERed98.dir00\svchost.exe.mdmp 16325836412030084

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERed98.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'20#.#50.68.39':445
'20#.#50.120.68':445
'20#.#50.14.244':445
'20#.#50.6.200':139
'20#.#50.119.75':445
'20#.#50.200.119':445
'20#.#50.83.159':139
'20#.#50.77.127':139
'20#.#50.84.6':139
'20#.#50.6.200':445
'20#.150.6.7':139
'20#.#50.200.119':139
'20#.#50.41.202':445
'20#.#50.128.148':445
'20#.#50.45.133':445
'20#.#50.59.239':445
'20#.#50.108.246':445
'20#.#50.180.108':445
'20#.#50.68.39':139
'20#.#50.120.68':139
'20#.#50.14.244':139
'20#.#50.254.73':445
'20#.#50.119.75':139
'20#.#50.189.15':139
'20#.#50.218.188':139
'20#.#50.15.144':139
'20#.#50.113.238':139
'20#.#50.143.114':139
'20#.#50.208.218':139
'20#.#50.88.180':139
'20#.#50.34.65':139
'20#.#50.88.172':139
'20#.#50.123.172':139
'20#.#50.18.177':139
'20#.#50.13.85':139
'20#.#50.186.56':139
'20#.#50.185.194':139
'20#.#50.146.148':139
'20#.#50.136.144':139
'20#.#50.109.26':139
'20#.#50.94.171':139
'20#.#50.7.250':139
'20#.#50.250.54':139
'20#.#50.214.147':139
'20#.#50.196.101':139
'20#.#50.211.24':139
'20#.#50.48.62':445
'20#.#50.10.35':445
'20#.#50.89.187':445
'20#.#50.84.134':445
'20#.#50.187.84':445
'20#.#50.126.128':445
'20#.#50.36.122':445
'20#.#50.212.187':445
'20#.#50.23.136':445
'20#.#50.83.45':445
'20#.#50.60.83':445
'20#.#50.49.175':445
'20#.#50.254.73':139
'20#.#50.82.66':139
'20#.#50.35.65':139
'20#.#50.128.148':139
'20#.#50.41.202':139
'20#.#50.52.2':139
'20#.#50.108.246':139
'20#.#50.180.108':139
'20#.#50.45.133':139
'20#.#50.59.239':139
'20#.#50.75.59':139
'20#.#50.3.74':445
'20#.#50.208.179':445
'20#.#50.180.20':445
'20#.#50.177.20':445
'20#.#50.63.63':445
'20#.#50.178.248':445
'20#.#50.75.59':445
'20#.#50.82.66':445
'20#.#50.35.65':445
'20#.#50.5.185':445
'20#.#50.52.2':445
'20#.#50.90.173':445
'20#.#50.22.59':445
'20#.#50.17.176':445
'20#.#50.38.7':445
'20#.#50.180.76':445
'20#.#50.44.200':445
'20#.#50.7.162':445
'20#.#50.36.143':445
'20#.#50.155.36':445
'20#.#50.143.13':445
'20#.#50.13.13':445
'20#.#50.29.82':445
'20#.#50.187.5':445
'20#.#50.48.10':445
'20#.#50.2.157':445
'20#.#50.98.71':445
'20#.#50.223.218':445
'20#.#50.146.246':445
'20#.#50.106.39':139
'20#.#50.133.44':139
'20#.#50.10.33':139
'20#.#50.14.37':445
'20#.#50.197.60':139
'20#.#50.139.92':445
'20#.#50.244.155':445
'20#.#50.1.78':445
'20#.#50.40.71':445
'20#.#50.45.34':445
'20#.#50.90.117':445
'20#.#50.20.66':445
'20#.#50.8.198':445
'20#.#50.135.8':445
'20#.#50.5.189':445
'20#.#50.86.216':445
'20#.#50.128.185':445
'20#.#50.34.208':139
'20#.#50.154.177':139
'20#.#50.77.17':139
'20#.#50.191.196':139
'20#.#50.15.96':139
'20#.#50.245.154':139
'20#.#50.178.181':139
'20#.#50.92.117':139
'20#.#50.110.147':139
'20#.#50.194.31':139
'20#.#50.123.145':139
'20#.#50.196.180':139
'20#.#50.197.60':445
'20#.#50.133.44':445
'20#.#50.106.39':445
'20#.#50.26.239':139
'20#.#50.10.33':445
'20#.#50.26.239':445
'20#.#50.152.156':139
'20#.#50.180.0':139
'20#.#50.128.64':139
'20#.#50.162.221':139
'20#.#50.237.162':139
'20#.#50.187.5':139
'20#.#50.48.10':139
'20#.#50.2.157':139
'20#.#50.139.92':139
'20#.#50.223.218':139
'20#.#50.14.37':139
'20#.#50.83.159':445
'20#.#50.186.56':445
'20#.#50.84.6':445
'20#.#50.146.246':139
'20#.150.6.7':445
'20#.#50.98.71':139
'20#.#50.40.71':139
'20#.#50.1.78':139
'20#.#50.244.155':139
'20#.#50.45.34':139
'20#.#50.90.117':139
'20#.#50.20.66':139
'20#.#50.8.198':139
'20#.#50.135.8':139
'20#.#50.5.189':139
'20#.#50.128.185':139
'20#.#50.86.216':139
'20#.#50.15.144':445
'20#.#50.208.218':445
'20#.#50.143.114':445
'20#.#50.189.15':445
'20#.#50.113.238':445
'20#.#50.88.180':445
'20#.#50.123.172':445
'20#.#50.34.65':445
'20#.#50.88.172':445
'20#.#50.218.188':445
'20#.#50.18.177':445
'20#.#50.211.24':445
'20#.#50.77.127':445
'20#.#50.94.171':445
'20#.#50.146.148':445
'20#.#50.136.144':445
'20#.#50.109.26':445
'20#.#50.185.194':445
'20#.#50.250.54':445
'20#.#50.7.250':445
'20#.#50.13.85':445
'20#.#50.196.101':445
'20#.#50.214.147':445
'20#.#50.134.121':445
'20#.#50.130.33':445
'20#.#50.192.16':445
'20#.#50.82.35':445
'20#.#50.43.233':445
'20#.#50.182.54':445
'20#.#50.196.159':445
'20#.#50.40.125':445
'20#.#50.125.122':445
'20#.#50.142.170':445
'20#.#50.34.125':445
'20#.#50.165.92':445
'20#.#50.41.102':139
'20#.#50.91.23':139
'20#.#50.111.156':139
'20#.#50.26.54':139
'20#.#50.159.180':139
'20#.#50.17.61':445
'20#.#50.61.102':445
'20#.#50.179.17':445
'20#.#50.102.23':445
'20#.#50.164.62':445
'20#.#50.157.197':445
'20#.#50.82.230':445
'20#.#50.242.117':445
'20#.#50.30.37':445
'20#.#50.145.4':445
'20#.#50.25.13':445
'20#.#50.248.233':445
'20#.#50.192.180':445
'20#.#50.82.92':445
'20#.#50.231.56':445
'20#.#50.76.242':445
'20#.#50.248.76':445
'20#.#50.11.107':445
'20#.#50.10.18':445
'20#.#50.80.140':445
'20#.#50.78.196':445
'20#.#50.159.185':445
'20#.#50.127.212':445
'20#.#50.17.189':445
'20#.#50.78.113':445
'20#.#50.40.137':445
'20#.#50.171.172':445
'20#.#50.180.165':445
'20#.#50.68.75':445
'20#.#50.125.122':139
'20#.#50.40.125':139
'20#.#50.142.170':139
'20#.#50.182.54':139
'20#.#50.34.125':139
'20#.#50.127.212':139
'20#.#50.80.140':139
'20#.#50.10.18':139
'20#.#50.78.196':139
'20#.#50.159.185':139
'20#.#50.196.159':139
'20#.#50.130.33':139
'20#.#50.61.102':139
'20#.#50.17.61':139
'20#.#50.164.62':139
'20#.#50.157.197':139
'20#.#50.102.23':139
'20#.#50.179.17':139
'20#.#50.192.16':139
'20#.#50.165.92':139
'20#.#50.43.233':139
'20#.#50.82.35':139
'20#.#50.134.121':139
'20#.#50.231.56':139
'20#.#50.192.180':139
'20#.#50.248.76':139
'20#.#50.242.117':139
'20#.#50.76.242':139
'20#.#50.82.92':139
'20#.#50.17.66':139
'20#.#50.93.75':139
'20#.#50.2.98':139
'20#.#50.34.95':139
'20#.#50.26.122':139
'20#.#50.248.233':139
'20#.#50.68.75':139
'20#.#50.171.172':139
'20#.#50.78.113':139
'20#.#50.17.189':139
'20#.#50.180.165':139
'20#.#50.40.137':139
'20#.#50.30.37':139
'20#.#50.82.230':139
'20#.#50.25.13':139
'20#.#50.11.107':139
'20#.#50.145.4':139
'20#.#50.49.175':139
'20#.#50.84.134':139
'20#.#50.111.156':9988
'20#.#50.142.170':9988
'20#.#50.157.197':9988
'20#.#50.187.84':139
'20#.#50.126.128':139
'20#.#50.83.45':139
'20#.#50.10.35':139
'20#.#50.89.187':139
'20#.#50.48.62':139
'20#.#50.134.121':9988
'20#.#50.192.180':9988
'20#.#50.78.196':9988
'20#.#50.78.113':9988
'20#.#50.242.117':9988
'20#.#50.34.95':9988
'20#.#50.82.92':9988
'20#.#50.164.62':9988
'20#.#50.40.125':9988
'20#.#50.93.75':9988
'20#.#50.25.13':9988
'20#.#50.41.102':9988
'20#.#50.90.173':139
'20#.#50.177.20':139
'20#.#50.155.36':139
'20#.#50.143.13':139
'20#.#50.36.143':139
'20#.#50.3.74':139
'20#.#50.5.185':139
'20#.#50.178.248':139
'20#.#50.208.179':139
'20#.#50.180.20':139
'20#.#50.63.63':139
'20#.#50.13.13':139
'20#.#50.44.200':139
'20#.#50.212.187':139
'20#.#50.36.122':139
'20#.#50.60.83':139
'20#.#50.23.136':139
'20#.#50.180.76':139
'20#.#50.17.176':139
'20#.#50.29.82':139
'20#.#50.38.7':139
'20#.#50.22.59':139
'20#.#50.7.162':139
'20#.#50.91.23':9988
'20#.#50.61.102':9988
'20#.#50.159.180':9988
'20#.#50.17.66':9988
'20#.#50.26.54':9988
'20#.#50.179.17':9988
'20#.#50.171.172':9988
'20#.#50.159.185':9988
'20#.#50.17.189':9988
'20#.#50.182.54':9988
'20#.#50.80.140':9988
'20#.#50.26.122':9988
'20#.#50.17.66':445
'20#.#50.93.75':445
'20#.#50.26.122':445
'20#.#50.34.95':445
'20#.#50.2.98':445
'20#.#50.26.54':445
'20#.#50.91.23':445
'20#.#50.43.233':9988
'20#.#50.41.102':445
'20#.#50.159.180':445
'20#.#50.111.156':445
'20#.#50.130.33':9988
'20#.#50.125.122':9988
'20#.#50.102.23':9988
'20#.#50.248.233':9988
'20#.#50.11.107':9988
'20#.#50.10.18':9988
'20#.#50.2.98':9988
'20#.#50.192.16':9988
'20#.#50.165.92':9988
'20#.#50.127.212':9988
'20#.#50.82.35':9988
'20#.#50.30.37':9988
'20#.#50.231.56':9988
'20#.#50.145.4':9988
'20#.#50.248.76':9988
'20#.#50.180.165':9988
'20#.#50.17.61':9988
'20#.#50.68.75':9988
'20#.#50.196.159':9988
'20#.#50.40.137':9988
'20#.#50.76.242':9988
'20#.#50.34.125':9988
'20#.#50.82.230':9988

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial