Trojan.DownLoader12.29211

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'21#.#05.224.108':139
'21#.#05.221.87':139
'21#.#05.55.141':139
'21#.#05.140.115':139
'21#.#05.114.198':139
'21#.#05.105.145':445
'21#.#05.182.99':445
'21#.#05.95.115':139
'21#.#05.49.187':445
'21#.#05.27.50':139
'21#.#05.50.17':139
'21#.#05.0.240':139
'21#.#05.39.82':139
'21#.#05.16.233':139
'21#.#05.203.118':139
'21#.#05.65.111':139
'21#.#05.231.150':139
'21#.#05.131.75':139
'21#.#05.93.35':139
'21#.#05.124.2':445
'21#.#05.184.151':445
'21#.#05.226.184':445
'21#.#05.196.219':445
'21#.#05.201.218':445
'21#.#05.227.162':445
'21#.#05.84.149':445
'21#.#05.57.85':445
'21#.#05.214.227':445
'21#.#05.20.36':445
'21#.#05.218.223':445
'21#.#05.8.68':445
'21#.#05.94.8':445
'21#.#05.54.214':445
'21#.#05.144.114':445
'21#.#05.115.94':445
'21#.#05.1.93':445
'21#.#05.6.209':445
'21#.#05.142.139':445
'21#.#05.152.98':445
'21#.#05.115.94':139
'21#.#05.142.139':139
'21#.#05.8.68':139
'21#.#05.94.8':139
'21#.#05.152.98':139
'21#.#05.218.223':139
'21#.#05.196.219':139
'21#.#05.1.93':139
'21#.#05.6.209':139
'21#.#05.144.114':139
'21#.#05.148.84':445
'21#.#05.240.115':445
'21#.#05.171.107':445
'21#.#05.7.59':445
'21#.#05.49.187':139
'21#.#05.124.2':139
'21#.#05.54.214':139
'21#.#05.105.145':139
'21#.#05.182.99':139
'21#.#05.201.218':139
'21#.#05.239.36':139
'21#.#05.186.216':139
'21#.#05.180.82':139
'21#.#05.46.7':139
'21#.#05.187.107':139
'21#.#05.18.205':139
'21#.#05.51.206':139
'21#.#05.221.160':139
'21#.#05.16.4':139
'21#.#05.83.18':139
'21#.#05.227.162':139
'21#.#05.214.227':139
'21#.#05.184.151':139
'21#.#05.226.184':139
'21#.#05.20.36':139
'21#.#05.33.57':139
'21#.#05.18.33':139
'21#.#05.84.149':139
'21#.#05.57.85':139
'21#.#05.33.57':445
'21#.#05.50.8':139
'21#.#05.143.82':139
'21#.#05.26.64':139
'21#.#05.11.135':139
'21#.#05.171.179':139
'21#.#05.217.200':139
'21#.#05.123.128':139
'21#.#05.22.85':139
'21#.#05.121.158':139
'21#.#05.136.2':139
'21#.#05.206.187':139
'21#.#05.27.44':139
'21#.#05.73.36':139
'21#.#05.137.161':139
'21#.#05.31.50':139
'21#.#05.176.158':139
'21#.#05.11.177':139
'21#.#05.80.121':139
'21#.#05.158.125':139
'21#.#05.64.124':139
'21#.#05.157.110':139
'21#.#05.42.110':139
'21#.#05.90.250':139
'21#.#05.188.35':139
'21#.#05.209.42':139
'21#.#05.108.218':139
'21#.#05.96.82':139
'21#.#05.128.135':139
'21#.#05.214.178':139
'21#.#05.155.97':139
'21#.#05.144.197':139
'21#.#05.138.156':139
'21#.#05.203.64':139
'21#.#05.220.184':139
'21#.#05.222.79':139
'21#.#05.8.42':139
'21#.#05.21.94':139
'21#.#05.8.153':139
'21#.#05.42.178':139
'21#.#05.16.233':445
'21#.#05.50.17':445
'21#.#05.51.206':445
'21#.#05.39.82':445
'21#.#05.0.240':445
'21#.#05.93.35':445
'21#.#05.65.111':445
'21#.#05.203.118':445
'21#.#05.131.75':445
'21#.#05.18.205':445
'21#.#05.180.82':445
'21#.#05.46.7':445
'21#.#05.18.33':445
'21#.#05.83.18':445
'21#.#05.239.36':445
'21#.#05.221.160':445
'21#.#05.16.4':445
'21#.#05.186.216':445
'21#.#05.187.107':445
'21#.#05.231.150':445
'21#.#05.215.197':139
'21#.#05.34.54':139
'21#.#05.139.121':139
'21#.#05.54.187':139
'21#.#05.132.189':139
'21#.#05.72.10':139
'21#.#05.24.102':139
'21#.#05.28.149':139
'21#.#05.10.152':139
'21#.#05.121.159':139
'21#.#05.140.115':445
'21#.#05.224.108':445
'21#.#05.27.50':445
'21#.#05.55.141':445
'21#.#05.221.87':445
'21#.#05.44.183':139
'21#.#05.19.177':139
'21#.#05.114.198':445
'21#.#05.95.115':445
'21#.#05.189.137':445
'21#.#05.12.39':445
'21#.#05.67.172':445
'21#.#05.218.43':139
'21#.#05.235.57':139
'21#.#05.47.245':445
'21#.#05.162.69':445
'21#.#05.245.17':445
'21#.#05.169.201':445
'21#.#05.171.253':445
'21#.#05.9.28':139
'21#.#05.203.95':139
'21#.#05.200.203':139
'21#.#05.193.191':139
'21#.#05.225.201':139
'21#.#05.231.192':139
'21#.#05.136.224':139
'21#.#05.83.137':139
'21#.#05.118.73':139
'21#.#05.66.147':139
'21#.#05.242.67':445
'21#.#05.123.253':445
'21#.#05.58.90':445
'21#.#05.71.36':445
'21#.#05.55.121':445
'21#.#05.172.58':445
'21#.#05.71.152':445
'21#.#05.33.252':445
'21#.#05.102.113':445
'21#.#05.127.229':445
'21#.#05.216.254':445
'21#.#05.123.148':445
'21#.#05.129.130':445
'21#.#05.18.179':445
'21#.#05.159.241':445
'21#.#05.37.153':445
'21#.#05.97.119':445
'21#.#05.84.241':445
'21#.#05.204.109':445
'21#.#05.153.104':445
'21#.#05.37.153':139
'21#.#05.204.109':139
'21#.#05.123.148':139
'21#.#05.129.130':139
'21#.#05.153.104':139
'21#.#05.216.254':139
'21#.#05.71.36':139
'21#.#05.97.119':139
'21#.#05.84.241':139
'21#.#05.159.241':139
'21#.#05.12.39':139
'21#.#05.169.201':139
'21#.#05.171.253':139
'21#.#05.245.17':139
'21#.#05.18.179':139
'21#.#05.47.245':139
'21#.#05.242.67':139
'21#.#05.162.69':139
'21#.#05.67.172':139
'21#.#05.55.121':139
'21#.#05.9.11':139
'21#.#05.110.146':139
'21#.#05.209.191':139
'21#.#05.101.91':139
'21#.#05.46.85':139
'21#.#05.6.132':139
'21#.#05.174.6':139
'21#.#05.31.4':139
'21#.#05.158.154':139
'21#.#05.208.31':139
'21#.#05.172.58':139
'21#.#05.102.113':139
'21#.#05.123.253':139
'21#.#05.58.90':139
'21#.#05.127.229':139
'21#.#05.221.42':139
'21#.#05.150.29':139
'21#.#05.71.152':139
'21#.#05.33.252':139
'21#.#05.221.42':445
'21#.#05.225.227':139
'21#.#05.109.225':139
'21#.#05.111.189':139
'21#.#05.13.18':139
'21#.#05.151.75':139
'21#.#05.171.107':139
'21#.#05.7.59':139
'21#.#05.183.20':139
'21#.#05.189.137':139
'21#.#05.21.52':139
'21#.#05.98.27':139
'21#.#05.196.121':139
'21#.#05.193.38':139
'21#.#05.17.110':139
'21#.#05.28.54':139
'21#.#05.71.139':139
'21#.#05.113.37':139
'21#.#05.22.1':139
'21#.#05.194.214':139
'21#.#05.148.84':139
'21#.#05.21.52':445
'21#.#05.111.189':445
'21#.#05.71.139':445
'21#.#05.113.37':445
'21#.#05.13.18':445
'21#.#05.151.75':445
'21#.#05.183.20':445
'21#.#05.225.227':445
'21#.#05.109.225':445
'21#.#05.194.214':445
'21#.#05.9.231':445
'21#.#05.193.38':445
'21#.#05.240.115':139
'21#.#05.124.172':445
'21#.#05.17.110':445
'21#.#05.28.54':445
'21#.#05.22.1':445
'21#.#05.98.27':445
'21#.#05.196.121':445
'21#.#05.225.201':445
'21#.#05.203.95':445
'21#.#05.174.6':445
'21#.#05.193.191':445
'21#.#05.200.203':445
'21#.#05.66.147':445
'21#.#05.136.224':445
'21#.#05.231.192':445
'21#.#05.118.73':445
'21#.#05.6.132':445
'21#.#05.209.191':445
'21#.#05.101.91':445
'21#.#05.150.29':445
'21#.#05.208.31':445
'21#.#05.9.11':445
'21#.#05.31.4':445
'21#.#05.158.154':445
'21#.#05.110.146':445
'21#.#05.46.85':445
'21#.#05.83.137':445
'21#.#05.225.201':9988
'21#.#05.203.95':9988
'21#.#05.209.191':9988
'21#.#05.174.6':9988
'21#.#05.200.203':9988
'21#.#05.124.172':139
'21#.#05.9.231':139
'21#.#05.136.224':9988
'21#.#05.9.28':9988
'21#.#05.208.31':9988
'21#.#05.235.57':445
'21#.#05.18.179':9988
'21#.#05.9.28':445
'21#.#05.218.43':445
'21#.#05.97.119':9988
'21#.#05.127.229':9988
'21#.#05.150.29':9988
'21#.#05.55.121':9988
'21#.#05.123.253':9988

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial