Trojan.DownLoader9.37266

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERd6a9.dir00\svchost.exe.mdmp 16325836412032016

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WERd6a9.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Network activity:

Connects to:

'14#.#8.184.207':445
'14#.#8.108.40':445
'14#.#8.128.203':445
'14#.#8.54.160':445
'14#.#8.40.15':445
'14#.#8.106.47':445
'14#.#8.34.225':445
'14#.#8.14.185':445
'14#.#8.175.162':445
'14#.#8.112.248':139
'14#.#8.34.128':139
'14#.#8.52.17':139
'14#.#8.246.245':445
'14#.#8.88.170':445
'14#.#8.235.83':445
'14#.#8.1.131':139
'14#.#8.65.135':139
'14#.#8.100.145':139
'14#.#8.123.81':139
'14#.#8.50.137':445
'14#.18.5.98':445
'14#.#8.32.243':445
'14#.#8.110.221':445
'14#.#8.244.1':445
'14#.#8.131.56':445
'14#.#8.104.103':445
'14#.#8.17.143':445
'14#.#8.88.45':445
'14#.#8.207.56':445
'14#.#8.223.126':445
'14#.#8.55.88':445
'14#.#8.91.242':445
'14#.18.6.74':445
'14#.#8.66.179':445
'14#.#8.226.252':445
'14#.#8.253.138':445
'14#.#8.58.11':445
'14#.#8.227.120':445
'14#.#8.154.240':445
'14#.18.6.74':139
'14#.#8.145.218':139
'14#.#8.58.11':139
'14#.#8.88.170':139
'14#.#8.110.221':139
'14#.#8.88.45':139
'14#.#8.104.103':139
'14#.#8.106.47':139
'14#.#8.233.162':139
'14#.#8.91.242':139
'14#.#8.175.162':139
'14#.#8.226.252':139
'14#.#8.108.40':139
'14#.#8.253.138':139
'14#.#8.227.120':139
'14#.#8.66.179':139
'14#.#8.48.210':139
'14#.#8.223.126':139
'14#.#8.37.84':139
'14#.#8.144.81':445
'14#.#8.139.83':445
'14#.#8.102.51':445
'14#.#8.46.127':445
'14#.#8.3.111':445
'14#.#8.131.56':139
'14#.#8.106.17':445
'14#.#8.193.3':445
'14#.#8.129.241':445
'14#.#8.2.231':139
'14#.#8.17.143':139
'14#.#8.244.1':139
'14#.#8.246.245':139
'14#.#8.50.137':139
'14#.#8.222.191':139
'14#.#8.55.88':139
'14#.#8.34.225':139
'14#.#8.32.243':139
'14#.18.5.98':139
'14#.#8.222.191':445
'14#.#8.38.154':139
'14#.#8.201.119':139
'14#.#8.48.82':139
'14#.#8.82.76':139
'14#.#8.213.209':139
'14#.#8.21.98':139
'14#.18.9.7':139
'14#.#8.178.190':139
'14#.#8.22.253':139
'14#.#8.254.85':139
'14#.#8.250.194':139
'14#.#8.251.239':139
'14#.#8.43.88':139
'14#.#8.187.193':139
'14#.#8.67.146':139
'14#.#8.88.125':139
'14#.#8.95.172':139
'14#.#8.125.71':139
'14#.18.91.6':139
'14#.#8.235.190':139
'14#.#8.80.187':445
'14#.#8.93.62':139
'14#.#8.75.46':139
'14#.#8.14.166':139
'14#.#8.48.82':445
'14#.#8.95.136':445
'14#.#8.238.239':445
'14#.#8.203.253':445
'14#.#8.246.207':445
'14#.#8.182.203':139
'14#.#8.22.221':139
'14#.#8.235.8':445
'14#.#8.30.131':139
'14#.#8.21.11':139
'14#.#8.192.157':445
'14#.#8.37.23':139
'14#.#8.237.130':139
'14#.#8.188.178':445
'14#.#8.98.127':139
'14#.#8.19.226':139
'14#.#8.9.225':139
'14#.#8.204.38':139
'14#.#8.202.134':139
'14#.#8.128.226':139
'14#.#8.1.131':445
'14#.#8.112.248':445
'14#.#8.90.52':139
'14#.#8.100.145':445
'14#.#8.246.207':139
'14#.#8.34.128':445
'14#.#8.134.66':139
'14#.#8.233.162':445
'14#.#8.48.210':445
'14#.#8.48.129':139
'14#.#8.80.187':139
'14#.#8.136.105':139
'14#.#8.238.239':139
'14#.#8.117.247':139
'14#.#8.116.68':139
'14#.#8.19.226':445
'14#.#8.192.220':139
'14#.#8.202.134':445
'14#.#8.90.52':445
'14#.#8.95.136':139
'14#.#8.127.165':139
'14#.#8.9.225':445
'14#.#8.128.226':445
'14#.#8.41.73':139
'14#.#8.134.66':445
'14#.#8.117.247':445
'14#.#8.52.17':445
'14#.#8.65.135':445
'14#.#8.136.105':445
'14#.#8.34.90':139
'14#.#8.35.49':139
'14#.#8.48.129':445
'14#.#8.204.38':445
'14#.#8.46.145':139
'14#.#8.125.15':445
'14#.#8.193.126':139
'14#.#8.130.3':139
'14#.#8.49.85':445
'14#.#8.120.139':445
'14#.#8.10.51':445
'14#.#8.203.225':445
'14#.#8.137.17':445
'14#.#8.43.81':139
'14#.#8.59.63':139
'14#.#8.112.166':139
'14#.#8.189.64':139
'14#.#8.52.109':139
'14#.#8.219.231':139
'14#.#8.115.38':139
'14#.#8.124.178':139
'14#.#8.94.133':139
'14#.#8.230.183':139
'14#.#8.164.172':445
'14#.#8.222.63':445
'14#.#8.102.136':445
'14#.18.4.5':445
'14#.#8.129.32':445
'14#.#8.218.70':445
'14#.#8.233.151':445
'14#.#8.124.243':445
'14#.#8.70.219':445
'14#.#8.199.195':445
'14#.#8.219.98':445
'14#.#8.243.148':445
'14#.#8.202.2':445
'14#.#8.63.241':445
'14#.#8.147.92':445
'14#.#8.82.227':445
'14#.#8.1.204':445
'14#.#8.19.212':445
'14#.#8.55.171':445
'14#.#8.103.111':139
'14#.#8.243.148':139
'14#.#8.82.227':139
'14#.#8.63.241':139
'14#.#8.55.171':139
'14#.#8.10.51':139
'14#.18.4.5':139
'14#.#8.129.32':139
'14#.#8.202.2':139
'14#.#8.1.204':139
'14#.#8.147.92':139
'14#.#8.49.85':139
'14#.#8.203.225':139
'14#.#8.137.17':139
'14#.#8.125.15':139
'14#.#8.120.139':139
'14#.#8.219.98':139
'14#.#8.19.212':139
'14#.#8.199.195':139
'14#.#8.102.136':139
'14#.#8.225.201':139
'14#.#8.120.6':139
'14#.#8.13.53':139
'14#.18.53.3':139
'14#.#8.147.98':139
'14#.#8.75.251':139
'14#.#8.13.112':139
'14#.#8.102.141':139
'14#.#8.23.235':139
'14#.#8.43.115':139
'14#.#8.222.63':139
'14#.#8.70.219':139
'14#.#8.32.125':139
'14#.#8.124.243':139
'14#.#8.218.70':139
'14#.#8.164.172':139
'14#.#8.4.184':139
'14#.#8.148.199':139
'14#.#8.233.151':139
'14#.#8.32.125':445
'14#.#8.233.151':9988
'14#.#8.19.212':9988
'14#.#8.112.166':9988
'14#.#8.124.243':9988
'14#.#8.125.15':9988
'14#.#8.94.133':9988
'14#.#8.52.109':9988
'14#.#8.219.231':9988
'14#.#8.243.148':9988
'14#.#8.120.6':9988
'14#.#8.63.241':9988
'14#.#8.130.3':9988
'14#.#8.13.53':9988
'14#.#8.120.139':9988
'14#.#8.46.145':9988
'14#.#8.43.81':9988
'14#.#8.199.195':9988
'14#.#8.49.85':9988
'14#.#8.218.70':9988
'14#.#8.54.160':139
'14#.#8.154.240':139
'14#.#8.170.223':139
'14#.#8.235.83':139
'14#.#8.106.17':139
'14#.#8.14.185':139
'14#.#8.40.15':139
'14#.#8.184.207':139
'14#.#8.207.56':139
'14#.#8.103.223':139
'14#.#8.193.126':9988
'14#.#8.219.98':9988
'14#.#8.115.38':9988
'14#.#8.225.201':9988
'14#.#8.222.63':9988
'14#.#8.3.111':139
'14#.#8.193.3':139
'14#.#8.103.111':9988
'14#.#8.46.127':139
'14#.#8.137.17':9988
'14#.#8.103.111':445
'14#.#8.52.109':445
'14#.#8.13.112':445
'14#.#8.75.251':445
'14#.#8.219.231':445
'14#.#8.112.166':445
'14#.#8.94.133':445
'14#.#8.59.63':445
'14#.#8.189.64':445
'14#.#8.102.141':445
'14#.18.53.3':445
'14#.#8.13.53':445
'14#.#8.148.199':445
'14#.#8.43.115':445
'14#.#8.4.184':445
'14#.#8.120.6':445
'14#.#8.23.235':445
'14#.#8.225.201':445
'14#.#8.147.98':445
'14#.#8.82.227':9988
'14#.#8.124.178':9988
'14#.#8.43.115':9988
'14#.#8.189.64':9988
'14#.#8.102.141':9988
'14#.#8.59.63':9988
'14#.#8.70.219':9988
'14#.#8.102.136':9988
'14#.#8.75.251':9988
'14#.#8.13.112':9988
'14#.#8.124.178':445
'14#.#8.130.3':445
'14#.#8.115.38':445
'14#.#8.230.183':445
'14#.#8.46.145':445
'14#.#8.203.225':9988
'14#.#8.230.183':9988
'14#.#8.193.126':445
'14#.#8.43.81':445

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial