Trojan.DownLoader12.28933

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'67.##3.10.214':139
'67.##3.78.22':139
'67.##3.70.173':139
'67.##3.124.250':139
'67.##3.246.247':139
'67.##3.232.253':139
'67.##3.158.182':139
'67.##3.234.115':139
'67.##3.113.156':139
'67.##3.75.173':139
'67.##3.80.158':139
'67.##3.204.80':139
'67.##3.169.127':139
'67.##3.152.45':139
'67.##3.30.111':139
'67.##3.64.61':139
'67.##3.124.112':445
'67.##3.59.241':445
'67.##3.45.94':139
'67.##3.56.199':139
'67.##3.249.128':139
'67.##3.152.171':139
'67.##3.97.140':139
'67.#33.24.4':139
'67.##3.112.253':139
'67.##3.151.112':139
'67.##3.78.22':445
'67.##3.158.182':445
'67.##3.80.158':445
'67.##3.232.253':445
'67.##3.10.214':445
'67.##3.70.173':445
'67.##3.204.80':445
'67.##3.75.173':445
'67.##3.211.100':139
'67.##3.84.230':139
'67.##3.169.127':445
'67.##3.234.115':445
'67.##3.113.156':445
'67.##3.64.61':445
'67.#33.24.4':445
'67.##3.56.199':445
'67.##3.45.94':445
'67.##3.152.45':445
'67.##3.30.111':445
'67.##3.151.112':445
'67.##3.152.171':445
'67.##3.124.250':445
'67.##3.246.247':445
'67.##3.112.253':445
'67.##3.97.140':445
'67.##3.249.128':445
'67.##3.18.23':139
'67.##3.250.100':139
'67.##3.39.251':139
'67.##3.17.25':139
'67.##3.237.16':139
'67.##3.84.186':139
'67.##3.2.172':139
'67.##3.34.215':139
'67.#33.8.0':139
'67.##3.124.112':139
'67.##3.255.121':139
'67.##3.135.176':139
'67.##3.115.197':139
'67.##3.188.139':139
'67.##3.212.159':139
'67.##3.185.185':139
'67.##3.116.54':139
'67.##3.63.116':139
'67.##3.98.45':139
'67.##3.193.198':139
'67.##3.232.212':139
'67.##3.6.172':139
'67.##3.27.204':139
'67.##3.121.193':139
'67.##3.123.246':139
'67.##3.95.15':139
'67.##3.84.186':445
'67.##3.18.23':445
'67.##3.250.100':445
'67.##3.27.204':445
'67.##3.17.25':445
'67.##3.237.16':445
'67.##3.39.251':445
'67.##3.115.197':445
'67.##3.34.215':445
'67.#33.8.0':445
'67.##3.2.172':445
'67.##3.255.121':445
'67.##3.135.176':445
'67.##3.63.116':445
'67.##3.188.139':445
'67.##3.212.159':445
'67.##3.59.241':139
'67.##3.116.54':445
'67.##3.98.45':445
'67.##3.185.185':445
'67.##3.6.172':445
'67.##3.123.246':445
'67.##3.121.193':445
'67.##3.193.198':445
'67.##3.232.212':445
'67.##3.95.15':445
'67.##3.195.84':139
'67.##3.82.34':139
'67.##3.161.112':139
'67.#33.64.6':139
'67.##3.200.130':139
'67.##3.174.55':139
'67.##3.50.207':139
'67.##3.206.120':139
'67.##3.57.244':445
'67.##3.143.57':445
'67.##3.15.30':445
'67.##3.102.4':139
'67.##3.239.11':139
'67.##3.187.163':139
'67.##3.37.226':139
'67.#33.55.8':139
'67.##3.168.107':139
'67.##3.143.57':139
'67.##3.15.30':139
'67.##3.153.177':139
'67.##3.247.203':139
'67.##3.193.95':139
'67.##3.254.141':139
'67.##3.239.163':139
'67.##3.220.27':139
'67.##3.41.188':139
'67.##3.184.185':139
'67.#33.64.6':445
'67.##3.206.120':445
'67.##3.102.4':445
'67.##3.50.207':445
'67.##3.82.34':445
'67.##3.161.112':445
'67.##3.239.11':445
'67.##3.169.103':139
'67.##3.86.156':139
'67.##3.40.162':139
'67.##3.187.163':445
'67.##3.16.127':139
'67.##3.241.29':139
'67.##3.168.107':445
'67.##3.247.203':445
'67.##3.220.27':445
'67.##3.153.177':445
'67.##3.37.226':445
'67.#33.55.8':445
'67.##3.41.188':445
'67.##3.239.163':445
'67.##3.200.130':445
'67.##3.174.55':445
'67.##3.184.185':445
'67.##3.193.95':445
'67.##3.254.141':445
'67.##3.45.33':139
'67.##3.54.192':139
'67.##3.188.49':139
'67.##3.63.48':139
'67.##3.188.253':139
'67.##3.39.85':139
'67.##3.70.83':139
'67.##3.136.171':139
'67.##3.211.100':445
'67.##3.84.230':445
'67.##3.96.130':139
'67.##3.162.188':139
'67.##3.87.186':139
'67.##3.53.247':139
'67.##3.76.69':139
'67.##3.65.185':139
'67.##3.177.195':139
'67.##3.81.165':139
'67.##3.165.119':139
'67.##3.45.154':139
'67.##3.131.108':139
'67.##3.21.105':139
'67.##3.96.14':139
'67.##3.55.45':139
'67.##3.62.55':139
'67.##3.88.88':139
'67.##3.39.85':445
'67.##3.45.33':445
'67.##3.54.192':445
'67.##3.96.14':445
'67.##3.63.48':445
'67.##3.188.253':445
'67.##3.188.49':445
'67.##3.87.186':445
'67.##3.136.171':445
'67.##3.57.244':139
'67.##3.70.83':445
'67.##3.96.130':445
'67.##3.162.188':445
'67.##3.165.119':445
'67.##3.53.247':445
'67.##3.76.69':445
'67.##3.195.84':445
'67.##3.177.195':445
'67.##3.81.165':445
'67.##3.65.185':445
'67.##3.88.88':445
'67.##3.131.108':445
'67.##3.21.105':445
'67.##3.45.154':445
'67.##3.55.45':445
'67.##3.62.55':445
'67.##3.114.254':445
'67.##3.200.41':445
'67.##3.27.13':445
'67.##3.118.135':445
'67.##3.178.222':445
'67.##3.85.178':445
'67.##3.85.52':445
'67.#33.9.26':445
'67.##3.2.180':445
'67.##3.227.193':445
'67.##3.59.221':445
'67.##3.235.22':445
'67.##3.246.230':445
'67.##3.77.110':445
'67.##3.118.4':445
'67.##3.237.98':445
'67.##3.122.222':445
'67.##3.24.72':445
'67.##3.192.23':445
'67.##3.231.192':445
'67.##3.151.206':445
'67.##3.234.202':445
'67.##3.58.234':445
'67.##3.184.5':445
'67.##3.183.163':445
'67.##3.235.44':445
'67.##3.139.118':445
'67.##3.142.209':445
'67.##3.47.232':445
'67.##3.155.48':445
'67.##3.37.58':445
'67.##3.186.129':445
'67.##3.188.4':445
'67.##3.237.154':445
'67.##3.105.45':445
'67.##3.24.72':9988
'67.##3.192.23':9988
'67.##3.187.155':445
'67.##3.41.183':445
'67.#33.8.61':445
'67.##3.10.110':445
'67.#33.77.5':445
'67.##3.73.190':445
'67.##3.56.220':445
'67.##3.253.56':445
'67.##3.23.253':445
'67.##3.29.74':445
'67.##3.148.220':445
'67.##3.41.242':445
'67.##3.81.78':445
'67.##3.229.28':445
'67.##3.243.228':445
'67.##3.220.243':445
'67.##3.85.52':139
'67.##3.200.41':139
'67.##3.27.13':139
'67.##3.184.5':139
'67.##3.178.222':139
'67.##3.85.178':139
'67.##3.118.135':139
'67.##3.77.110':139
'67.##3.2.180':139
'67.##3.227.193':139
'67.#33.9.26':139
'67.##3.235.22':139
'67.##3.246.230':139
'67.##3.231.192':139
'67.##3.118.4':139
'67.##3.237.98':139
'67.##3.71.203':139
'67.##3.24.72':139
'67.##3.192.23':139
'67.##3.122.222':139
'67.##3.139.118':139
'67.##3.234.202':139
'67.##3.58.234':139
'67.##3.151.206':139
'67.##3.183.163':139
'67.##3.235.44':139
'67.##3.188.4':139
'67.##3.142.209':139
'67.##3.47.232':139
'67.##3.81.78':139
'67.##3.37.58':139
'67.##3.186.129':139
'67.##3.155.48':139
'67.#33.8.61':139
'67.##3.105.45':139
'67.##3.71.203':445
'67.##3.237.154':139
'67.##3.187.155':139
'67.##3.41.183':139
'67.##3.23.253':139
'67.##3.10.110':139
'67.#33.77.5':139
'67.##3.59.221':139
'67.##3.56.220':139
'67.##3.253.56':139
'67.##3.73.190':139
'67.##3.220.243':139
'67.##3.148.220':139
'67.##3.41.242':139
'67.##3.29.74':139
'67.##3.229.28':139
'67.##3.243.228':139
'67.##3.71.203':9988
'67.##3.70.100':139
'67.##3.21.245':139
'67.##3.99.213':139
'67.##3.107.27':139
'67.##3.241.4':139
'67.##3.177.49':139
'67.##3.57.219':139
'67.##3.24.157':139
'67.##3.9.251':139
'67.##3.96.126':139
'67.##3.94.206':139
'67.##3.169.254':139
'67.##3.72.89':139
'67.##3.188.112':445
'67.##3.222.167':445
'67.##3.140.175':139
'67.##3.28.96':445
'67.#33.1.94':445
'67.##3.130.238':445
'67.##3.240.161':139
'67.##3.246.68':139
'67.##3.160.9':139
'67.##3.89.200':139
'67.##3.237.239':139
'67.##3.93.75':139
'67.##3.136.21':139
'67.##3.99.213':445
'67.##3.57.219':445
'67.##3.94.206':445
'67.##3.177.49':445
'67.##3.70.100':445
'67.##3.21.245':445
'67.##3.169.254':445
'67.##3.96.126':445
'67.#33.8.51':445
'67.##3.102.61':445
'67.##3.72.89':445
'67.##3.24.157':445
'67.##3.9.251':445
'67.##3.140.175':445
'67.##3.240.161':445
'67.##3.237.239':445
'67.#33.8.51':139
'67.##3.102.61':139
'67.##3.114.254':139
'67.##3.93.75':445
'67.##3.89.200':445
'67.##3.107.27':445
'67.##3.241.4':445
'67.##3.136.21':445
'67.##3.246.68':445
'67.##3.160.9':445
'67.##3.175.160':139
'67.##3.236.159':139
'67.##3.154.188':139
'67.##3.68.228':139
'67.##3.69.50':139
'67.##3.225.181':139
'67.##3.84.154':139
'67.##3.169.49':139
'67.##3.191.146':139
'67.##3.83.217':139
'67.##3.40.111':139
'67.##3.26.142':139
'67.##3.187.246':139
'67.##3.235.44':9988
'67.##3.184.5':9988
'67.##3.178.222':9988
'67.##3.122.222':9988
'67.##3.151.206':9988
'67.##3.183.163':9988
'67.##3.56.220':9988
'67.##3.237.154':9988
'67.##3.47.245':139
'67.##3.109.91':139
'67.##3.253.56':9988
'67.##3.23.253':9988
'67.#33.77.5':9988
'67.##3.84.154':445
'67.##3.40.111':445
'67.##3.26.142':445
'67.##3.175.160':445
'67.##3.236.159':445
'67.##3.154.188':445
'67.##3.187.246':445
'67.##3.74.209':445
'67.##3.60.54':445
'67.##3.234.59':445
'67.##3.169.49':445
'67.##3.191.146':445
'67.##3.83.217':445
'67.##3.28.96':139
'67.#33.1.94':139
'67.##3.130.238':139
'67.##3.74.209':139
'67.##3.60.54':139
'67.##3.234.59':139
'67.##3.188.112':139
'67.##3.68.228':445
'67.##3.69.50':445
'67.##3.225.181':445
'67.##3.222.167':139
'67.##3.47.245':445
'67.##3.109.91':445

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial