Trojan.DownLoader9.38023

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER7051.dir00\svchost.exe.mdmp 16325836412032092

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%TEMP%\WER7051.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe

Network activity:

Connects to:

'63.##9.132.141':139
'63.##9.212.131':139
'63.##9.234.234':139
'63.##9.253.234':139
'63.##9.234.211':139
'63.##9.125.156':139
'63.##9.152.180':139
'63.##9.111.130':139
'63.##9.39.77':139
'63.##9.94.190':139
'63.##9.22.225':139
'63.##9.188.141':139
'63.##9.26.11':139
'63.##9.223.25':139
'63.##9.211.163':139
'63.##9.41.114':139
'63.##9.56.159':139
'63.##9.42.49':139
'63.##9.214.108':139
'63.##9.62.214':139
'63.##9.172.60':139
'63.##9.134.38':139
'63.##9.136.215':139
'63.##9.27.29':139
'63.##9.141.27':139
'63.##9.168.223':139
'63.##9.105.227':139
'63.##9.91.209':139
'63.##9.232.206':139
'63.##9.209.105':139
'63.##9.137.190':139
'63.##9.44.188':9988
'63.##9.220.87':9988
'63.##9.195.126':9988
'63.##9.40.74':9988
'63.##9.252.22':9988
'63.##9.97.13':9988
'63.##9.97.50':9988
'63.##9.67.41':9988
'63.##9.95.245':9988
'63.##9.22.40':9988
'63.##9.163.224':9988
'63.##9.124.71':9988
'63.##9.158.90':9988
'63.##9.93.154':9988
'63.##9.175.73':9988
'63.#99.2.51':9988
'63.##9.81.138':9988
'63.##9.152.63':9988
'63.##9.73.93':9988
'63.##9.241.191':139
'63.##9.74.186':9988
'63.##9.84.22':9988
'63.##9.49.204':9988
'63.##9.39.101':9988
'63.##9.61.93':9988
'63.##9.162.161':9988
'63.##9.243.104':9988
'63.##9.135.72':9988
'63.##9.97.26':9988
'63.##9.20.30':9988
'63.##9.62.158':139
'63.##9.22.225':445
'63.##9.134.38':445
'63.##9.253.234':445
'63.##9.209.105':445
'63.##9.232.206':445
'63.##9.111.130':445
'63.##9.39.77':445
'63.##9.105.227':445
'63.##9.212.131':445
'63.##9.168.223':445
'63.##9.60.32':445
'63.##9.247.44':445
'63.##9.132.141':445
'63.##9.62.158':445
'63.##9.194.80':445
'63.##9.137.190':445
'63.##9.41.114':445
'63.##9.141.27':445
'63.##9.89.170':445
'63.##9.223.25':445
'63.##9.239.12':445
'63.##9.27.29':445
'63.##9.68.171':445
'63.##9.240.40':445
'63.##9.241.80':445
'63.##9.56.159':445
'63.##9.42.49':445
'63.##9.94.190':445
'63.##9.12.139':445
'63.##9.172.60':445
'63.##9.152.180':445
'63.##9.95.231':139
'63.##9.89.170':139
'63.##9.239.12':139
'63.##9.37.67':139
'63.##9.191.26':445
'63.##9.194.80':139
'63.##9.60.32':139
'63.##9.12.139':139
'63.##9.189.139':139
'63.##9.231.82':139
'63.##9.241.80':139
'63.##9.247.44':139
'63.##9.68.171':139
'63.##9.240.40':139
'63.##9.183.58':139
'63.##9.95.231':445
'63.##9.136.215':445
'63.##9.188.141':445
'63.##9.62.214':445
'63.##9.234.211':445
'63.##9.91.209':445
'63.##9.183.58':445
'63.##9.26.11':445
'63.##9.214.108':445
'63.##9.37.67':445
'63.##9.211.163':445
'63.##9.241.191':445
'63.##9.189.139':445
'63.##9.125.156':445
'63.##9.231.82':445
'63.##9.220.87':139
'63.##9.39.101':139
'63.##9.162.105':139
'63.##9.162.83':139
'63.##9.97.50':139
'63.##9.97.13':139
'63.##9.73.93':139
'63.##9.122.71':139
'63.##9.207.96':139
'63.##9.152.63':139
'63.##9.93.154':139
'63.##9.175.73':139
'63.##9.109.114':139
'63.##9.61.93':139
'63.##9.163.224':139
'63.##9.162.161':445
'63.##9.122.71':445
'63.##9.23.100':445
'63.##9.84.22':445
'63.##9.66.55':445
'63.##9.44.188':445
'63.##9.49.204':445
'63.##9.77.250':445
'63.##9.154.157':139
'63.##9.29.201':139
'63.##9.22.40':139
'63.##9.252.22':139
'63.#99.37.7':445
'63.##9.97.50':445
'63.##9.81.138':139
'63.##9.5.158':139
'63.##9.40.74':139
'63.##9.200.187':139
'63.##9.14.144':139
'63.##9.255.162':139
'63.##9.162.161':139
'63.##9.55.202':139
'63.##9.77.250':139
'63.#99.2.51':139
'63.##9.243.104':139
'63.##9.101.248':139
'63.##9.116.176':139
'63.#99.37.7':139
'63.##9.158.90':139
'63.##9.67.41':139
'63.##9.23.100':139
'63.##9.44.188':139
'63.##9.66.55':139
'63.##9.95.245':139
'63.##9.97.26':139
'63.##9.198.5':139
'63.##9.20.30':139
'63.##9.135.72':139
'63.##9.90.141':139
'63.##9.124.71':139
'63.##9.84.22':139
'63.##9.195.126':139
'63.#99.11.2':139
'63.##9.74.186':139
'63.##9.49.204':139
'63.#99.53.5':139
'63.##9.109.114':445
'63.##9.101.248':9988
'63.##9.200.187':9988
'63.##9.243.104':445
'63.#99.37.7':9988
'63.##9.122.71':9988
'63.##9.77.250':9988
'63.##9.90.141':9988
'63.##9.198.5':445
'63.##9.152.63':445
'63.##9.67.41':445
'63.##9.97.26':445
'63.##9.95.245':445
'63.##9.252.22':445
'63.##9.61.93':445
'63.##9.97.13':445
'63.##9.14.144':9988
'63.##9.116.176':9988
'63.##9.207.96':9988
'63.##9.162.83':9988
'63.#99.11.2':9988
'63.##9.109.114':9988
'63.##9.66.55':9988
'63.##9.55.202':9988
'63.##9.255.162':9988
'63.#99.53.5':9988
'63.##9.162.105':9988
'63.##9.154.157':9988
'63.##9.5.158':9988
'63.##9.29.201':9988
'63.##9.198.5':9988
'63.##9.162.105':445
'63.##9.93.154':445
'63.##9.81.138':445
'63.##9.200.187':445
'63.##9.39.101':445
'63.##9.195.126':445
'63.##9.22.40':445
'63.#99.53.5':445
'63.##9.29.201':445
'63.##9.90.141':445
'63.##9.74.186':445
'63.##9.220.87':445
'63.##9.116.176':445
'63.##9.73.93':445
'63.##9.135.72':445
'63.##9.255.162':445
'63.##9.40.74':445
'63.#99.2.51':445
'63.##9.101.248':445
'63.##9.207.96':445
'63.##9.158.90':445
'63.##9.162.83':445
'63.#99.11.2':445
'63.##9.154.157':445
'63.##9.55.202':445
'63.##9.5.158':445
'63.##9.124.71':445
'63.##9.14.144':445
'63.##9.175.73':445
'63.##9.163.224':445
'63.##9.20.30':445

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial