Trojan.DownLoader10.3399

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERe621.dir00\svchost.exe.mdmp 16325836412032736

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERe621.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Deletes itself.

Network activity:

Connects to:

'58.##3.157.245':139
'58.##3.230.125':139
'58.##3.1.111':139
'58.##3.152.78':139
'58.##3.100.192':139
'58.##3.42.29':139
'58.##3.163.238':139
'58.##3.213.230':139
'58.##3.41.11':139
'58.##3.231.249':139
'58.##3.239.254':139
'58.##3.215.2':139
'58.##3.29.63':139
'58.##3.104.219':139
'58.##3.2.172':139
'58.##3.173.113':139
'58.##3.169.186':139
'58.##3.179.251':139
'58.##3.100.231':139
'58.##3.43.16':139
'58.##3.122.162':139
'58.##3.239.239':139
'58.##3.54.81':139
'58.##3.217.227':139
'58.##3.58.51':139
'58.##3.145.150':139
'58.##3.60.104':139
'58.##3.161.247':139
'58.##3.126.185':139
'58.##3.104.161':139
'58.##3.36.129':139
'58.##3.126.185':445
'58.##3.1.111':445
'58.##3.145.150':445
'58.##3.157.245':445
'58.##3.100.192':445
'58.##3.104.161':445
'58.##3.42.29':445
'58.##3.217.227':445
'58.##3.204.69':139
'58.##3.41.11':445
'58.##3.29.63':445
'58.##3.163.238':445
'58.##3.152.78':445
'58.##3.213.230':445
'58.##3.230.125':445
'58.##3.169.186':445
'58.##3.239.239':445
'58.##3.43.16':445
'58.##3.225.136':445
'58.##3.41.147':139
'58.##3.60.217':445
'58.##3.82.72':445
'58.##3.54.81':445
'58.##3.161.247':445
'58.##3.60.104':445
'58.##3.58.51':445
'58.##3.173.113':445
'58.##3.122.162':445
'58.##3.179.251':445
'58.##3.100.231':445
'58.##3.225.136':139
'58.##3.142.139':445
'58.##3.176.104':445
'58.##3.149.161':445
'58.##3.139.134':445
'58.##3.136.42':445
'58.##3.50.132':445
'58.##3.31.201':445
'58.##3.167.180':445
'58.##3.224.228':445
'58.##3.117.107':139
'58.##3.62.23':139
'58.#93.56.1':139
'58.##3.50.167':445
'58.##3.92.27':445
'58.##3.70.50':445
'58.#93.0.88':445
'58.##3.132.47':445
'58.##3.237.212':445
'58.##3.90.75':445
'58.##3.65.182':445
'58.##3.107.236':445
'58.##3.12.240':445
'58.##3.216.238':445
'58.##3.176.136':445
'58.##3.77.176':445
'58.##3.59.49':445
'58.##3.159.74':445
'58.##3.107.87':445
'58.##3.88.159':445
'58.##3.160.234':445
'58.##3.216.45':139
'58.##3.141.93':445
'58.##3.247.42':445
'58.##3.213.40':445
'58.##3.146.105':445
'58.##3.216.45':445
'58.##3.57.112':445
'58.##3.43.188':445
'58.##3.214.125':445
'58.##3.93.65':445
'58.##3.82.72':139
'58.##3.38.246':445
'58.##3.60.217':139
'58.##3.210.51':445
'58.##3.167.109':445
'58.##3.106.11':445
'58.##3.214.125':139
'58.##3.247.42':139
'58.##3.141.93':139
'58.##3.93.65':139
'58.##3.57.112':139
'58.##3.43.188':139
'58.##3.146.105':139
'58.##3.38.246':139
'58.##3.117.107':445
'58.#93.56.1':445
'58.##3.62.23':445
'58.##3.106.11':139
'58.##3.213.40':139
'58.##3.167.109':139
'58.##3.210.51':139
'58.##3.104.219':445
'58.##3.116.247':445
'58.##3.107.40':445
'58.##3.175.239':445
'58.##3.129.71':445
'58.##3.96.129':445
'58.##3.16.111':445
'58.##3.52.54':445
'58.##3.202.117':445
'58.##3.121.19':445
'58.##3.8.157':445
'58.##3.163.90':445
'58.##3.95.158':445
'58.##3.69.214':445
'58.##3.86.158':445
'58.##3.169.188':445
'58.##3.216.27':139
'58.##3.55.122':139
'58.##3.34.170':139
'58.##3.34.124':139
'58.##3.82.249':139
'58.##3.37.27':139
'58.##3.116.48':139
'58.##3.121.206':139
'58.##3.165.177':445
'58.##3.86.106':445
'58.##3.70.244':445
'58.##3.1.103':445
'58.##3.109.247':139
'58.##3.183.121':139
'58.##3.153.108':445
'58.##3.126.12':445
'58.##3.62.72':139
'58.##3.84.163':139
'58.##3.102.12':139
'58.##3.57.221':139
'58.##3.132.76':139
'58.##3.93.102':139
'58.##3.221.159':139
'58.##3.115.101':139
'58.##3.157.74':139
'58.##3.169.7':139
'58.##3.123.22':139
'58.##3.84.34':139
'58.##3.50.111':139
'58.##3.172.19':139
'58.##3.205.113':139
'58.##3.216.27':445
'58.##3.152.104':445
'58.##3.34.170':445
'58.##3.37.27':445
'58.##3.206.143':445
'58.##3.104.89':445
'58.##3.80.152':445
'58.##3.55.122':445
'58.##3.116.48':445
'58.##3.82.249':445
'58.##3.102.94':139
'58.##3.109.247':445
'58.##3.34.124':445
'58.##3.121.206':445
'58.##3.183.121':445
'58.##3.104.89':139
'58.##3.208.87':139
'58.##3.144.65':139
'58.##3.153.108':139
'58.##3.108.211':139
'58.##3.54.115':139
'58.##3.117.122':139
'58.##3.185.117':139
'58.##3.204.69':445
'58.##3.156.96':445
'58.##3.199.251':445
'58.##3.8.186':445
'58.##3.37.145':445
'58.##3.25.81':445
'58.##3.1.103':139
'58.#93.9.38':445
'58.##3.239.254':445
'58.##3.36.129':445
'58.##3.41.147':445
'58.##3.231.249':445
'58.##3.215.2':445
'58.##3.25.81':139
'58.##3.2.172':445
'58.##3.156.96':139
'58.##3.33.163':139
'58.##3.71.44':139
'58.##3.133.215':139
'58.##3.8.186':139
'58.##3.199.251':139
'58.##3.37.145':139
'58.#93.9.38':139
'58.##3.133.215':445
'58.##3.69.214':139
'58.##3.169.188':139
'58.##3.86.158':139
'58.##3.202.117':139
'58.##3.116.247':139
'58.##3.107.40':139
'58.##3.175.239':139
'58.##3.121.19':139
'58.##3.206.143':139
'58.##3.152.104':139
'58.##3.80.152':139
'58.##3.126.12':139
'58.##3.95.158':139
'58.##3.8.157':139
'58.##3.163.90':139
'58.##3.86.106':139
'58.##3.108.211':445
'58.##3.208.87':445
'58.##3.117.122':445
'58.##3.33.163':445
'58.##3.185.117':445
'58.##3.71.44':445
'58.##3.54.115':445
'58.##3.52.54':139
'58.##3.70.244':139
'58.##3.129.71':139
'58.##3.96.129':139
'58.##3.144.65':445
'58.##3.165.177':139
'58.##3.16.111':139
'58.##3.21.226':445
'58.##3.235.64':445
'58.##3.53.231':445
'58.##3.26.243':445
'58.##3.25.199':445
'58.##3.181.122':445
'58.##3.38.43':445
'58.##3.218.244':445
'58.##3.138.209':445
'58.##3.141.160':445
'58.##3.91.214':445
'58.##3.214.164':445
'58.##3.131.221':445
'58.##3.34.104':445
'58.##3.73.131':445
'58.##3.83.12':445
'58.##3.205.189':445
'58.##3.198.205':445
'58.##3.107.154':445
'58.##3.219.98':445
'58.##3.64.116':445
'58.##3.42.147':445
'58.#93.7.91':445
'58.##3.73.181':445
'58.##3.25.82':445
'58.##3.41.199':445
'58.##3.41.77':445
'58.##3.17.189':445
'58.##3.131.89':445
'58.##3.73.97':445
'58.##3.89.117':445
'58.##3.131.89':9988
'58.##3.83.12':9988
'58.##3.17.189':9988
'58.##3.205.189':9988
'58.##3.198.205':9988
'58.##3.131.221':9988
'58.##3.89.117':9988
'58.##3.41.199':9988
'58.##3.86.182':139
'58.##3.3.238':139
'58.##3.235.91':139
'58.##3.219.98':9988
'58.##3.42.147':9988
'58.#93.7.91':9988
'58.##3.25.199':9988
'58.##3.52.93':445
'58.##3.132.14':445
'58.#93.23.2':445
'58.##3.80.89':445
'58.##3.103.182':445
'58.##3.112.127':445
'58.##3.72.171':445
'58.##3.80.97':445
'58.##3.181.122':9988
'58.##3.177.189':9988
'58.##3.138.209':9988
'58.##3.25.82':9988
'58.##3.110.80':445
'58.##3.52.93':9988
'58.##3.214.146':9988
'58.##3.216.107':445
'58.##3.38.43':139
'58.##3.17.189':139
'58.##3.131.89':139
'58.##3.41.199':139
'58.##3.83.12':139
'58.##3.205.189':139
'58.##3.198.205':139
'58.#93.7.91':139
'58.##3.181.122':139
'58.##3.73.181':139
'58.##3.26.243':139
'58.##3.41.77':139
'58.##3.25.82':139
'58.##3.73.97':139
'58.##3.25.199':139
'58.##3.205.254':139
'58.##3.190.20':139
'58.##3.64.116':139
'58.##3.42.147':139
'58.##3.177.189':139
'58.##3.39.37':139
'58.##3.214.146':139
'58.##3.44.210':139
'58.##3.247.115':139
'58.##3.64.245':139
'58.##3.216.107':139
'58.##3.3.205':139
'58.##3.33.226':139
'58.##3.219.98':139
'58.##3.107.154':139
'58.##3.131.221':139
'58.##3.110.80':139
'58.##3.177.189':445
'58.##3.214.146':445
'58.##3.80.97':139
'58.##3.72.171':139
'58.##3.132.14':139
'58.#93.23.2':139
'58.##3.3.205':445
'58.##3.190.20':445
'58.##3.44.210':445
'58.##3.247.115':445
'58.##3.205.254':445
'58.##3.33.226':445
'58.##3.39.37':445
'58.##3.64.245':445
'58.##3.34.104':139
'58.##3.141.160':139
'58.##3.73.131':139
'58.##3.53.231':139
'58.##3.235.64':139
'58.##3.218.244':139
'58.##3.21.226':139
'58.##3.138.209':139
'58.##3.112.127':139
'58.##3.80.89':139
'58.##3.52.93':139
'58.##3.103.182':139
'58.##3.214.164':139
'58.##3.91.214':139
'58.##3.89.117':139
'58.##3.171.235':139
'58.##3.203.238':445
'58.##3.75.99':445
'58.##3.58.64':445
'58.##3.239.89':445
'58.##3.80.242':445
'58.##3.101.183':445
'58.##3.157.17':445
'58.##3.191.83':445
'58.##3.31.109':445
'58.##3.173.245':445
'58.#93.47.5':445
'58.##3.107.164':445
'58.##3.51.75':445
'58.##3.203.183':445
'58.##3.164.185':445
'58.##3.75.99':139
'58.##3.58.64':139
'58.##3.191.83':139
'58.##3.203.238':139
'58.##3.101.183':139
'58.##3.157.17':139
'58.##3.239.89':139
'58.##3.51.75':139
'58.##3.173.245':139
'58.#93.47.5':139
'58.##3.174.46':445
'58.##3.31.109':139
'58.##3.203.183':139
'58.##3.164.185':139
'58.##3.107.164':139
'58.##3.65.182':139
'58.##3.139.134':139
'58.##3.142.139':139
'58.##3.176.104':139
'58.##3.59.49':139
'58.##3.136.42':139
'58.##3.176.136':139
'58.##3.77.176':139
'58.##3.149.161':139
'58.##3.224.228':139
'58.##3.31.225':445
'58.##3.108.178':445
'58.##3.92.27':139
'58.##3.167.180':139
'58.##3.50.167':139
'58.##3.70.50':139
'58.##3.90.75':139
'58.#93.0.88':139
'58.##3.107.87':139
'58.##3.12.240':139
'58.##3.31.225':139
'58.##3.108.178':139
'58.##3.107.236':139
'58.##3.237.212':139
'58.##3.159.74':139
'58.##3.160.234':139
'58.##3.88.159':139
'58.##3.50.132':139
'58.##3.132.47':139
'58.##3.216.238':139
'58.##3.31.201':139
'58.##3.80.242':139
'58.##3.45.224':139
'58.##3.231.45':139
'58.#93.15.0':139
'58.##3.103.234':139
'58.##3.28.234':139
'58.##3.221.183':139
'58.##3.109.97':139
'58.##3.121.112':139
'58.##3.247.115':9988
'58.##3.107.154':9988
'58.##3.86.182':445
'58.##3.204.57':139
'58.##3.59.212':139
'58.##3.239.144':139
'58.##3.38.228':139
'58.##3.138.84':139
'58.##3.116.29':139
'58.##3.150.67':139
'58.##3.173.171':139
'58.##3.154.122':139
'58.##3.249.187':139
'58.##3.116.40':139
'58.##3.15.178':139
'58.##3.117.13':139
'58.#93.8.35':139
'58.##3.130.112':139
'58.##3.85.236':139
'58.##3.205.29':139
'58.##3.144.73':139
'58.##3.137.250':139
'58.##3.3.238':445
'58.##3.221.183':445
'58.##3.103.234':445
'58.##3.45.224':445
'58.##3.109.97':445
'58.#93.8.35':445
'58.##3.130.112':445
'58.##3.28.234':445
'58.##3.231.45':445
'58.##3.239.144':445
'58.##3.204.57':445
'58.##3.174.46':139
'58.##3.38.228':445
'58.#93.15.0':445
'58.##3.121.112':445
'58.##3.59.212':445
'58.##3.116.40':445
'58.##3.173.171':445
'58.##3.138.84':445
'58.##3.249.187':445
'58.##3.235.91':445
'58.##3.171.235':445
'58.##3.154.122':445
'58.##3.116.29':445
'58.##3.137.250':445
'58.##3.85.236':445
'58.##3.117.13':445
'58.##3.144.73':445
'58.##3.150.67':445
'58.##3.15.178':445
'58.##3.205.29':445

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial