Trojan.DownLoader8.15508

Technical Information

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\services.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n

Deletes itself.

Network activity:

Connects to:

'any':80
'j.###mind.com':80

TCP:

HTTP GET requests:

any/5699017-3C912481A04E584CDF231C519E1DF857/counter.img?th##########################
j.###mind.com/app/geoip.js

UDP:

DNS ASK pz#��/
DNS ASK pz#/1��
DNS ASK pz#6C��
DNS ASK pz#�u
DNS ASK pz#�hl
DNS ASK pz#��
DNS ASK j.###mind.com
DNS ASK pz#y�
DNS ASK pz#��h
DNS ASK pz#)h�
'18#.#88.42.192':16464
'79.##2.192.187':16464
'18#.#8.99.187':16464
'5.##.86.116':16464
'18#.#73.36.202':16464
'11#.#41.197.113':16464
'86.##4.254.200':16464
'69.##3.122.253':16464
'90.##6.206.121':16464
'95.##1.45.123':16464
'76.##1.43.121':16464
'78.##.213.186':16464
'90.##.90.120':16464
'24.##3.107.120':16464
'94.##5.187.209':16464
'12#.#45.24.208':16464
'18#.#73.147.205':16464
'50.##2.250.220':16464
'70.##.197.223':16464
'21#.#6.66.223':16464
'11#.#70.30.24':16464
'67.##7.229.110':16464
'70.##.206.111':16464
'20#.#7.53.22':16464
'85.##1.132.203':16464
'71.##8.126.204':16464
'49.##6.139.105':16464
'69.##6.29.107':16464
'14.##.147.181':16464
'97.##.228.180':16464
'95.##1.131.179':16464
'14.##.129.254':16464
'19#.#4.92.135':16464
'19#.#45.250.135':16464
'17#.#50.117.136':16464
'97.##.161.146':16464
'12#.#38.180.254':16464
'24.##6.173.147':16464
'18#.#60.174.145':16464
'20#.#09.171.140':16464
'18#.#01.59.141':16464
'21#.#29.52.179':16464
'20#.#42.107.128':16464
'11#.#97.35.130':16464
'17#.#4.11.131':16464
'24.##.154.127':16464
'12#.#21.249.15':16464
'17#.#37.165.13':16464
'15#.#4.109.186':16464
'31.##1.143.133':16464
'78.##.183.253':16464
'24.#.133.134':16464
'17#.#21.223.183':16464
'75.##.109.13':16464
'21#.#33.144.131':16464
'84.##6.230.132':16464
'72.##6.121.98':16464
'81.##9.69.250':16464
'24.##.51.250':16464
'89.##5.114.50':16464
'67.##3.42.48':16464
'18#.#29.1.45':16464
'88.##2.82.45':16464
'11#.#04.78.250':16464
'18#.#41.135.248':16464
'88.##2.144.60':16464
'24.#.124.28':16464
'18#.#2.95.249':16464
'18#.#4.50.250':16464
'66.##3.225.50':16464
'12#.#5.45.250':16464
'88.##.156.29':16464
'75.##.15.252':16464
'20#.#26.233.32':16464
'70.##8.8.139':16464
'18#.#4.29.69':16464
'46.#9.2.61':16464
'66.##.239.36':16464
'14.##.120.39':16464
'15#.#0.47.251':16464
'11#.#94.247.43':16464
'15#.#6.124.251':16464
'79.#.3.252':16464
'20#.#10.18.29':16464
'46.##9.206.251':16464
'18#.#0.47.239':16464
'79.##8.171.92':16464
'95.#8.4.237':16464
'19#.#01.123.89':16464
'12#.#18.56.253':16464
'24.##.240.85':16464
'21#.#38.28.240':16464
'10#.#3.169.229':16464
'78.##.64.228':16464
'10#.#3.189.224':16464
'11#.#50.62.231':16464
'1.###.203.94':16464
'20#.#0.37.95':16464
'17#.#77.161.231':16464
'17#.#9.144.69':16464
'2.###.222.69':16464
'11#.#8.60.252':16464
'78.##2.85.28':16464
'24.##.166.62':16464
'70.##.171.63':16464
'37.##0.41.66':16464
'11#.#9.224.78':16464
'70.##2.95.243':16464
'75.##0.6.241':16464
'18#.#8.201.77':16464
'21#.#15.76.76':16464
'78.##4.168.76':16464
'74.##3.91.252':16464
'78.##0.89.84':16464
'74.##.178.76':16464
'95.##0.103.74':16464
'46.##4.199.242':16464
'11#.#52.181.91':16464
'68.##4.69.89':16464
'98.##2.177.84':16464
'20#.#48.28.50':16464
'24.##7.145.48':16464
'5.##.117.47':16464
'24.##1.207.50':16464
'21#.#6.96.59':16464
'11#.#41.202.54':16464
'67.##.200.53':16464
'46.##7.4.102':16464
'72.##9.6.224':16464
'17#.#49.34.98':16464
'12#.#4.95.102':16464
'84.##.149.102':16464
'78.##8.212.221':16464
'10#.#93.113.102':16464
'18#.#36.62.95':16464
'24.##1.207.93':16464
'82.##9.191.238':16464
'20#.#42.139.96':16464
'11#.#99.226.227':16464
'17#.#3.59.97':16464
'14.##.168.96':16464
'12#.#94.226.2':16464
'87.##4.253.254':16464
'88.##4.253.254':16464
'71.##9.136.3':16464
'11#.#46.108.9':16464
'20#.#95.128.8':16464
'11#.#69.208.6':16464
'18#.#54.253.254':16464
'19#.#54.253.254':16464
'20#.#54.253.254':16464
'16#.#54.253.254':16464
'92.##4.253.254':16464
'11#.#54.253.254':16464
'13#.#54.253.254':16464
'24.##0.66.31':16464
'95.##.230.26':16464
'91.##.150.26':16464
'72.##1.114.36':16464
'17#.#.192.39':16464
'87.#.193.38':16464
'50.#0.70.37':16464
'79.##7.34.18':16464
'11#.#94.41.11':16464
'11#.#8.68.10':16464
'10#.#3.239.24':16464
'24.##4.119.252':16464
'11#.#32.148.252':16464
'20#.#53.253.252':16464
'99.##0.159.218':16464
'82.##9.22.156':16464
'11#.#2.251.155':16464
'67.#.86.154':16464
'19#.#5.254.163':16464
'75.##.252.159':16464
'70.##2.240.157':16464
'18#.#8.199.163':16464
'85.##.69.175':16464
'74.##.35.177':16464
'15#.#0.197.141':16464
'19#.#54.175.146':16464
'95.##.55.153':16464
'18#.#8.48.168':16464
'24.##1.5.153':16464
'91.##1.110.5':16464
'75.##.221.165':16464
'98.##9.113.153':16464
'12#.#23.140.169':16464
'89.##7.222.150':16464
'19#.#06.200.254':16464
'74.#7.171.6':16464
'24.##2.187.160':16464
'76.##4.203.254':16464
'18#.#52.233.254':16464
'12#.#34.97.4':16464
'79.##.196.165':16464
'24.##8.70.165':16464
'11#.#13.51.164':16464
'67.##.37.104':16464
'70.#2.4.209':16464
'18#.#9.87.209':16464
'24.##5.55.104':16464
'50.##9.47.109':16464
'24.##8.83.104':16464
'13#.#9.108.205':16464
'92.##.165.217':16464
'78.##.211.217':16464
'12#.#9.248.217':16464
'18#.#0.76.215':16464
'98.##1.201.103':16464
'10#.#8.199.209':16464
'19#.#7.176.212':16464
'75.##6.57.133':16464
'50.##0.124.127':16464
'87.##.248.119':16464
'89.##.211.137':16464
'17#.#77.195.139':16464
'5.##.147.179':16464
'94.#34.27.1':16464
'99.##2.200.199':16464
'88.##2.198.114':16464
'75.##9.61.113':16464
'64.##1.93.117':16464
'94.##8.67.119':16464
'50.##.167.118':16464
'17#.#4.61.191':16464

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial