Trojan.DownLoader10.3412

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3603.dir00\svchost.exe.mdmp 16325836412032536

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER3603.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Deletes itself.

Network activity:

Connects to:

'21#.#40.5.123':445
'21#.#40.128.66':445
'21#.#40.61.216':445
'21#.#40.122.54':445
'21#.#40.118.125':445
'21#.#40.76.141':139
'21#.#40.194.71':139
'21#.#40.158.237':445
'21#.#40.68.167':445
'21#.#40.31.218':445
'21#.#40.99.74':445
'21#.#40.54.114':445
'21#.#40.125.55':445
'21#.#40.1.28':445
'21#.#40.199.176':445
'21#.#40.37.26':445
'21#.#40.237.93':445
'21#.#40.228.207':445
'21#.#40.113.81':445
'21#.#40.187.240':139
'21#.#40.95.89':139
'21#.#40.116.95':139
'21#.#40.120.20':139
'21#.#40.25.190':139
'21#.#40.229.116':139
'21#.#40.150.20':139
'21#.#40.215.221':139
'21#.#40.116.53':139
'21#.#40.32.61':139
'21#.#40.211.182':139
'21#.#40.23.196':139
'21#.#40.193.87':139
'21#.#40.148.187':139
'21#.#40.80.149':139
'21#.#40.12.178':139
'21#.#40.49.27':139
'21#.#40.186.90':139
'21#.#40.21.132':139
'21#.#40.28.107':139
'21#.#40.169.116':445
'21#.#40.33.153':445
'21#.#40.183.65':445
'21#.#40.4.147':445
'21#.#40.40.81':445
'21#.#40.192.180':445
'21#.#40.251.64':445
'21#.#40.203.140':445
'21#.#40.129.74':445
'21#.#40.65.20':445
'21#.#40.71.167':445
'21#.#40.128.66':139
'21#.#40.118.125':139
'21#.#40.122.54':139
'21#.#40.5.123':139
'21#.#40.158.237':139
'21#.#40.219.153':445
'21#.#40.212.146':445
'21#.#40.68.167':139
'21#.#40.65.32':445
'21#.#40.77.253':445
'21#.#40.62.97':445
'21#.#40.226.83':445
'21#.#40.42.74':445
'21#.#40.85.218':445
'21#.#40.152.59':445
'21#.#40.200.146':445
'21#.#40.101.113':445
'21#.#40.82.137':445
'21#.#40.147.82':445
'21#.#40.16.190':445
'21#.#40.57.92':445
'21#.#40.234.15':445
'21#.#40.109.59':445
'21#.#40.79.68':445
'21#.#40.38.253':445
'21#.#40.105.157':445
'21#.#40.73.42':445
'21#.#40.117.202':445
'21#.#40.51.26':445
'21#.#40.52.121':139
'21#.#40.13.161':445
'21#.#40.4.207':445
'21#.#40.52.121':445
'21#.#40.161.95':445
'21#.#40.202.193':445
'21#.#40.66.199':445
'21#.#40.155.224':445
'21#.#40.72.203':445
'21#.#40.103.183':445
'21#.#40.215.221':445
'21#.#40.25.190':445
'21#.#40.95.89':445
'21#.#40.211.182':445
'21#.#40.120.20':445
'21#.#40.116.95':445
'21#.#40.32.61':445
'21#.#40.150.20':445
'21#.#40.229.116':445
'21#.#40.116.53':445
'21#.#40.148.152':445
'21#.#40.123.118':445
'21#.#40.83.123':445
'21#.#40.79.180':445
'21#.#40.250.167':445
'21#.#40.40.44':445
'21#.#40.150.36':445
'21#.#40.135.222':445
'21#.#40.236.115':445
'21#.#40.19.15':445
'21#.#40.8.27':445
'21#.#40.138.5':445
'21#.#40.115.138':445
'21#.#40.172.192':445
'21#.#40.5.146':445
'21#.#40.46.155':445
'21#.#40.175.8':445
'21#.#40.44.239':445
'21#.#40.154.8':445
'21#.#40.114.132':445
'21#.#40.186.90':445
'21#.#40.115.138':139
'21#.#40.46.155':139
'21#.#40.5.146':139
'21#.#40.138.5':139
'21#.#40.154.8':139
'21#.#40.44.239':139
'21#.#40.8.27':139
'21#.#40.114.132':139
'21#.#40.175.8':139
'21#.#40.172.192':139
'21#.#40.4.207':139
'21#.#40.202.193':139
'21#.#40.161.95':139
'21#.#40.13.161':139
'21#.#40.72.203':139
'21#.#40.155.224':139
'21#.#40.148.152':139
'21#.#40.103.183':139
'21#.#40.66.199':139
'21#.#40.79.180':139
'21#.#40.80.149':445
'21#.#40.23.196':445
'21#.#40.187.240':445
'21#.#40.148.187':445
'21#.#40.193.87':445
'21#.#40.28.107':445
'21#.#40.49.27':445
'21#.#40.12.178':445
'21#.#40.21.132':445
'21#.#40.194.71':445
'21#.#40.83.123':139
'21#.#40.40.44':139
'21#.#40.250.167':139
'21#.#40.123.118':139
'21#.#40.236.115':139
'21#.#40.135.222':139
'21#.#40.76.141':445
'21#.#40.19.15':139
'21#.#40.150.36':139
'21#.#40.98.100':445
'21#.#40.212.37':445
'21#.#40.33.33':139
'21#.#40.27.229':445
'21#.#40.29.139':445
'21#.#40.197.229':445
'21#.#40.12.112':445
'21#.#40.129.15':445
'21#.#40.99.1':445
'21#.#40.67.208':139
'21#.#40.204.51':139
'21#.#40.7.27':139
'21#.#40.22.194':139
'21#.#40.60.44':139
'21#.#40.19.249':139
'21#.#40.207.11':139
'21#.#40.50.171':139
'21#.#40.186.104':139
'21#.#40.247.200':139
'21#.#40.102.195':445
'21#.#40.72.248':445
'21#.#40.15.123':445
'21#.#40.80.34':445
'21#.#40.254.172':445
'21#.#40.150.169':445
'21#.#40.40.116':445
'21#.#40.47.242':445
'21#.#40.103.153':445
'21#.#40.40.43':445
'21#.#40.121.214':445
'21#.#40.182.130':445
'21#.#40.115.251':445
'21#.#40.59.102':445
'21#.#40.91.42':445
'21#.#40.237.21':445
'21#.#40.182.1':445
'21#.#40.218.74':445
'21#.#40.68.146':445
'21#.#40.1.68':445
'21#.#40.17.32':139
'21#.#40.115.251':139
'21#.#40.237.21':139
'21#.#40.91.42':139
'21#.#40.182.130':139
'21#.#40.68.146':139
'21#.#40.218.74':139
'21#.#40.121.214':139
'21#.#40.1.68':139
'21#.#40.182.1':139
'21#.#40.59.102':139
'21#.#40.29.139':139
'21#.#40.129.15':139
'21#.#40.98.100':139
'21#.#40.27.229':139
'21#.#40.99.1':139
'21#.#40.12.112':139
'21#.#40.102.195':139
'21#.#40.212.37':139
'21#.#40.197.229':139
'21#.#40.80.34':139
'21#.#40.10.9':139
'21#.#40.33.150':139
'21#.#40.136.23':139
'21#.#40.236.137':139
'21#.#40.59.125':139
'21#.#40.135.196':139
'21#.#40.83.61':139
'21#.#40.213.207':139
'21#.#40.76.213':139
'21#.#40.213.76':139
'21#.#40.15.123':139
'21#.#40.150.169':139
'21#.#40.254.172':139
'21#.#40.72.248':139
'21#.#40.103.153':139
'21#.#40.47.242':139
'21#.#40.138.163':139
'21#.#40.40.43':139
'21#.#40.40.116':139
'21#.#40.138.163':445
'21#.#40.38.253':139
'21#.#40.117.202':139
'21#.#40.57.92':139
'21#.#40.234.15':139
'21#.#40.51.26':139
'21#.#40.16.190':139
'21#.#40.42.74':139
'21#.#40.105.157':139
'21#.#40.73.42':139
'21#.#40.79.68':139
'21#.#40.192.180':139
'21#.#40.129.74':139
'21#.#40.33.153':139
'21#.#40.183.65':139
'21#.#40.65.20':139
'21#.#40.77.253':139
'21#.#40.109.59':139
'21#.#40.251.64':139
'21#.#40.203.140':139
'21#.#40.85.218':139
'21#.#40.199.176':139
'21#.#40.228.207':139
'21#.#40.99.74':139
'21#.#40.54.114':139
'21#.#40.113.81':139
'21#.#40.31.218':139
'21#.#40.61.216':139
'21#.#40.37.26':139
'21#.#40.237.93':139
'21#.#40.1.28':139
'21#.#40.152.59':139
'21#.#40.82.137':139
'21#.#40.62.97':139
'21#.#40.226.83':139
'21#.#40.147.82':139
'21#.#40.169.116':139
'21#.#40.125.55':139
'21#.#40.200.146':139
'21#.#40.101.113':139
'21#.#40.40.81':139
'21#.#40.60.44':445
'21#.#40.204.51':445
'21#.#40.17.32':445
'21#.#40.22.194':445
'21#.#40.7.27':445
'21#.#40.247.200':445
'21#.#40.207.11':445
'21#.#40.19.249':445
'21#.#40.186.104':445
'21#.#40.83.61':445
'21#.#40.236.137':445
'21#.#40.10.9':445
'21#.#40.213.76':445
'21#.#40.136.23':445
'21#.#40.33.150':445
'21#.#40.76.213':445
'21#.#40.135.196':445
'21#.#40.59.125':445
'21#.#40.213.207':445
'21#.#40.50.171':445
'21#.#40.40.116':9988
'21#.#40.213.76':9988
'21#.#40.129.15':9988
'21#.#40.27.229':9988
'21#.#40.65.32':139
'21#.#40.71.167':139
'21#.#40.4.147':139
'21#.#40.219.153':139
'21#.#40.212.146':139
'21#.#40.98.100':9988
'21#.#40.29.139':9988
'21#.#40.72.248':9988
'21#.#40.67.208':445
'21#.#40.33.33':445
'21#.#40.15.123':9988
'21#.#40.182.1':9988
'21#.#40.197.229':9988
'21#.#40.254.172':9988
'21#.#40.212.37':9988

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial