Trojan.DownLoader39.42773

Technical Information

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021060820210609\index.dat

Network activity

Connects to

'sw###mining.win':443
'oa###ocks.org':80
'ir###pic.com':80
'i.###img.com':443
'kr###na24.ru':80
'ce####itymixer.com':80
'i.####ymail.co.uk':443
'pj####.wordpress.com':443
'im#####c.timeincapp.com':443
'cr###ick.com':80
'i.###m.co.uk':443
'pe########om.files.wordpress.com':443
'th#####-cl.xhcdn.com':443
'th####peningnew.com':80
'me###mass.net':443
'cl#####sion-gion.com':80
'lo##dat.ru':80
'pr###it2016.ru':443
'ji###osek.eu':443
'cd#.##quisitr.com':443
'st####.hugedomains.com':80
'th#####eningblog.com':80
'fa#.###fappeningnew.com':443
'th#####eningblog.com':443
'pj####.#iles.wordpress.com':80
'pj####.#iles.wordpress.com':443
'x.##2.us':80
'oc##.thawte.com':80
'ji###osek.eu':80
'o.##2.us':80
'pr###it2016.ru':80
'di.##ncdn.com':443
'st###ounter.com':443
'il###4ulih.com':445
'aj##.#oogleapis.com':80
'ht######v.googlecode.com':445
'ht######v.googlecode.com':139
'microsoft.com':80
'm.####access.mobi':443
'sw###mining.win':80
'google.com':80
'im####.###ebritymoviearchive.com':80
'im#####.xvideos-cdn.com':443
'im####c.xvideos.com':443
'ne###emovie.com':443
'ga####.uludagsozluk.com':80
'cd##.aznude.com':443
'cf##e.com':80
'nu###raphy.com':80
'an###sored.com':80
'th###ppening.so':80
'i.####ymail.co.uk':80
'pj####.wordpress.com':80
'nu####lebsworld.com':80
'st####.cinemagia.ro':80
'ne######.files.wordpress.com':443
'ci.##ncdn.com':443
'cd#.##quisitr.com':80
'im###.#eviantart.net':443
'up####.wikimedia.org':443
'oc##.###tg2.amazontrust.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://x.##2.us/x.cer
http://an###sored.com/files/images/vthumbs/m/a85b07fcc45a8c93bb00e5b7fd079dbc_full.jpg
http://an###sored.com/files/images/vthumbs/m/4a82bd3579491a9caceb2d57b6130aab_full.jpg
http://an###sored.com/sites/default/files/images/galleries/_ver2/data/pic/00/22/15/Lynskey-Park-n-01.jpg
http://st####.hugedomains.com/images/logo_huge_domains.gif
http://an###sored.com/sites/default/files/images/galleries/_ver2/data/pic/00/22/15/Lynskey-Heavenly-dai-n-4.jpg
http://an###sored.com/files/images/vthumbs/m/2e28d7502c3bb6eddf55e9d722c4d325_full.jpg
http://cf##e.com/medias/thumbs/1450830848f072d192_cfake.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-18.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-1.jpg
http://an###sored.com/files/images/vthumbs/m/af9403dcfa76b25bf429ea803e7d6c5e_full.jpg
http://an###sored.com/sites/default/files/images/celebrities/m/melanie_lynskey_naked.jpg
http://cf##e.com/medias/thumbs/1436185110029fb230_cfake.jpg
http://cf##e.com/medias/thumbs/14115158722b251e76_cfake.jpg
http://www.ir###pic.com/wp-content/uploads/2015/12/Melanie-Lynskey-17.jpg
http://ce####itymixer.com/wp-content/uploads/2016/01/MelanieLynskey02.jpg
http://i.####ymail.co.uk/i/pix/2017/02/16/18/3D4D92A200000578-4232212-Soon_to_wed_Melanie_Lynskey_delivered_some_news_on_Thursday_Whil-m-70_1487270810122.jpg
http://www.nu####lebsworld.com/nudeceleb/camsanon.jpg
http://an###sored.com/files/images/vthumbs/m/962abf2681771fef56f51845e98e7a0b_full.jpg
http://cf##e.com/medias/thumbs/1517227420d0e8a1d8_cfake.jpg
http://sw###mining.win/px.gif?ch######################
http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D

Other

'sw###mining.win':443
'th####peningnew.com':443
'cd#.##quisitr.com':443
'ji###osek.eu':443
'pr###it2016.ru':443
'me###mass.net':443
'th#####-cl.xhcdn.com':443
'i.###m.co.uk':443
'im#####c.timeincapp.com':443
'pj####.wordpress.com':443
'i.####ymail.co.uk':443
'im###.#eviantart.net':443
'i.###img.com':443
'up####.wikimedia.org':443
'di.##ncdn.com':443
'ci.##ncdn.com':443
'ne######.files.wordpress.com':443
'cd##.aznude.com':443
'im####c.xvideos.com':443
'im#####.xvideos-cdn.com':443
'm.####access.mobi':443
'st###ounter.com':443
'th#####eningblog.com':443
'pj####.#iles.wordpress.com':443

UDP

DNS ASK sw###mining.win
DNS ASK im###.#eviantart.net
DNS ASK gh####ebvalley.eu
DNS ASK di.##ncdn.com
DNS ASK pr###it2016.ru
DNS ASK up####.wikimedia.org
DNS ASK ex###nalsite.eu
DNS ASK ji###osek.eu
DNS ASK go#####eam-rostov.ru
DNS ASK i.###img.com
DNS ASK im#####c.timeincapp.com
DNS ASK p.###moms.info
DNS ASK lo##dat.ru
DNS ASK i.###m.co.uk
DNS ASK pe########om.files.wordpress.com
DNS ASK me###mass.net
DNS ASK cr###ick.com
DNS ASK th#####-cl.xhcdn.com
DNS ASK th####peningnew.com
DNS ASK nu####kedpics.com
DNS ASK cl#####sion-gion.com
DNS ASK th#####eningblog.com
DNS ASK in###sitr.com
DNS ASK st####.hugedomains.com
DNS ASK fa#.###fappeningnew.com
DNS ASK pj####.#iles.wordpress.com
DNS ASK x.##2.us
DNS ASK oc##.thawte.com
DNS ASK cd#.##quisitr.com
DNS ASK o.##2.us
DNS ASK ci.##ncdn.com
DNS ASK ce####itymixer.com
DNS ASK st###ounter.com
DNS ASK il###4ulih.com
DNS ASK aj##.#oogleapis.com
DNS ASK ht######v.googlecode.com
DNS ASK microsoft.com
DNS ASK m.####access.mobi
DNS ASK google.com
DNS ASK im####c.xvideos.com
DNS ASK im#####.xvideos-cdn.com
DNS ASK im####.###ebritymoviearchive.com
DNS ASK ne###emovie.com
DNS ASK i.####nstatic.com
DNS ASK ga####.uludagsozluk.com
DNS ASK nu####lebsworld.com
DNS ASK cf##e.com
DNS ASK cd##.aznude.com
DNS ASK th###ppening.so
DNS ASK nu###raphy.com
DNS ASK an###sored.com
DNS ASK i.####ymail.co.uk
DNS ASK ir###pic.com
DNS ASK oe##z.info
DNS ASK oa###ocks.org
DNS ASK fb##.###worldmediacdn.com
DNS ASK st####.cinemagia.ro
DNS ASK pj####.wordpress.com
DNS ASK ne######.files.wordpress.com
DNS ASK kr###na24.ru
DNS ASK oc##.###tg2.amazontrust.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial