Trojan.DownLoader9.37259

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Network activity:

Connects to:

'88.##3.190.173':139
'88.##3.105.250':139
'88.##3.63.245':139
'88.##3.68.101':139
'88.##3.133.88':139
'88.##3.32.161':139
'88.##3.124.207':139
'88.##3.86.100':139
'88.##3.205.230':139
'88.##3.169.19':139
'88.##3.207.239':139
'88.##3.151.251':139
'88.##3.239.204':139
'88.##3.104.121':139
'88.##3.188.225':139
'88.##3.68.208':139
'88.##3.208.90':139
'88.##3.5.173':139
'88.##3.124.127':139
'88.##3.58.194':139
'88.##3.91.98':139
'88.##3.70.50':139
'88.##3.134.131':139
'88.##3.50.224':139
'88.##3.224.241':139
'88.##3.237.109':139
'88.##3.140.117':139
'88.##3.129.233':139
'88.##3.124.128':139
'88.##3.51.161':139
'88.##3.124.203':139
'88.##3.109.169':139
'88.##3.119.79':139
'88.##3.161.125':139
'88.##3.78.181':9988
'88.##3.2.172':9988
'88.##3.204.182':9988
'88.##3.114.9':139
'88.##3.140.70':9988
'88.##3.205.88':9988
'88.##3.228.103':139
'88.##3.178.218':139
'88.##3.19.168':139
'88.##3.65.60':139
'88.##3.60.149':139
'88.##3.34.33':139
'88.##3.225.198':139
'88.##3.182.132':139
'88.##3.187.31':139
'88.##3.127.29':139
'88.#43.30.7':139
'88.##3.132.150':139
'88.##3.150.122':139
'88.##3.122.89':139
'88.##3.207.239':445
'88.##3.63.245':445
'88.##3.205.230':445
'88.##3.134.131':445
'88.##3.104.121':445
'88.##3.68.101':445
'88.##3.133.88':445
'88.##3.105.250':445
'88.##3.32.161':445
'88.##3.239.204':445
'88.##3.86.100':445
'88.##3.124.207':445
'88.##3.151.251':445
'88.##3.50.224':445
'88.##3.110.61':445
'88.##3.58.194':445
'88.##3.68.208':445
'88.##3.5.173':445
'88.##3.209.160':139
'88.##3.103.121':445
'88.##3.188.225':445
'88.##3.70.50':445
'88.##3.140.117':445
'88.##3.224.241':445
'88.##3.91.98':445
'88.##3.208.90':445
'88.##3.237.109':445
'88.##3.124.203':445
'88.##3.127.29':445
'88.##3.119.79':445
'88.##3.109.169':445
'88.#43.30.7':445
'88.##3.187.31':445
'88.##3.124.128':445
'88.##3.124.127':445
'88.##3.110.61':139
'88.##3.103.121':139
'88.##3.114.9':445
'88.##3.51.161':445
'88.##3.161.125':445
'88.##3.228.103':445
'88.##3.34.33':445
'88.##3.225.198':445
'88.##3.182.132':445
'88.##3.190.173':445
'88.##3.169.19':445
'88.##3.60.149':445
'88.##3.19.168':445
'88.##3.150.122':445
'88.##3.129.233':445
'88.##3.122.89':445
'88.##3.65.60':445
'88.##3.178.218':445
'88.##3.132.150':445
'88.##3.83.106':139
'88.##3.211.227':139
'88.##3.65.182':139
'88.##3.56.199':139
'88.##3.18.26':139
'88.##3.134.27':139
'88.##3.205.88':139
'88.##3.118.23':139
'88.##3.227.121':139
'88.##3.55.134':139
'88.##3.167.152':139
'88.##3.3.239':139
'88.##3.78.207':139
'88.#43.31.0':139
'88.##3.19.114':139
'88.##3.88.46':139
'88.##3.106.230':139
'88.##3.100.113':445
'88.##3.209.247':445
'88.##3.226.205':445
'88.##3.196.17':139
'88.##3.103.195':139
'88.##3.113.103':139
'88.##3.171.126':139
'88.##3.56.101':139
'88.##3.17.69':139
'88.##3.78.181':139
'88.##3.179.121':139
'88.##3.217.102':139
'88.##3.171.140':139
'88.##3.112.14':139
'88.##3.57.161':139
'88.##3.121.100':139
'88.#43.6.38':139
'88.##3.33.112':139
'88.##3.100.113':139
'88.##3.106.242':139
'88.##3.183.83':139
'88.##3.226.205':139
'88.##3.209.247':139
'88.##3.102.226':139
'88.##3.46.132':139
'88.##3.39.87':139
'88.##3.35.131':139
'88.##3.100.208':139
'88.#43.7.90':139
'88.##3.20.165':139
'88.##3.187.247':139
'88.##3.112.240':139
'88.##3.204.182':139
'88.##3.2.172':139
'88.##3.26.55':139
'88.##3.63.16':139
'88.##3.140.70':139
'88.##3.113.103':445
'88.#43.31.0':445
'88.##3.3.239':445
'88.##3.56.101':445
'88.##3.171.126':445
'88.##3.78.181':445
'88.##3.227.121':445
'88.##3.112.240':445
'88.##3.217.102':445
'88.##3.134.27':445
'88.##3.205.88':445
'88.##3.65.182':445
'88.##3.211.227':445
'88.##3.196.17':445
'88.##3.171.140':9988
'88.##3.17.69':9988
'88.##3.196.17':9988
'88.##3.56.101':9988
'88.##3.226.205':9988
'88.##3.113.103':9988
'88.##3.103.195':445
'88.##3.88.46':445
'88.##3.106.230':445
'88.##3.19.114':445
'88.##3.17.69':445
'88.##3.56.199':445
'88.##3.18.26':445
'88.##3.112.14':445
'88.##3.57.161':445
'88.##3.179.121':445
'88.##3.26.55':445
'88.##3.121.100':445
'88.##3.204.182':445
'88.##3.63.16':445
'88.##3.171.140':445
'88.##3.33.112':445
'88.##3.106.242':445
'88.##3.102.226':445
'88.##3.183.83':445
'88.#43.6.38':445
'88.##3.140.70':445
'88.##3.39.87':445
'88.##3.46.132':445
'88.##3.20.165':445
'88.##3.118.23':445
'88.##3.100.208':445
'88.##3.55.134':445
'88.##3.35.131':445
'88.##3.167.152':445
'88.##3.78.207':445
'88.##3.2.172':445
'88.##3.187.247':445
'88.##3.83.106':445
'88.#43.7.90':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial