Trojan.DownLoader9.61112

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc970.dir00\svchost.exe.mdmp 16325836412032752

Modifies file system :

Creates the following files:

<SYSTEM32>\urdvxc.exe

Deletes itself.

Network activity:

Connects to:

'20#.#30.76.87':445
'20#.#30.105.91':445
'20#.#30.95.238':445
'20#.#30.151.37':445
'20#.#30.242.54':445
'20#.#30.67.46':445
'20#.#30.74.216':445
'20#.#30.108.82':445
'20#.#30.56.200':445
'20#.#30.122.246':445
'20#.#30.154.56':445
'20#.#30.128.240':445
'20#.#30.119.37':445
'20#.#30.121.231':445
'20#.#30.68.90':445
'20#.#30.223.43':445
'20#.#30.155.142':445
'20#.#30.147.215':445
'20#.#30.166.63':445
'20#.#30.140.94':9988
'20#.#30.63.77':9988
'20#.#30.171.7':9988
'20#.#30.111.114':445
'20#.#30.102.103':445
'20#.#30.173.49':445
'20#.#30.80.225':445
'20#.#30.145.63':445
'20#.#30.114.187':445
'20#.#30.14.162':445
'20#.#30.227.196':445
'20#.#30.118.188':445
'20#.#30.63.77':445
'20#.#30.41.67':445
'20#.#30.7.108':445
'20#.#30.96.194':445
'20#.#30.78.117':445
'20#.#30.102.166':445
'20#.#30.116.99':445
'20#.#30.142.102':445
'20#.#30.233.141':445
'20#.#30.153.71':445
'20#.#30.25.146':445
'20#.#30.54.147':445
'20#.#30.61.109':445
'20#.#30.147.253':445
'20#.#30.224.215':445
'20#.#30.228.249':445
'20#.#30.22.124':445
'20#.#30.85.251':445
'20#.#30.43.168':445
'20#.#30.99.42':445
'20#.#30.140.52':445
'20#.#30.90.146':445
'20#.#30.97.36':445
'20#.#30.140.35':445
'20#.#30.172.137':445
'20#.#30.198.101':445
'20#.#30.63.216':445
'20#.#30.42.251':445
'20#.#30.70.55':445
'20#.#30.97.36':9988
'20#.#30.140.52':9988
'20#.#30.147.253':9988
'20#.#30.119.37':9988
'20#.#30.61.109':9988
'20#.#30.34.161':9988
'20#.#30.92.178':9988
'20#.#30.140.35':9988
'20#.#30.128.240':9988
'20#.#30.206.129':9988
'20#.#30.207.181':9988
'20#.#30.95.238':9988
'20#.#30.25.146':9988
'20#.#30.242.54':9988
'20#.#30.74.216':9988
'20#.#30.165.193':9988
'20#.#30.153.71':9988
'20#.#30.37.163':9988
'20#.#30.175.82':9988
'20#.#30.105.91':9988
'20#.#30.149.46':9988
'20#.#30.7.108':9988
'20#.#30.116.99':9988
'20#.#30.233.141':9988
'20#.#30.67.46':9988
'20#.#30.16.153':9988
'20#.#30.68.90':9988
'20#.#30.99.227':9988
'20#.#30.223.43':9988
'20#.#30.61.237':9988
'20#.#30.154.56':9988
'20#.#30.172.137':9988
'20#.#30.155.142':9988
'20#.#30.70.55':9988
'20#.#30.151.37':9988
'20#.#30.85.251':9988
'20#.#30.173.49':9988
'20#.#30.90.146':9988
'20#.#30.4.122':9988
'20#.#30.119.36':9988
'20#.#30.155.224':9988
'20#.#30.121.231':9988
'20#.#30.122.246':9988
'20#.#30.63.216':9988
'20#.#30.42.251':9988
'20#.#30.57.111':9988
'20#.#30.36.211':9988
'20#.#30.102.166':9988
'20#.#30.96.148':9988
'20#.#30.164.220':9988
'20#.#30.145.148':9988
'20#.#30.224.215':9988
'20#.#30.140.101':9988
'20#.#30.198.101':9988
'20#.#30.43.207':9988
'20#.#30.87.144':9988
'20#.#30.103.123':9988
'20#.#30.215.175':9988
'20#.#30.66.144':9988
'20#.#30.108.82':9988
'20#.#30.215.152':445
'20#.#30.145.63':139
'20#.#30.92.178':139
'20#.#30.154.56':139
'20#.#30.223.43':139
'20#.#30.173.49':139
'20#.#30.147.215':139
'20#.#30.142.102':139
'20#.#30.227.196':139
'20#.#30.128.240':139
'20#.#30.80.225':139
'20#.#30.242.54':139
'20#.#30.43.168':139
'20#.#30.122.246':139
'20#.#30.56.200':139
'20#.#30.102.103':139
'20#.#30.140.35':139
'20#.#30.198.101':139
'20#.#30.97.36':139
'20#.#30.151.37':139
'20#.#30.78.117':139
'20#.#30.16.153':139
'20#.#30.95.238':139
'20#.#30.42.251':139
'20#.#30.140.52':139
'20#.#30.90.146':139
'20#.#30.37.163':139
'20#.#30.68.90':139
'20#.#30.63.77':139
'20#.#30.7.108':139
'20#.#30.22.124':139
'20#.#30.165.193':139
'20#.#30.87.144':139
'20#.#30.171.7':139
'20#.#30.233.141':139
'20#.#30.246.176':139
'20#.#30.61.237':139
'20#.#30.114.187':139
'20#.#30.155.224':139
'20#.#30.74.216':139
'20#.#30.155.142':139
'20#.#30.103.123':139
'20#.#30.66.144':139
'20#.#30.108.82':139
'20#.#30.215.175':139
'20#.#30.224.215':139
'20#.#30.96.148':139
'20#.#30.36.211':139
'20#.#30.99.227':139
'20#.#30.175.82':139
'20#.#30.99.42':139
'20#.#30.99.144':139
'20#.#30.85.251':139
'20#.#30.4.122':139
'20#.#30.121.231':139
'20#.#30.166.63':139
'20#.#30.111.114':139
'20#.#30.164.220':139
'20#.#30.140.94':139
'20#.#30.119.36':139
'20#.#30.136.63':139
'20#.#30.96.148':445
'20#.#30.155.224':445
'20#.#30.175.82':445
'20#.#30.140.94':445
'20#.#30.215.175':445
'20#.#30.165.193':445
'20#.#30.61.237':445
'20#.#30.87.144':445
'20#.#30.57.111':445
'20#.#30.140.101':445
'20#.#30.207.181':445
'20#.#30.43.207':445
'20#.#30.103.123':445
'20#.#30.66.144':445
'20#.#30.34.161':445
'20#.#30.16.153':445
'20#.#30.99.144':445
'20#.#30.164.220':445
'20#.#30.37.163':445
'20#.#30.206.129':445
'20#.#30.92.178':445
'20#.#30.149.46':445
'20#.#30.99.227':445
'20#.#30.171.7':445
'20#.#30.36.211':445
'20#.#30.246.176':445
'20#.#30.145.148':445
'20#.#30.4.122':445
'20#.#30.136.63':445
'20#.#30.119.36':445
'20#.#30.41.67':139
'20#.#30.67.46':139
'20#.#30.215.152':139
'20#.#30.147.253':139
'20#.#30.116.99':139
'20#.#30.119.37':139
'20#.#30.63.216':139
'20#.#30.54.147':139
'20#.#30.25.146':139
'20#.#30.118.188':139
'20#.#30.105.91':139
'20#.#30.96.194':139
'20#.#30.172.137':139
'20#.#30.206.129':139
'20#.#30.76.87':139
'20#.#30.145.148':139
'20#.#30.57.111':139
'20#.#30.149.46':139
'20#.#30.43.207':139
'20#.#30.149.60':139
'20#.#30.34.161':139
'20#.#30.14.162':139
'20#.#30.140.101':139
'20#.#30.102.166':139
'20#.#30.61.109':139
'20#.#30.153.71':139
'20#.#30.70.55':139
'20#.#30.207.181':139
'20#.#30.228.249':139
'20#.#30.149.60':445

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial