Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader29.46196

Added to the Dr.Web virus database: 2019-07-18

Virus description added:

Technical Information

To ensure autorun and distribution
Creates the following services
  • [<HKLM>\System\CurrentControlSet\Services\sxpoksal] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\sxpoksal] 'ImagePath' = '<SYSTEM32>\sxpoksal\nnmsdryb.exe /d"<Full path to file>"'
  • [<HKLM>\SYSTEM\CurrentControlSet\services\sxpoksal] 'ImagePath' = '<SYSTEM32>\sxpoksal\nnmsdryb.exe'
Malicious functions
Injects code into
the following system processes:
  • <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
  • %TEMP%\nnmsdryb.exe
  • C:\documents and settings\localservice:.repos
Moves the following files
  • from %TEMP%\nnmsdryb.exe to <SYSTEM32>\sxpoksal\nnmsdryb.exe
Deletes itself.
Network activity
Connects to
  • 'pu####ory.bc.edu':25
  • 'vk.com':443
  • 'mx#.##il.icloud.com':25
  • 'alt1.aspmx.l.google.com':25
  • 'dc######.emirates.net.ae':25
  • 'lo###.vk.com':443
  • 'mx.####ght.synacor.com':25
  • 'sm##.##cureserver.net':25
  • 'mx.##ncaser.com':25
  • 'mx#.#otmail.com':25
  • 'sm##.##b.shawcable.net':25
  • 'alt2.aspmx.l.google.com':25
  • 'vi########er.arn03.hls.ttvnw.net':443
  • 'gmail-smtp-in.l.google.com':25
  • 'mx#.qq.com':25
  • '69.#1.136.5':443
  • 'mt##.##0.yahoodns.net':25
  • 'ms#####p-mx1.hinet.net':25
  • 'alt3.gmail-smtp-in.l.google.com':25
TCP
HTTP GET requests
  • http://www.google.com/
  • http://ap#.##-cy.ru:35000/
  • http://ip##fo.io/ip
UDP
  • DNS ASK mi##########m.mail.protection.outlook.com
  • DNS ASK am###trade.com
  • DNS ASK mx#######501.gslb.pphosted.com
  • DNS ASK la#.com
  • DNS ASK sm##.##b-hosting.com
  • DNS ASK vk.com
  • DNS ASK fo##ham.edu
  • DNS ASK mx#######d01.gslb.pphosted.com
  • DNS ASK po#####ssense.com.br
  • DNS ASK mx.####.locaweb.com.br
  • DNS ASK cl######n-01.mbs.boeing.net
  • DNS ASK li#e.no
  • DNS ASK co####.netwizard.com.br
  • DNS ASK on####schools.org
  • DNS ASK alt2.aspmx.l.google.com
  • DNS ASK bo###dgroup.com
  • DNS ASK us##nk.com
  • DNS ASK on####ratoner.com
  • DNS ASK mx.##ndex.net
  • DNS ASK se###-air.com
  • DNS ASK ma##.#even-air.com
  • DNS ASK ss#.com
  • DNS ASK ma##.ssg.com
  • DNS ASK on##ave.net
  • DNS ASK po########.com.mx1.fsr.rcimx.net
  • DNS ASK po###oy-wa.com
  • DNS ASK mx###.owm.bell.net
  • DNS ASK ya###.com.sg
  • DNS ASK wi######ftsfuehrerschein.at
  • DNS ASK mx.###business.at
  • DNS ASK sa####ailing.com
  • DNS ASK bu##.#iggplus.com
  • DNS ASK rh####offroad.com
  • DNS ASK be##net.ca
  • DNS ASK mx###.bellnet.ca
  • DNS ASK ms#.com
  • DNS ASK po####uality.com.br
  • DNS ASK bo##ng.com
  • DNS ASK vi###tron.ca
  • DNS ASK mx.##deotron.ca
  • DNS ASK ya##o.dk
  • DNS ASK hk##ar.com
  • DNS ASK im####.netvigator.com
  • DNS ASK pn##.edu
  • DNS ASK ha##ail.net
  • DNS ASK mx#.#anmail.net
  • DNS ASK ya##o.com
  • DNS ASK sy###tico.ca
  • DNS ASK ya##o.co.in
  • DNS ASK ms#####.##c.protection.outlook.com
  • DNS ASK he####chonline.com
  • DNS ASK d1#####.##s.barracudanetworks.com
  • DNS ASK ma##.###anfamoustours.com
  • DNS ASK ba##mex.com
  • DNS ASK mx##.#ail.citi.com
  • DNS ASK ba####america.com
  • DNS ASK mx#######c05.gslb.pphosted.com
  • DNS ASK bc.edu
  • DNS ASK pu####ory.bc.edu
  • DNS ASK ms#.#inet.net
  • DNS ASK ms#####p-mx1.hinet.net
  • DNS ASK co###rweb.com
  • DNS ASK connorwindows.com
  • DNS ASK in#####.#ail.truedefense.com
  • DNS ASK sm##.##cureserver.net
  • DNS ASK in###htbb.com
  • DNS ASK mx.####ght.synacor.com
  • DNS ASK fu##.com
  • DNS ASK co###rworld.com
  • DNS ASK em###tes.net.ae
  • DNS ASK dc######.emirates.net.ae
  • DNS ASK ma#.com
  • DNS ASK mx#.##il.icloud.com
  • DNS ASK co###tate.com
  • DNS ASK as#####moustours.com
  • DNS ASK mx#######602.gslb.pphosted.com
  • DNS ASK mx.#####.#om.cust.b.hostedemail.com
  • DNS ASK ne###rkkf.com
  • DNS ASK lo###.vk.com
  • DNS ASK on###ance.info
  • DNS ASK alt1.aspmx.l.google.com
  • DNS ASK ma#l.be
  • DNS ASK sm###.mail.be
  • DNS ASK ya###.com.br
  • DNS ASK ga##.ind.br
  • DNS ASK d.##.#ipnet.com.br
  • DNS ASK nw####lproducts.com
  • DNS ASK mx#######c01.gslb.pphosted.com
  • DNS ASK ve###ser.com
  • DNS ASK mx#.qq.com
  • DNS ASK pr###nmail.ch
  • DNS ASK do#.com
  • DNS ASK ma##.#rotonmail.ch
  • DNS ASK mx######da402.pphosted.com
  • DNS ASK ho###epot.com
  • DNS ASK mx#######601.gslb.pphosted.com
  • DNS ASK vi########er.arn03.hls.ttvnw.net
  • DNS ASK gm.com
  • DNS ASK mx#.#mr.gm.com
  • DNS ASK qq.com
  • DNS ASK ly##s.com
  • DNS ASK ma##.##ter-energo.com
  • DNS ASK me####ragedoors.com
  • DNS ASK ya##o.fr
  • DNS ASK po###red.com.br
  • DNS ASK ma##.##locred.com.br
  • DNS ASK alt4.gmail-smtp-in.l.google.com
  • DNS ASK gr###e.co.uk
  • DNS ASK mx###.##erycloudtech.com
  • DNS ASK po###arage.com
  • DNS ASK ma###.#ologarage.com
  • DNS ASK gi#.####a-geosystems.com
  • DNS ASK co###ounty.org
  • DNS ASK 19#.###.#11.95.cbl.abuseat.org
  • DNS ASK google.com
  • DNS ASK jn##.com
  • DNS ASK gr####nberger.com
  • DNS ASK mx#.#ycloud.at
  • DNS ASK gm##l.com
  • DNS ASK gmail-smtp-in.l.google.com
  • DNS ASK av##ue20.it
  • DNS ASK ma#####ver.mediacity.it
  • DNS ASK po##gy.net
  • DNS ASK ma##.pology.net
  • DNS ASK ya##o.co.th
  • DNS ASK mx#####.#ail.gm0.yahoodns.net
  • DNS ASK mx#.#ail.qq.com
  • DNS ASK fo##ail.com
  • DNS ASK mx##.#aramail.com
  • DNS ASK de##i.lt
  • DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
  • DNS ASK 19#.###.#11.95.bl.spamcop.net
  • DNS ASK mx##.delfi.lt
  • DNS ASK mx#.#otmail.com
  • DNS ASK alt3.gmail-smtp-in.l.google.com
  • DNS ASK 19#.###.#11.95.zen.spamhaus.org
  • DNS ASK mt##.##0.yahoodns.net
  • DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
  • DNS ASK cl####casino.com
  • DNS ASK d1######.#ss.barracudanetworks.com
  • DNS ASK po#####oproductions.com
  • DNS ASK plus.google.com
  • DNS ASK aspmx.l.google.com
  • DNS ASK ya###.com.ar
  • DNS ASK alt1.gmail-smtp-in.l.google.com
  • DNS ASK po##illo.be
  • DNS ASK ma##.#ortillo.be
  • DNS ASK at#.#oeing.com
  • DNS ASK ph######n-01.mbs.boeing.net
  • DNS ASK ca###ail.com
  • DNS ASK 19#.###.211.95.in-addr.arpa
  • DNS ASK mx#.##ailsrvr.com
  • DNS ASK ya##o.ca
  • DNS ASK qs###5.pair.com
  • DNS ASK ma##.##upomaestre.com
  • DNS ASK ve##zon.net
  • DNS ASK mx####.##il.gm0.yahoodns.net
  • DNS ASK po###-paul.de
  • DNS ASK mx#.##wer-paul.de
  • DNS ASK cs##ve.net
  • DNS ASK mx#.#ianet.ca
  • DNS ASK sh#w.ca
  • DNS ASK sm##.##b.shawcable.net
  • DNS ASK da#####joelma.com.br
  • DNS ASK po###paxuk.com
  • DNS ASK gr####aestre.com
  • DNS ASK gl####naust.com.au
  • DNS ASK mx###.##il.am0.yahoodns.net
  • DNS ASK de######oseussonhos.com.br
  • DNS ASK li#e.de
  • DNS ASK eu#.###.#rotection.outlook.com
  • DNS ASK ma#l.ru
  • DNS ASK mx#.mail.ru
  • DNS ASK nu####edical.com.br
  • DNS ASK mx.####imedical.com.br
  • DNS ASK ea##link.ca
  • DNS ASK sm##.###a.secureserver.net
  • DNS ASK sp######.activeit.solutions
  • DNS ASK mx.##ncaser.com
  • DNS ASK mt#.net
  • DNS ASK ho##ail.com
  • DNS ASK ba######a.northern911.com
  • DNS ASK po#####rtners-inc.com
  • DNS ASK mx#######401.gslb.pphosted.com
  • DNS ASK alt2.gmail-smtp-in.l.google.com
  • DNS ASK sh#####ndustries.com
  • DNS ASK ge###mar.com
  • DNS ASK mx.####ndecorreo.com
  • DNS ASK po#####rtnersllc.com
  • DNS ASK mx#######102.gslb.pphosted.com
  • DNS ASK mx.##mts.net
  • DNS ASK sm####.eastlink.ca
  • DNS ASK ca#####kadvantage.ca
  • DNS ASK ho#########.olc.protection.outlook.com
  • DNS ASK ve###nlaw.com
  • DNS ASK ap#.#r-cy.ru
  • DNS ASK ve#######.##m.pri-mx.na0104.smtproutes.com
  • DNS ASK ge###tco.com
  • DNS ASK mx.####iciodecorreo.es
  • DNS ASK ms##.hinet.net
  • DNS ASK ms#####p-mx2.hinet.net
  • DNS ASK po#####rtners-usa.com
  • DNS ASK sm###.edelkey.net
  • DNS ASK hy##o.com
  • '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
  • '<SYSTEM32>\sxpoksal\nnmsdryb.exe' /d"<Full path to file>"
  • '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sxpoksal\' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\nnmsdryb.exe" <SYSTEM32>\sxpoksal\' (with hidden window)
  • '<SYSTEM32>\sc.exe' create sxpoksal binPath= "<SYSTEM32>\sxpoksal\nnmsdryb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
  • '<SYSTEM32>\sc.exe' description sxpoksal "wifi internet conection"' (with hidden window)
  • '<SYSTEM32>\sc.exe' start sxpoksal' (with hidden window)
Executes the following
  • '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sxpoksal\
  • '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\nnmsdryb.exe" <SYSTEM32>\sxpoksal\
  • '<SYSTEM32>\sc.exe' create sxpoksal binPath= "<SYSTEM32>\sxpoksal\nnmsdryb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
  • '<SYSTEM32>\sc.exe' description sxpoksal "wifi internet conection"
  • '<SYSTEM32>\sc.exe' start sxpoksal
  • '<SYSTEM32>\svchost.exe'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040