Trojan.Packed.30124

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2edf.dir00\svchost.exe.mdmp 16325836412032236

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2edf.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'14#.#58.16.124':139
'14#.#58.156.4':139
'14#.#58.74.61':139
'14#.#58.124.158':139
'14#.#58.66.173':139
'14#.#58.45.81':139
'14#.#58.91.75':139
'14#.#58.113.87':139
'14#.#58.96.203':139
'14#.#58.223.101':139
'14#.#58.108.237':139
'14#.#58.54.75':139
'14#.#58.47.148':139
'14#.#58.19.42':139
'14#.#58.57.146':139
'14#.#58.57.81':139
'14#.#58.136.62':139
'14#.#58.108.4':139
'14#.#58.212.56':139
'14#.#58.140.207':139
'14#.#58.96.51':139
'14#.#58.175.90':139
'14#.#58.108.4':445
'14#.#58.108.237':445
'14#.#58.136.62':445
'14#.#58.96.51':445
'14#.#58.212.56':445
'14#.#58.16.124':445
'14#.#58.156.4':445
'14#.#58.74.61':445
'14#.#58.124.158':445
'14#.#58.66.173':445
'14#.#58.140.207':445
'14#.#58.68.7':139
'14#.#58.229.247':139
'14#.#58.41.185':139
'14#.#58.172.235':139
'14#.#58.217.202':139
'14#.#58.54.75':445
'14#.#58.47.148':445
'14#.#58.19.42':445
'14#.#58.57.146':445
'14#.#58.57.81':445
'14#.#58.22.214':139
'14#.#58.20.161':139
'14#.#58.82.174':139
'14#.#58.3.214':139
'14#.#58.94.137':139
'14#.#58.135.85':445
'14#.#58.2.135':445
'14#.#58.73.108':139
'14#.#58.2.175':139
'14#.#58.239.148':139
'14#.#58.21.237':139
'14#.#58.12.144':139
'14#.#58.22.249':139
'14#.#58.62.150':139
'14#.#58.231.81':139
'14#.#58.238.28':139
'14#.#58.7.107':139
'14#.#58.77.89':139
'14#.#58.75.84':139
'14#.#58.148.3':139
'14#.#58.78.15':139
'14#.#58.152.59':445
'14#.#58.94.137':445
'14#.#58.82.174':445
'14#.#58.3.214':445
'14#.#58.77.89':445
'14#.#58.21.237':445
'14#.#58.239.148':445
'14#.#58.73.108':445
'14#.#58.2.175':445
'14#.#58.22.214':445
'14#.#58.20.161':445
'14#.#58.7.107':445
'14#.#58.238.28':445
'14#.#58.62.150':445
'14#.#58.231.81':445
'14#.#58.197.104':445
'14#.#58.18.5':445
'14#.#58.78.15':445
'14#.#58.75.84':445
'14#.#58.148.3':445
'14#.#58.12.144':445
'14#.#58.22.249':445
'14#.#58.209.180':445
'14#.#58.3.135':445
'14#.#58.101.104':445
'14#.#58.138.183':445
'14#.#58.154.138':445
'14#.#58.3.109':139
'14#.#58.19.132':139
'14#.#58.52.136':139
'14#.#58.191.101':139
'14#.#58.52.123':139
'14#.#58.30.24':445
'14#.#58.112.47':445
'14#.#58.201.69':445
'14#.#58.9.160':445
'14#.#58.46.80':445
'14#.#58.254.65':445
'14#.#58.42.46':445
'14#.#58.126.33':445
'14#.#58.45.94':445
'14#.#58.246.244':445
'14#.#58.158.241':445
'14#.#58.42.23':139
'14#.#58.142.216':139
'14#.#58.75.134':139
'14#.#58.0.15':139
'14#.#58.139.89':139
'14#.#58.166.150':139
'14#.#58.173.129':139
'14#.#58.115.167':139
'14#.#58.238.181':139
'14#.#58.123.34':139
'14#.#58.97.123':139
'14#.#58.89.68':139
'14#.#58.208.102':139
'14#.#58.183.208':139
'14#.#58.102.191':139
'14#.#58.35.209':139
'14#.#58.204.87':139
'14#.#58.87.78':139
'14#.#58.68.87':139
'14#.#58.40.212':139
'14#.#58.169.183':139
'14#.#58.74.176':139
'14#.#58.113.232':139
'14#.#58.223.128':139
'14#.#58.161.78':139
'14#.#58.123.22':139
'14#.#58.224.14':139
'14#.#58.46.80':139
'14#.#58.254.65':139
'14#.#58.183.22':139
'14#.#58.188.220':139
'14#.#58.108.47':139
'14#.#58.229.247':445
'14#.#58.45.81':445
'14#.#58.91.75':445
'14#.#58.113.87':445
'14#.#58.96.203':445
'14#.#58.223.101':445
'14#.#58.41.185':445
'14#.#58.68.7':445
'14#.#58.217.202':445
'14#.#58.175.90':445
'14#.#58.172.235':445
'14#.#58.9.160':139
'14#.#58.224.14':445
'14#.#58.161.78':445
'14#.#58.123.22':445
'14#.#58.209.180':139
'14#.#58.3.135':139
'14#.#58.108.47':445
'14#.#58.183.22':445
'14#.#58.188.220':445
'14#.#58.113.232':445
'14#.#58.223.128':445
'14#.#58.101.104':139
'14#.#58.158.241':139
'14#.#58.45.94':139
'14#.#58.246.244':139
'14#.#58.112.47':139
'14#.#58.201.69':139
'14#.#58.138.183':139
'14#.#58.154.138':139
'14#.#58.30.24':139
'14#.#58.42.46':139
'14#.#58.126.33':139
'14#.#58.18.5':139
'14#.#58.40.33':445
'14#.#58.250.8':445
'14#.#58.86.48':445
'14#.#58.156.222':445
'14#.#58.61.20':445
'14#.#58.26.48':445
'14#.#58.167.60':445
'14#.#58.91.53':445
'14#.#58.194.146':445
'14#.#58.142.175':445
'14#.#58.91.240':445
'14#.#58.88.22':139
'14#.#58.160.151':139
'14#.#58.156.53':139
'14#.#58.193.215':139
'14#.#58.9.19':139
'14#.#58.158.231':445
'14#.#58.82.141':445
'14#.#58.208.65':139
'14#.#58.170.71':139
'14#.#58.65.170':139
'14#.#58.96.167':445
'14#.#58.173.41':445
'14#.#58.180.102':445
'14#.#58.31.112':445
'14#.#58.93.101':445
'14#.#58.112.93':445
'14#.#58.250.15':445
'14#.#58.80.250':445
'14#.#58.80.120':445
'14#.#58.81.66':445
'14#.#58.207.218':445
'14#.#58.81.39':445
'14#.#58.152.82':445
'14#.#58.25.6':445
'14#.#58.251.32':445
'14#.#58.68.175':445
'14#.#58.46.45':445
'14#.#58.232.67':445
'14#.#58.140.37':445
'14#.#58.49.210':445
'14#.#58.74.152':445
'14#.#58.25.230':445
'14#.#58.68.175':139
'14#.#58.46.45':139
'14#.#58.96.167':139
'14#.#58.26.48':139
'14#.#58.167.60':139
'14#.#58.25.6':139
'14#.#58.25.230':139
'14#.#58.74.152':139
'14#.#58.251.32':139
'14#.#58.152.82':139
'14#.#58.91.53':139
'14#.#58.82.141':139
'14#.#58.40.33':139
'14#.#58.158.231':139
'14#.#58.156.222':139
'14#.#58.61.20':139
'14#.#58.194.146':139
'14#.#58.142.175':139
'14#.#58.250.8':139
'14#.#58.91.240':139
'14#.#58.86.48':139
'14#.#58.49.210':139
'14#.#58.209.61':139
'14#.#58.132.162':139
'14#.#58.61.81':139
'14#.#58.250.15':139
'14#.#58.80.250':139
'14#.#58.3.197':139
'14#.#58.240.192':139
'14#.#58.14.26':139
'14#.#58.77.198':139
'14#.#58.229.85':139
'14#.#58.80.120':139
'14#.#58.93.101':139
'14#.#58.112.93':139
'14#.#58.140.37':139
'14#.#58.232.67':139
'14#.#58.81.39':139
'14#.#58.81.66':139
'14#.#58.207.218':139
'14#.#58.180.102':139
'14#.#58.31.112':139
'14#.#58.173.41':139
'14#.#58.92.185':445
'14#.#58.0.115':445
'14#.#58.185.54':445
'14#.#58.85.208':139
'14#.#58.57.168':445
'14#.#58.36.171':445
'14#.#58.136.232':445
'14#.#58.245.220':445
'14#.#58.138.251':445
'14#.#58.221.13':445
'14#.#58.48.245':139
'14#.#58.95.215':139
'14#.#58.193.95':139
'14#.#58.215.6':139
'14#.#58.36.102':139
'14#.#58.251.200':139
'14#.#58.184.154':139
'14#.#58.126.83':139
'14#.#58.20.34':139
'14#.#58.46.62':139
'14#.#58.89.47':139
'14#.#58.209.174':445
'14#.#58.126.83':445
'14#.#58.48.245':445
'14#.#58.184.154':445
'14#.#58.89.47':445
'14#.#58.20.34':445
'14#.#58.152.59':139
'14#.#58.197.104':139
'14#.#58.2.135':139
'14#.#58.85.208':445
'14#.#58.135.85':139
'14#.#58.46.62':445
'14#.#58.156.124':445
'14#.#58.232.19':445
'14#.#58.71.71':445
'14#.#58.144.114':445
'14#.#58.131.113':445
'14#.#58.95.215':445
'14#.#58.193.95':445
'14#.#58.215.6':445
'14#.#58.36.102':445
'14#.#58.251.200':445
'14#.#58.65.170':445
'14#.#58.208.65':445
'14#.#58.170.71':445
'14#.#58.88.22':445
'14#.#58.160.151':445
'14#.#58.61.20':9988
'14#.#58.142.175':9988
'14#.#58.158.231':9988
'14#.#58.82.141':9988
'14#.#58.91.240':9988
'14#.#58.156.53':445
'14#.#58.77.198':445
'14#.#58.229.85':445
'14#.#58.132.162':445
'14#.#58.61.81':445
'14#.#58.209.61':445
'14#.#58.193.215':445
'14#.#58.9.19':445
'14#.#58.240.192':445
'14#.#58.14.26':445
'14#.#58.3.197':445
'14#.#58.26.48':9988
'14#.#58.136.232':139
'14#.#58.209.174':139
'14#.#58.36.171':139
'14#.#58.221.13':139
'14#.#58.245.220':139
'14#.#58.156.124':139
'14#.#58.232.19':139
'14#.#58.71.71':139
'14#.#58.144.114':139
'14#.#58.131.113':139
'14#.#58.138.251':139
'14#.#58.25.230':9988
'14#.#58.112.93':9988
'14#.#58.74.152':9988
'14#.#58.96.167':9988
'14#.#58.251.32':9988
'14#.#58.92.185':139
'14#.#58.0.115':139
'14#.#58.185.54':139
'14#.#58.250.15':9988
'14#.#58.57.168':139

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial