Trojan.Packed.30125

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER36f7.dir00\svchost.exe.mdmp 16325836412032324

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER36f7.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'88.##.98.138':139
'88.##.252.110':139
'88.##.179.39':139
'88.##.142.249':139
'88.##.94.159':139
'88.#3.89.66':139
'88.##.85.129':139
'88.##.62.153':139
'88.##.129.252':139
'88.##.246.129':139
'88.##.22.138':139
'88.##.53.205':139
'88.##.164.140':139
'88.##.214.104':139
'88.##.242.171':139
'88.##.105.73':139
'88.##.245.87':139
'88.#3.61.59':139
'88.#3.23.68':139
'88.##.120.226':139
'88.##.231.108':139
'88.#3.37.1':445
'88.#3.12.26':445
'88.##.121.69':445
'88.##.152.23':445
'88.##.112.216':445
'88.##.53.205':445
'88.##.164.140':445
'88.##.214.104':445
'88.##.242.171':445
'88.##.105.73':445
'88.#3.5.109':139
'88.##.247.235':139
'88.##.26.167':139
'88.##.217.170':139
'88.##.220.195':139
'88.##.216.65':139
'88.##.196.49':139
'88.##.238.217':139
'88.##.49.208':139
'88.##.101.80':139
'88.##.118.126':139
'88.#3.12.26':139
'88.#3.249.4':139
'88.#3.6.150':139
'88.#3.162.8':139
'88.##.105.85':139
'88.#3.18.38':139
'88.##.219.232':139
'88.##.200.220':139
'88.#3.33.71':139
'88.##.38.212':139
'88.##.202.84':139
'88.#3.15.81':139
'88.##.19.207':445
'88.##.109.13':445
'88.##.165.222':445
'88.##.128.16':445
'88.##.222.74':445
'88.##.224.167':445
'88.##.182.67':445
'88.##.168.32':445
'88.##.87.186':445
'88.#3.6.188':445
'88.##.195.238':445
'88.##.148.104':445
'88.##.200.220':445
'88.#3.33.71':445
'88.##.219.232':445
'88.##.121.69':139
'88.#3.37.1':139
'88.##.112.216':139
'88.##.191.239':445
'88.##.152.23':139
'88.##.202.84':445
'88.#3.15.81':445
'88.##.105.85':445
'88.##.191.239':139
'88.##.195.238':139
'88.##.148.104':139
'88.#3.6.150':445
'88.##.38.212':445
'88.#3.249.4':445
'88.#3.18.38':445
'88.#3.162.8':445
'88.##.120.226':445
'88.##.106.144':139
'88.##.151.76':139
'88.##.144.145':139
'88.#3.50.58':139
'88.##.110.246':139
'88.##.221.130':139
'88.##.123.24':139
'88.##.153.26':139
'88.#3.82.61':139
'88.##.147.159':139
'88.##.118.136':445
'88.#3.91.30':445
'88.##.133.234':445
'88.##.173.128':445
'88.##.214.112':445
'88.##.157.96':445
'88.##.231.40':445
'88.#3.5.202':445
'88.##.29.235':445
'88.##.113.179':445
'88.##.83.111':445
'88.##.122.99':139
'88.##.144.184':139
'88.##.246.23':139
'88.##.163.25':139
'88.#3.67.64':139
'88.##.13.253':139
'88.##.226.146':139
'88.##.248.146':139
'88.#3.76.18':139
'88.##.146.76':139
'88.#3.25.66':139
'88.##.241.11':139
'88.##.123.113':139
'88.##.100.156':139
'88.##.101.69':139
'88.##.211.93':139
'88.##.164.69':139
'88.##.145.58':139
'88.##.186.17':139
'88.##.105.123':139
'88.##.19.133':139
'88.##.72.241':445
'88.##.85.129':445
'88.##.220.195':445
'88.#3.89.66':445
'88.##.246.129':445
'88.##.62.153':445
'88.##.26.167':445
'88.##.101.80':445
'88.##.247.235':445
'88.##.216.65':445
'88.##.217.170':445
'88.##.129.252':445
'88.#3.61.59':445
'88.##.22.138':445
'88.##.245.87':445
'88.##.231.108':445
'88.#3.23.68':445
'88.##.98.138':445
'88.##.252.110':445
'88.##.179.39':445
'88.##.142.249':445
'88.##.94.159':445
'88.##.83.111':139
'88.##.29.235':139
'88.##.113.179':139
'88.#3.91.30':139
'88.##.133.234':139
'88.##.18.193':445
'88.##.31.219':445
'88.##.118.136':139
'88.##.231.40':139
'88.#3.5.202':139
'88.##.173.128':139
'88.##.238.217':445
'88.#3.5.109':445
'88.##.196.49':445
'88.##.118.126':445
'88.##.49.208':445
'88.##.214.112':139
'88.##.157.96':139
'88.##.72.241':139
'88.##.18.193':139
'88.##.31.219':139
'88.##.171.143':445
'88.##.125.66':445
'88.##.133.71':445
'88.##.160.89':445
'88.##.194.243':445
'88.#3.53.92':445
'88.##.15.102':445
'88.#3.1.108':445
'88.##.122.41':445
'88.##.39.105':445
'88.##.91.164':445
'88.##.97.243':445
'88.##.172.12':139
'88.##.123.40':139
'88.##.75.172':139
'88.#3.137.2':139
'88.##.161.96':139
'88.#3.4.226':445
'88.##.66.136':445
'88.##.56.183':139
'88.##.24.120':139
'88.##.14.183':139
'88.##.80.166':445
'88.##.114.108':445
'88.##.230.213':445
'88.#3.56.0':445
'88.##.239.191':445
'88.##.14.123':445
'88.##.100.18':445
'88.##.114.17':445
'88.##.41.148':445
'88.#3.4.186':445
'88.##.228.38':445
'88.##.157.235':445
'88.##.87.107':445
'88.#3.200.2':445
'88.##.72.209':445
'88.#3.2.209':445
'88.##.208.233':445
'88.##.82.155':445
'88.##.233.225':445
'88.##.135.143':445
'88.##.225.216':445
'88.##.10.120':139
'88.#3.2.209':139
'88.#3.200.2':139
'88.##.72.209':139
'88.##.15.102':139
'88.#3.1.108':139
'88.##.225.216':139
'88.##.233.225':139
'88.##.135.143':139
'88.##.157.235':139
'88.##.87.107':139
'88.##.122.41':139
'88.#3.4.226':139
'88.##.194.243':139
'88.##.97.243':139
'88.##.66.136':139
'88.#3.53.92':139
'88.##.39.105':139
'88.##.91.164':139
'88.##.133.71':139
'88.##.160.89':139
'88.##.125.66':139
'88.##.70.122':139
'88.##.146.210':139
'88.##.21.254':139
'88.##.14.123':139
'88.##.100.18':139
'88.##.184.106':139
'88.##.144.194':139
'88.##.85.136':139
'88.##.52.233':139
'88.##.44.206':139
'88.##.114.17':139
'88.#3.56.0':139
'88.##.239.191':139
'88.##.228.38':139
'88.##.208.233':139
'88.##.82.155':139
'88.##.41.148':139
'88.#3.4.186':139
'88.##.114.108':139
'88.##.230.213':139
'88.##.80.166':139
'88.##.21.254':445
'88.##.224.167':139
'88.##.182.67':139
'88.##.168.32':139
'88.##.87.186':139
'88.#3.6.188':139
'88.#3.14.83':445
'88.##.172.164':445
'88.#3.67.57':445
'88.##.183.49':445
'88.#3.57.29':445
'88.##.109.13':139
'88.##.104.41':139
'88.##.112.144':139
'88.##.27.137':139
'88.##.75.208':139
'88.##.137.107':139
'88.##.165.222':139
'88.##.19.207':139
'88.##.222.74':139
'88.##.171.143':139
'88.##.128.16':139
'88.##.174.179':445
'88.##.58.159':445
'88.##.39.239':445
'88.##.165.76':445
'88.#3.60.37':445
'88.##.104.41':445
'88.##.112.144':445
'88.##.27.137':445
'88.##.75.208':445
'88.##.137.107':445
'88.##.21.129':445
'88.#3.7.123':445
'88.#3.0.128':445
'88.##.115.252':445
'88.#3.2.43':445
'88.##.250.91':445
'88.##.163.170':445
'88.##.128.139':445
'88.##.171.43':445
'88.##.83.124':445
'88.##.51.158':445
'88.##.58.159':139
'88.##.14.183':445
'88.##.56.183':445
'88.##.24.120':445
'88.##.172.12':445
'88.##.123.40':445
'88.##.72.209':9988
'88.##.208.233':9988
'88.##.194.243':9988
'88.#3.1.108':9988
'88.##.125.66':9988
'88.##.75.172':445
'88.##.44.206':445
'88.##.85.136':445
'88.##.52.233':445
'88.##.70.122':445
'88.##.146.210':445
'88.#3.137.2':445
'88.##.161.96':445
'88.##.10.120':445
'88.##.184.106':445
'88.##.144.194':445
'88.##.163.170':139
'88.##.128.139':139
'88.##.171.43':139
'88.##.83.124':139
'88.##.51.158':139
'88.##.39.239':139
'88.##.174.179':139
'88.#3.60.37':139
'88.##.21.129':139
'88.##.165.76':139
'88.#3.0.128':139
'88.#3.67.57':139
'88.#3.14.83':139
'88.#3.57.29':139
'88.##.70.122':9988
'88.##.183.49':139
'88.##.115.252':139
'88.#3.7.123':139
'88.##.250.91':139
'88.##.172.164':139
'88.#3.2.43':139

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial