Trojan.DownLoader40.28064

Technical Information

Network activity

Connects to

'te##.com':80
'ha######d2.persiangig.com':80
'fa###atogh.com':80
'pa##naz.com':443
'st####.hugedomains.com':80
'microsoft.com':80
'pe######hop.injakojast.ir':80
'pa##naz.ir':80
'pe######hop.injakojast.ir':443
'si###n2.rzb.ir':80
's1#.#istats.com':80
's1#.#istats.com':443
's4.##stats.com':443
'x1.#.lencr.org':80
'r3.#.lencr.org':80
'ta##ak.ir':443
'ec###gesim.ir':443
'ec###gesim.ir':80
'as####online.com':80
'my###ficar.com':443
'me###.snn.ir':80
'ro##log.com':80
'ak####.markbaz.com':80
'dl#.ir':80
'encrypted-tbn1.google.com':443
'di###ovie.ir':80
'oc##.#etsolssl.com':80
'pa##naz.com':80
's3.##cofile.com':80
'8p#c.ir':443
'te##.com':443
's3.##cofile.com':443
'encrypted-tbn2.google.com':443
'23.##.121.245':443
'ta##ak.ir':80
'8p#c.ir':80
'ac##lia.ir':80
'cr#.##tsolssl.com':80

TCP

HTTP GET requests

http://ro##log.com/temp/nuke/FBarrow.gif
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://pe######hop.injakojast.ir/adcode/run/banner/v/vertical/1/0/0/null/353/ref:3668
http://www.pa##naz.ir/upload/3/0.502790001308055111_parsnaz_ir.jpg
http://pe######hop.injakojast.ir/adcode/run/banner/v/vertical/1/0/0/null/714/ref:3668
http://www.pa##naz.ir/upload/3/0.247097001308055124_parsnaz_ir.jpg
http://ro##p.ir/up/sibfun2/Pictures/yasyas_pictures(axdownload.com)3.jpg
http://ro##p.ir/up/sibfun2/Pictures/71669388002435937137.gif
http://ro##p.ir/up/sibfun2/Pictures/nabeghe.jpg
http://ro##p.ir/up/sibfun2/Pictures/79991954122935038990.png
http://ro##p.ir/up/sibfun2/Pictures/nabeghe.png
http://www.pa##naz.ir/upload/3/0.180297001308055121_parsnaz_ir.jpg
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPpo69INVwgQi381nNub5v7iw%3D%3D
http://www.pa##naz.ir/upload/3/0.265754001308055125_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.203526001308055123_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.234838001308055122_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.890759001308055119_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.728563001308055118_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.299484001308055117_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.251508001308055116_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.075430001308055115_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/3/0.916242001308055113_parsnaz_ir.jpg
http://www.pa##naz.ir/upload/4/0.812900001309161399_parsnaz_ir.jpg
http://s2.##cofile.com/file/7315387090/%D8%B1%D8%A6%D8%A7%D9%84.jpg
http://ro##log.com/temp/rang/like.png
http://ro##p.ir/up/sibfun2/Pictures/317261_1.jpg
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEA4XQ00je0h9hnmjUyA%2F95g%3D