Trojan.DownLoader39.46813

Technical Information

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021061520210616\index.dat

Modifies the following files

Network activity

Connects to

'ro##log.com':80
'on####.1abzar.com':80
'to###.1abzar.com':443
'1a##ar.ir':80
'ne######a.tasnimnews.com':443
'go#.gl':443
'uu##oad.ir':80
'vi######ratk.persiangig.com':80
'cd#.#araru.com':80
'ra##.rzb.ir':80
'cd#.#araru.com':443
'uu##oad.ir':443
'go#####analytics.com':80
'microsoft.com':80
'x1.#.lencr.org':80
'r3.#.lencr.org':80

TCP

HTTP GET requests

http://ro##log.com/webuser/file/forum/temp15/files/wdyekan.eot?
http://www.1a##ar.com/files/pic-abzar/nazar.jpg
http://www.1a##ar.com/files/pic-abzar/fix.jpg
http://www.1a##ar.com/files/pic-abzar/dic.jpg
http://www.1a##ar.com/files/pic-abzar/ray.jpg
http://www.1a##ar.com/files/pic-abzar/up.jpg
http://www.1a##ar.com/files/resp16.png
http://www.1a##ar.com/files/resp13.png
http://www.1a##ar.com/files/resp18.png
http://www.1a##ar.com/ads/ban387.gif
http://www.1a##ar.com/files/resp19.png
http://www.1a##ar.com/files/resp1.png
http://www.1a##ar.com/files/dot.gif
http://www.1a##ar.com/files/resp9.png
http://www.1a##ar.com/files/pic-abzar/news.jpg
http://www.1a##ar.com/files/pic-abzar/behesht.jpg
http://www.1a##ar.com/files/pic-abzar/hava.jpg
http://www.1a##ar.com/files/pic-abzar/lig.jpg
http://www.1a##ar.com/files/resp21.png
http://www.1a##ar.com/files/resp2.png
http://www.1a##ar.com/files/ver2/bg3.png
http://www.1a##ar.com/files/pic-abzar/date.jpg
http://www.1a##ar.com/files/resp20.png
http://www.1a##ar.com/files/resp15.jpg
http://www.go#####analytics.com/r/__utm.gif?ut###################################################################################################################################################...
http://www.1a##ar.com/files/pic-abzar/contact.jpg
http://www.1a##ar.com/files/ver2/vj.jpg
http://www.1a##ar.com/files/pic-abzar/amar.jpg
http://www.1a##ar.com/files/resp14.png
http://ro##log.com/webuser/file/forum/temp15/images/bg.png
http://ro##log.com/webuser/file/forum/temp15/images/li.png
http://ro##log.com/webuser/file/forum/temp15/images/toplinks.png
http://ro##log.com/webuser/file/forum/temp15/images/box_title.png
http://ro##log.com/webuser/file/forum/temp15/images/block_top.png
http://ro##log.com/webuser/file/forum/temp15/images/post_top.png
http://vi######ratk.persiangig.com/image/Menu/r2.jpg
http://uu##oad.ir/files/16e3_slide1.jpg
http://www.1a##ar.com/jquery.min.js
http://www.1a##ar.com/style-v3.css
http://www.1a##ar.com/files/IRANSansWeb.eot?
http://www.1a##ar.com/files/resp17.png
http://www.1a##ar.com/files/pic-abzar/azan.jpg
http://www.1a##ar.com/files/logor.png
http://www.1a##ar.com/files/ads.gif
http://www.1a##ar.com/files/ver2/bg.png
http://www.1a##ar.com/files/pic-abzar/support.jpg
http://www.1a##ar.com/files/pic-abzar/moz.png
http://www.1a##ar.com/files/pic-abzar/scroll.jpg
http://www.1a##ar.com/files/pic-abzar/convert-date.jpg
http://www.1a##ar.com/files/pic-abzar/video.jpg
http://www.1a##ar.com/files/pic-abzar/taghvim.jpg
http://www.1a##ar.com/files/pic-abzar/alexa.jpg
http://www.1a##ar.com/files/pic-abzar/music.jpg
http://www.1a##ar.com/files/pic-abzar/slider.jpg
http://www.1a##ar.com/favicon.ico