Trojan.Starman.4799

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERc013.dir00\svchost.exe.mdmp 16325836412032636

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc013.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'81.##1.17.149':445
'81.##1.235.105':445
'81.##1.218.131':445
'81.##1.195.212':445
'81.##1.197.217':445
'81.##1.173.78':139
'81.##1.134.92':139
'81.##1.62.112':445
'81.##1.98.174':445
'81.##1.39.139':445
'81.##1.233.124':445
'81.##1.209.38':445
'81.##1.136.92':445
'81.##1.124.136':445
'81.##1.73.61':445
'81.##1.16.103':445
'81.##1.165.66':445
'81.##1.176.64':445
'81.##1.135.216':445
'81.##1.71.148':139
'81.##1.20.240':139
'81.##1.189.120':139
'81.#01.8.10':139
'81.##1.66.118':139
'81.##1.149.188':139
'81.##1.70.117':139
'81.##1.174.159':139
'81.##1.138.150':139
'81.##1.99.20':139
'81.##1.43.43':139
'81.##1.91.40':139
'81.##1.60.142':139
'81.##1.241.183':139
'81.##1.214.238':139
'81.##1.70.248':139
'81.##1.230.215':139
'81.##1.122.197':139
'81.##1.135.40':139
'81.##1.132.51':139
'81.##1.92.199':445
'81.##1.127.92':445
'81.##1.152.57':445
'81.##1.26.206':445
'81.##1.93.231':445
'81.##1.57.44':445
'81.##1.72.99':445
'81.##1.43.208':445
'81.##1.142.168':445
'81.##1.218.221':445
'81.##1.31.90':445
'81.##1.235.105':139
'81.##1.197.217':139
'81.##1.195.212':139
'81.##1.17.149':139
'81.##1.62.112':139
'81.##1.142.201':445
'81.##1.47.174':445
'81.##1.98.174':139
'81.##1.220.251':445
'81.##1.174.184':445
'81.#01.4.47':445
'81.##1.154.166':445
'81.##1.190.135':445
'81.##1.198.251':445
'81.##1.109.154':445
'81.##1.55.26':445
'81.##1.149.124':445
'81.##1.88.109':445
'81.##1.27.44':445
'81.##1.112.244':445
'81.##1.96.21':445
'81.##1.48.153':445
'81.##1.76.18':445
'81.##1.21.44':445
'81.##1.123.178':445
'81.##1.203.21':445
'81.##1.236.105':445
'81.##1.31.217':445
'81.##1.151.233':445
'81.##1.66.230':139
'81.##1.206.105':445
'81.##1.223.206':445
'81.##1.66.230':445
'81.##1.213.128':445
'81.#01.6.30':445
'81.##1.9.237':445
'81.##1.124.54':445
'81.##1.177.81':445
'81.##1.237.10':445
'81.##1.174.159':445
'81.##1.66.118':445
'81.##1.20.240':445
'81.#01.8.10':445
'81.##1.43.43':445
'81.##1.189.120':445
'81.##1.99.20':445
'81.##1.70.117':445
'81.##1.149.188':445
'81.##1.138.150':445
'81.##1.184.85':445
'81.##1.160.183':445
'81.##1.240.156':445
'81.##1.124.74':445
'81.##1.200.124':445
'81.##1.110.200':445
'81.##1.54.39':445
'81.##1.35.254':445
'81.##1.84.239':445
'81.##1.5.139':445
'81.##1.46.170':445
'81.##1.206.8':445
'81.##1.55.236':445
'81.##1.132.197':445
'81.##1.32.25':445
'81.##1.5.193':445
'81.##1.20.147':445
'81.##1.70.194':445
'81.##1.53.199':445
'81.##1.152.9':445
'81.##1.122.197':445
'81.##1.55.236':139
'81.##1.5.193':139
'81.##1.32.25':139
'81.##1.206.8':139
'81.##1.53.199':139
'81.##1.70.194':139
'81.##1.46.170':139
'81.##1.152.9':139
'81.##1.20.147':139
'81.##1.132.197':139
'81.##1.223.206':139
'81.#01.6.30':139
'81.##1.213.128':139
'81.##1.206.105':139
'81.##1.177.81':139
'81.##1.124.54':139
'81.##1.184.85':139
'81.##1.237.10':139
'81.##1.9.237':139
'81.##1.124.74':139
'81.##1.214.238':445
'81.##1.60.142':445
'81.##1.71.148':445
'81.##1.241.183':445
'81.##1.91.40':445
'81.##1.132.51':445
'81.##1.230.215':445
'81.##1.70.248':445
'81.##1.135.40':445
'81.##1.134.92':445
'81.##1.240.156':139
'81.##1.110.200':139
'81.##1.200.124':139
'81.##1.160.183':139
'81.##1.84.239':139
'81.##1.35.254':139
'81.##1.173.78':445
'81.##1.5.139':139
'81.##1.54.39':139
'81.##1.219.220':445
'81.##1.243.208':445
'81.##1.223.116':139
'81.##1.23.208':445
'81.##1.234.172':445
'81.##1.84.115':445
'81.##1.148.245':445
'81.##1.209.250':445
'81.##1.79.227':445
'81.##1.182.220':139
'81.##1.135.48':139
'81.##1.108.227':139
'81.##1.184.179':139
'81.##1.23.178':139
'81.##1.227.212':139
'81.##1.12.23':139
'81.##1.221.53':139
'81.##1.234.227':139
'81.##1.251.233':139
'81.##1.172.143':445
'81.##1.145.23':445
'81.##1.64.195':445
'81.##1.60.235':445
'81.##1.241.60':445
'81.##1.69.65':445
'81.##1.49.224':445
'81.##1.58.13':445
'81.##1.158.18':445
'81.##1.102.178':445
'81.##1.44.17':445
'81.##1.183.159':445
'81.##1.20.65':445
'81.##1.159.215':445
'81.##1.69.84':445
'81.##1.238.183':445
'81.##1.128.222':445
'81.##1.107.129':445
'81.##1.214.171':445
'81.##1.98.247':445
'81.##1.182.16':139
'81.##1.183.159':139
'81.##1.238.183':139
'81.##1.69.84':139
'81.##1.20.65':139
'81.##1.214.171':139
'81.##1.107.129':139
'81.##1.60.235':139
'81.##1.98.247':139
'81.##1.128.222':139
'81.##1.172.143':139
'81.##1.219.220':139
'81.##1.243.208':139
'81.##1.79.227':139
'81.##1.209.250':139
'81.##1.23.208':139
'81.##1.148.245':139
'81.##1.159.215':139
'81.##1.234.172':139
'81.##1.84.115':139
'81.##1.44.17':139
'81.##1.71.194':139
'81.##1.102.211':139
'81.##1.184.209':139
'81.##1.6.233':139
'81.##1.140.86':139
'81.##1.154.108':139
'81.##1.17.81':139
'81.##1.177.140':139
'81.##1.54.177':139
'81.##1.216.241':139
'81.##1.64.195':139
'81.##1.69.65':139
'81.##1.241.60':139
'81.##1.145.23':139
'81.##1.158.18':139
'81.##1.58.13':139
'81.##1.221.58':139
'81.##1.102.178':139
'81.##1.49.224':139
'81.##1.221.58':445
'81.##1.123.178':139
'81.##1.31.217':139
'81.##1.96.21':139
'81.##1.48.153':139
'81.##1.151.233':139
'81.##1.190.135':139
'81.##1.112.244':139
'81.##1.203.21':139
'81.##1.236.105':139
'81.##1.21.44':139
'81.##1.142.168':139
'81.##1.57.44':139
'81.##1.127.92':139
'81.##1.152.57':139
'81.##1.218.221':139
'81.##1.76.18':139
'81.##1.174.184':139
'81.##1.72.99':139
'81.##1.43.208':139
'81.##1.198.251':139
'81.##1.73.61':139
'81.##1.176.64':139
'81.##1.233.124':139
'81.##1.209.38':139
'81.##1.135.216':139
'81.##1.39.139':139
'81.##1.218.131':139
'81.##1.16.103':139
'81.##1.165.66':139
'81.##1.124.136':139
'81.##1.109.154':139
'81.##1.88.109':139
'81.#01.4.47':139
'81.##1.154.166':139
'81.##1.27.44':139
'81.##1.92.199':139
'81.##1.136.92':139
'81.##1.55.26':139
'81.##1.149.124':139
'81.##1.26.206':139
'81.##1.23.178':445
'81.##1.135.48':445
'81.##1.182.16':445
'81.##1.184.179':445
'81.##1.108.227':445
'81.##1.251.233':445
'81.##1.221.53':445
'81.##1.227.212':445
'81.##1.234.227':445
'81.##1.154.108':445
'81.##1.184.209':445
'81.##1.6.233':445
'81.##1.216.241':445
'81.##1.71.194':445
'81.##1.102.211':445
'81.##1.54.177':445
'81.##1.17.81':445
'81.##1.140.86':445
'81.##1.177.140':445
'81.##1.223.116':445
'81.##1.107.129':9988
'81.##1.182.220':9988
'81.##1.158.18':9988
'81.##1.214.171':9988
'81.##1.220.251':139
'81.##1.31.90':139
'81.##1.93.231':139
'81.##1.142.201':139
'81.##1.47.174':139
'81.##1.219.220':9988
'81.##1.23.208':9988
'81.##1.216.241':9988
'81.##1.182.220':445
'81.##1.12.23':445
'81.##1.243.208':9988
'81.##1.234.172':9988
'81.##1.6.233':9988
'81.##1.98.247':9988
'81.##1.140.86':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней