Trojan.Starman.5917

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER1f70.dir00\svchost.exe.mdmp 16325836412032412

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'20#.#07.176.89':139
'20#.#07.109.121':139
'20#.#07.200.51':445
'20#.#07.84.185':445
'20#.#07.240.108':139
'20#.#07.109.121':445
'20#.#07.240.108':445
'20#.#07.11.57':139
'20#.#07.176.89':445
'20#.#07.51.186':445
'20#.#07.231.30':445
'20#.#07.237.18':445
'20#.#07.51.135':445
'20#.#07.80.76':445
'20#.#07.48.71':445
'20#.#07.72.77':445
'20#.#07.182.79':445
'20#.#07.187.112':445
'20#.#07.77.80':445
'20#.#07.11.57':445
'20#.#07.169.148':139
'20#.#07.170.169':139
'20#.#07.213.37':139
'20#.#07.34.167':139
'20#.#07.28.171':139
'20#.#07.41.9':139
'20#.#07.118.54':139
'20#.#07.46.188':139
'20#.#07.139.198':139
'20#.#07.61.64':139
'20#.#07.25.46':139
'20#.#07.12.228':139
'20#.#07.78.121':139
'20#.#07.46.18':139
'20#.#07.82.176':139
'20#.#07.63.240':139
'20#.#07.137.175':139
'20#.#07.176.146':139
'20#.#07.49.43':139
'20#.#07.176.68':445
'20#.#07.72.176':445
'20#.#07.39.159':445
'20#.#07.69.40':445
'20#.#07.163.34':445
'20#.#07.255.82':445
'20#.#07.82.209':445
'20#.#07.219.232':445
'20#.#07.43.200':445
'20#.#07.11.131':445
'20#.#07.200.51':139
'20#.#07.84.185':139
'20#.#07.182.79':139
'20#.#07.51.186':139
'20#.#07.182.168':445
'20#.#07.5.38':445
'20#.#07.126.28':445
'20#.#07.51.21':445
'20#.#07.89.44':445
'20#.#07.142.41':445
'20#.#07.20.121':445
'20#.#07.37.20':445
'20#.#07.227.122':445
'20#.#07.64.165':445
'20#.#07.21.37':445
'20#.#07.135.32':445
'20#.#07.62.182':445
'20#.#07.129.5':445
'20#.#07.106.231':445
'20#.#07.95.208':445
'20#.#07.74.213':445
'20#.#07.134.3':445
'20#.#07.123.142':445
'20#.#07.126.155':445
'20#.#07.8.30':445
'20#.#07.11.135':445
'20#.#07.53.51':445
'20#.#07.251.30':445
'20#.#07.118.3':445
'20#.#07.109.139':139
'20#.#07.252.47':445
'20#.#07.181.19':445
'20#.#07.160.209':445
'20#.#07.254.55':445
'20#.#07.210.130':445
'20#.#07.121.71':445
'20#.#07.231.57':445
'20#.#07.245.32':445
'20#.#07.89.158':445
'20#.#07.24.134':445
'20#.#07.28.171':445
'20#.#07.46.188':445
'20#.#07.169.148':445
'20#.#07.170.169':445
'20#.#07.139.198':445
'20#.#07.109.139':445
'20#.#07.134.133':445
'20#.#07.41.9':445
'20#.#07.118.54':445
'20#.#07.163.231':445
'20#.#07.146.54':445
'20#.#07.96.21':445
'20#.#07.253.65':445
'20#.#07.113.166':445
'20#.#07.153.91':445
'20#.#07.1.111':139
'20#.#07.155.205':139
'20#.#07.228.68':139
'20#.#07.1.138':139
'20#.#07.106.43':445
'20#.#07.76.135':445
'20#.#07.115.202':445
'20#.#07.214.18':445
'20#.#07.70.49':445
'20#.#07.31.144':445
'20#.#07.111.141':445
'20#.#07.4.147':445
'20#.#07.190.189':445
'20#.#07.179.190':445
'20#.#07.214.18':139
'20#.#07.70.49':139
'20#.#07.231.57':139
'20#.#07.163.231':139
'20#.#07.76.135':139
'20#.#07.190.189':139
'20#.#07.179.190':139
'20#.#07.115.202':139
'20#.#07.31.144':139
'20#.#07.121.71':139
'20#.#07.160.209':139
'20#.#07.254.55':139
'20#.#07.134.133':139
'20#.#07.24.134':139
'20#.#07.252.47':139
'20#.#07.245.32':139
'20#.#07.89.158':139
'20#.#07.181.19':139
'20#.#07.210.130':139
'20#.#07.111.141':139
'20#.#07.176.146':445
'20#.#07.49.43':445
'20#.#07.12.228':445
'20#.#07.82.176':445
'20#.#07.63.240':445
'20#.#07.213.37':445
'20#.#07.34.167':445
'20#.#07.137.175':445
'20#.#07.61.64':445
'20#.#07.25.46':445
'20#.#07.253.65':139
'20#.#07.113.166':139
'20#.#07.4.147':139
'20#.#07.106.43':139
'20#.#07.146.54':139
'20#.#07.78.121':445
'20#.#07.46.18':445
'20#.#07.96.21':139
'20#.#07.153.91':139
'20#.#07.72.77':139
'20#.#07.154.62':445
'20#.#07.161.105':445
'20#.#07.219.22':139
'20#.#07.72.66':139
'20#.#07.13.123':445
'20#.#07.235.227':445
'20#.#07.95.35':445
'20#.#07.214.251':445
'20#.#07.10.2':445
'20#.#07.238.121':139
'20#.#07.81.28':139
'20#.#07.129.95':139
'20#.#07.231.56':139
'20#.#07.28.231':139
'20#.#07.75.32':139
'20#.#07.254.124':139
'20#.#07.117.254':139
'20#.#07.84.233':139
'20#.#07.3.133':139
'20#.#07.152.135':445
'20#.#07.7.27':445
'20#.#07.35.175':445
'20#.#07.172.88':445
'20#.#07.13.141':445
'20#.#07.38.137':445
'20#.#07.53.66':445
'20#.#07.219.0':445
'20#.#07.202.33':445
'20#.#07.116.67':445
'20#.#07.167.192':445
'20#.#07.207.186':445
'20#.#07.26.100':445
'20#.#07.168.93':445
'20#.#07.23.28':445
'20#.#07.173.105':445
'20#.#07.80.169':445
'20#.#07.5.171':445
'20#.#07.103.143':445
'20#.#07.20.235':445
'20#.#07.173.105':139
'20#.#07.103.143':139
'20#.#07.207.186':139
'20#.#07.26.100':139
'20#.#07.20.235':139
'20#.#07.167.192':139
'20#.#07.172.88':139
'20#.#07.80.169':139
'20#.#07.5.171':139
'20#.#07.23.28':139
'20#.#07.154.62':139
'20#.#07.13.123':139
'20#.#07.161.105':139
'20#.#07.214.251':139
'20#.#07.10.2':139
'20#.#07.152.135':139
'20#.#07.168.93':139
'20#.#07.235.227':139
'20#.#07.95.35':139
'20#.#07.13.141':139
'20#.#07.84.15':139
'20#.#07.32.159':139
'20#.#07.89.251':139
'20#.#07.124.107':139
'20#.#07.177.229':139
'20#.#07.30.92':139
'20#.#07.45.31':139
'20#.#07.4.125':139
'20#.#07.36.121':139
'20#.#07.26.244':139
'20#.#07.38.137':139
'20#.#07.202.33':139
'20#.#07.7.27':139
'20#.#07.35.175':139
'20#.#07.116.67':139
'20#.#07.37.11':139
'20#.#07.161.25':139
'20#.#07.53.66':139
'20#.#07.219.0':139
'20#.#07.37.11':445
'20#.#07.142.41':139
'20#.#07.123.142':139
'20#.#07.255.82':139
'20#.#07.82.209':139
'20#.#07.126.155':139
'20#.#07.8.30':139
'20#.#07.251.30':139
'20#.#07.74.213':139
'20#.#07.134.3':139
'20#.#07.43.200':139
'20#.#07.11.131':139
'20#.#07.39.159':139
'20#.#07.5.38':139
'20#.#07.126.28':139
'20#.#07.69.40':139
'20#.#07.163.34':139
'20#.#07.219.232':139
'20#.#07.176.68':139
'20#.#07.72.176':139
'20#.#07.118.3':139
'20#.#07.51.135':139
'20#.#07.80.76':139
'20#.#07.135.32':139
'20#.#07.62.182':139
'20#.#07.231.30':139
'20#.#07.187.112':139
'20#.#07.77.80':139
'20#.#07.237.18':139
'20#.#07.48.71':139
'20#.#07.106.231':139
'20#.#07.95.208':139
'20#.#07.227.122':139
'20#.#07.11.135':139
'20#.#07.53.51':139
'20#.#07.64.165':139
'20#.#07.21.37':139
'20#.#07.129.5':139
'20#.#07.20.121':139
'20#.#07.37.20':139
'20#.#07.28.231':445
'20#.#07.81.28':445
'20#.#07.45.31':445
'20#.#07.231.56':445
'20#.#07.129.95':445
'20#.#07.3.133':445
'20#.#07.254.124':445
'20#.#07.75.32':445
'20#.#07.84.233':445
'20#.#07.30.92':445
'20#.#07.89.251':445
'20#.#07.124.107':445
'20#.#07.161.25':445
'20#.#07.26.244':445
'20#.#07.84.15':445
'20#.#07.4.125':445
'20#.#07.36.121':445
'20#.#07.32.159':445
'20#.#07.177.229':445
'20#.#07.117.254':445
'20#.#07.124.107':9988
'20#.#07.177.229':9988
'20#.#07.116.67':9988
'20#.#07.37.11':9988
'20#.#07.84.15':9988
'20#.#07.51.21':139
'20#.#07.89.44':139
'20#.#07.219.22':9988
'20#.#07.182.168':139
'20#.#07.38.137':9988
'20#.#07.72.66':445
'20#.#07.161.105':9988
'20#.#07.238.121':445
'20#.#07.219.22':445
'20#.#07.235.227':9988
'20#.#07.5.171':9988
'20#.#07.7.27':9988
'20#.#07.154.62':9988
'20#.#07.214.251':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней