Trojan.Starman.5967

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc63c.dir00\svchost.exe.mdmp 16325836412032140

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc63c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'67.##.103.183':445
'67.##.140.104':445
'67.##.172.211':445
'67.##.135.246':445
'67.##.233.135':445
'67.##.99.100':445
'67.##.103.82':139
'67.##.211.147':445
'67.##.218.210':445
'67.##.121.195':445
'67.##.54.120':445
'67.##.97.235':445
'67.##.121.117':445
'67.##.187.200':445
'67.##.31.145':445
'67.##.120.123':445
'67.#0.12.75':445
'67.##.161.134':445
'67.#0.13.20':445
'67.##.110.98':445
'67.##.37.242':139
'67.##.199.230':139
'67.##.207.33':139
'67.##.36.168':139
'67.##.223.177':139
'67.#0.93.89':139
'67.#0.81.59':139
'67.##.112.76':139
'67.##.188.36':139
'67.##.76.149':139
'67.##.142.132':139
'67.##.88.196':139
'67.#0.10.46':139
'67.#0.0.88':139
'67.##.19.113':139
'67.##.110.171':139
'67.##.123.122':139
'67.##.196.185':139
'67.##.133.205':139
'67.##.127.205':139
'67.##.61.238':445
'67.##.145.192':445
'67.##.179.174':445
'67.#0.176.8':445
'67.##.162.159':445
'67.#0.66.87':445
'67.##.119.133':445
'67.##.107.119':445
'67.##.213.201':445
'67.##.37.147':445
'67.#0.71.83':445
'67.##.103.183':139
'67.##.140.104':139
'67.##.172.211':139
'67.##.135.246':139
'67.##.233.135':139
'67.##.99.100':139
'67.##.118.140':445
'67.##.211.147':139
'67.##.218.210':139
'67.##.121.195':139
'67.##.238.174':445
'67.##.65.130':445
'67.##.64.201':445
'67.##.22.177':445
'67.##.114.33':445
'67.##.163.152':445
'67.##.144.38':445
'67.##.163.167':445
'67.##.244.140':445
'67.#0.212.1':445
'67.##.170.187':445
'67.#0.0.197':445
'67.##.15.169':445
'67.##.69.107':445
'67.##.181.46':445
'67.##.35.237':445
'67.##.200.86':445
'67.#0.74.53':445
'67.#0.54.0':445
'67.##.124.54':445
'67.#0.41.98':445
'67.##.255.248':445
'67.#0.95.86':445
'67.##.146.47':445
'67.##.101.111':445
'67.#0.61.10':445
'67.##.166.105':445
'67.##.44.105':445
'67.##.201.73':445
'67.##.49.201':445
'67.##.37.242':445
'67.##.199.230':445
'67.##.207.33':445
'67.##.36.168':445
'67.##.223.177':445
'67.#0.93.89':445
'67.#0.81.59':445
'67.##.112.76':445
'67.##.188.36':445
'67.##.76.149':445
'67.##.133.209':445
'67.##.187.133':445
'67.##.33.180':445
'67.##.143.42':445
'67.##.178.20':445
'67.##.29.184':445
'67.##.169.124':445
'67.#0.36.54':445
'67.##.161.187':445
'67.##.240.161':445
'67.##.176.51':445
'67.#0.168.8':445
'67.##.18.134':445
'67.##.128.217':445
'67.##.182.122':445
'67.##.152.74':445
'67.#0.6.152':445
'67.#0.74.31':445
'67.##.216.52':445
'67.##.29.235':445
'67.##.123.122':445
'67.##.176.51':139
'67.#0.168.8':139
'67.##.18.134':139
'67.##.128.217':139
'67.##.182.122':139
'67.##.152.74':139
'67.#0.6.152':139
'67.#0.74.31':139
'67.##.216.52':139
'67.##.29.235':139
'67.#0.41.98':139
'67.##.255.248':139
'67.#0.95.86':139
'67.##.146.47':139
'67.##.101.111':139
'67.#0.61.10':139
'67.##.166.105':139
'67.##.44.105':139
'67.##.201.73':139
'67.##.49.201':139
'67.#0.10.46':445
'67.##.142.132':445
'67.##.19.113':445
'67.##.103.82':445
'67.#0.0.88':445
'67.##.196.185':445
'67.##.110.171':445
'67.##.127.205':445
'67.##.88.196':445
'67.##.133.205':445
'67.##.133.209':139
'67.##.187.133':139
'67.##.33.180':139
'67.##.143.42':139
'67.##.178.20':139
'67.##.29.184':139
'67.##.169.124':139
'67.#0.36.54':139
'67.##.161.187':139
'67.##.240.161':139
'67.#0.12.75':139
'67.##.124.27':445
'67.##.188.138':445
'67.##.105.126':445
'67.##.138.123':445
'67.#0.65.31':445
'67.##.125.71':445
'67.##.37.182':445
'67.#0.72.0':445
'67.##.27.167':445
'67.##.37.176':445
'67.##.53.218':139
'67.#0.78.25':139
'67.##.165.200':139
'67.#0.81.27':139
'67.##.207.80':139
'67.##.202.125':139
'67.##.115.202':139
'67.##.146.111':139
'67.##.223.14':139
'67.##.165.247':139
'67.#0.9.76':445
'67.##.139.47':445
'67.##.84.117':445
'67.#0.88.3':445
'67.##.117.170':445
'67.##.182.64':445
'67.##.138.182':445
'67.##.41.102':445
'67.##.177.209':445
'67.##.13.118':445
'67.##.148.99':445
'67.##.97.147':445
'67.#0.99.21':445
'67.##.155.118':445
'67.##.150.166':445
'67.##.146.57':445
'67.##.126.65':445
'67.##.29.227':445
'67.#0.40.46':445
'67.##.125.207':445
'67.##.127.165':139
'67.##.148.99':139
'67.##.97.147':139
'67.#0.99.21':139
'67.##.155.118':139
'67.##.150.166':139
'67.##.146.57':139
'67.##.126.65':139
'67.##.29.227':139
'67.#0.40.46':139
'67.##.125.207':139
'67.##.188.138':139
'67.##.105.126':139
'67.##.138.123':139
'67.##.27.167':139
'67.##.124.27':139
'67.##.125.71':139
'67.##.37.182':139
'67.#0.72.0':139
'67.#0.65.31':139
'67.##.37.176':139
'67.##.117.70':139
'67.##.100.35':139
'67.##.11.154':139
'67.##.40.240':139
'67.##.52.169':139
'67.##.224.172':139
'67.#0.5.77':139
'67.##.134.103':139
'67.#0.44.20':139
'67.#0.50.50':139
'67.#0.9.76':139
'67.##.139.47':139
'67.##.84.117':139
'67.#0.88.3':139
'67.##.117.170':139
'67.##.182.64':139
'67.##.138.182':139
'67.##.41.102':139
'67.##.177.209':139
'67.##.13.118':139
'67.##.170.187':139
'67.#0.0.197':139
'67.##.15.169':139
'67.##.69.107':139
'67.##.181.46':139
'67.##.35.237':139
'67.##.200.86':139
'67.#0.74.53':139
'67.#0.54.0':139
'67.##.124.54':139
'67.##.145.192':139
'67.##.179.174':139
'67.#0.176.8':139
'67.##.162.159':139
'67.#0.66.87':139
'67.##.119.133':139
'67.##.107.119':139
'67.##.213.201':139
'67.##.37.147':139
'67.#0.71.83':139
'67.##.121.117':139
'67.##.54.120':139
'67.##.31.145':139
'67.##.61.238':139
'67.##.187.200':139
'67.##.161.134':139
'67.##.120.123':139
'67.##.110.98':139
'67.##.97.235':139
'67.#0.13.20':139
'67.##.238.174':139
'67.##.65.130':139
'67.##.64.201':139
'67.##.22.177':139
'67.##.114.33':139
'67.##.163.152':139
'67.##.144.38':139
'67.##.163.167':139
'67.##.244.140':139
'67.#0.212.1':139
'67.##.118.140':139
'67.##.165.200':445
'67.##.53.218':445
'67.##.207.80':445
'67.##.127.165':445
'67.#0.81.27':445
'67.##.146.111':445
'67.##.202.125':445
'67.##.165.247':445
'67.#0.78.25':445
'67.##.223.14':445
'67.##.117.70':445
'67.##.100.35':445
'67.##.11.154':445
'67.##.40.240':445
'67.##.52.169':445
'67.##.224.172':445
'67.#0.5.77':445
'67.##.134.103':445
'67.#0.44.20':445
'67.#0.50.50':445
'67.##.177.209':9988
'67.##.182.64':9988
'67.##.139.47':9988
'67.#0.88.3':9988
'67.##.84.117':9988
'67.##.11.154':9988
'67.##.117.70':9988
'67.##.52.169':9988
'67.##.138.182':9988
'67.##.40.240':9988
'67.##.27.167':9988
'67.##.155.118':9988
'67.##.188.138':9988
'67.##.115.202':445
'67.##.124.27':9988
'67.#0.40.46':9988
'67.##.146.57':9988
'67.##.97.147':9988
'67.#0.99.21':9988
'67.##.148.99':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней