Trojan.Starman.5045

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER3bef.dir00\svchost.exe.mdmp 16325836412029912

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3bef.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'82.##1.76.90':445
'82.#41.12.7':445
'82.##1.135.31':445
'82.##1.39.103':445
'82.##1.234.195':445
'82.##1.165.49':445
'82.##1.155.112':445
'82.##1.90.197':445
'82.##1.41.206':445
'82.##1.1.227':445
'82.##1.123.53':445
'82.##1.157.239':445
'82.##1.77.191':445
'82.##1.163.137':445
'82.##1.224.67':445
'82.##1.134.43':445
'82.##1.72.222':445
'82.##1.18.73':445
'82.##1.43.19':445
'82.##1.36.148':445
'82.##1.113.174':445
'82.##1.208.49':445
'82.##1.92.136':445
'82.##1.120.193':445
'82.##1.94.98':445
'82.##1.189.173':445
'82.##1.231.26':445
'82.##1.26.200':445
'82.##1.52.23':445
'82.##1.15.80':445
'82.##1.212.236':445
'82.##1.40.34':445
'82.##1.221.135':445
'82.##1.237.8':445
'82.##1.17.42':445
'82.##1.146.192':445
'82.##1.161.8':445
'82.##1.150.226':445
'82.##1.34.139':445
'82.##1.223.54':445
'82.##1.40.34':139
'82.##1.17.42':139
'82.##1.237.8':139
'82.##1.212.236':139
'82.##1.150.226':139
'82.##1.161.8':139
'82.##1.15.80':139
'82.##1.34.139':139
'82.##1.146.192':139
'82.##1.221.135':139
'82.#41.12.7':139
'82.##1.234.195':139
'82.##1.39.103':139
'82.##1.76.90':139
'82.##1.90.197':139
'82.##1.155.112':139
'82.##1.36.148':139
'82.##1.41.206':139
'82.##1.165.49':139
'82.##1.92.136':139
'82.##1.14.80':445
'82.##1.213.13':445
'82.##1.83.45':445
'82.##1.192.109':445
'82.##1.237.212':445
'82.##1.196.4':445
'82.##1.221.149':445
'82.#41.14.1':445
'82.##1.166.21':445
'82.##1.157.38':445
'82.##1.208.49':139
'82.##1.94.98':139
'82.##1.120.193':139
'82.##1.113.174':139
'82.##1.26.200':139
'82.##1.231.26':139
'82.##1.144.253':445
'82.##1.52.23':139
'82.##1.189.173':139
'82.##1.225.78':445
'82.##1.197.8':445
'82.##1.188.148':139
'82.##1.78.163':445
'82.##1.102.41':445
'82.##1.43.118':445
'82.##1.183.43':445
'82.##1.137.244':445
'82.##1.118.137':445
'82.##1.134.210':139
'82.#41.6.23':139
'82.##1.204.58':139
'82.##1.135.221':139
'82.##1.134.135':139
'82.##1.165.84':139
'82.##1.83.60':139
'82.##1.145.30':139
'82.##1.98.173':139
'82.##1.127.157':139
'82.##1.243.85':445
'82.##1.116.24':445
'82.##1.237.191':445
'82.##1.23.208':445
'82.##1.124.178':445
'82.##1.63.185':445
'82.##1.103.44':445
'82.##1.164.218':445
'82.##1.85.197':445
'82.##1.185.241':445
'82.##1.248.226':445
'82.##1.50.247':445
'82.##1.77.76':445
'82.##1.36.174':445
'82.##1.139.146':445
'82.##1.81.77':445
'82.##1.89.78':445
'82.##1.159.207':445
'82.##1.83.199':445
'82.##1.43.224':445
'82.##1.143.39':139
'82.##1.77.76':139
'82.##1.81.77':139
'82.##1.139.146':139
'82.##1.50.247':139
'82.##1.83.199':139
'82.##1.159.207':139
'82.##1.248.226':139
'82.##1.43.224':139
'82.##1.89.78':139
'82.##1.36.174':139
'82.##1.197.8':139
'82.##1.102.41':139
'82.##1.78.163':139
'82.##1.225.78':139
'82.##1.137.244':139
'82.##1.183.43':139
'82.##1.243.85':139
'82.##1.118.137':139
'82.##1.43.118':139
'82.##1.23.208':139
'82.##1.169.200':139
'82.##1.132.79':139
'82.##1.47.251':139
'82.##1.232.246':139
'82.##1.175.231':139
'82.##1.182.6':139
'82.##1.51.16':139
'82.##1.224.175':139
'82.##1.54.238':139
'82.##1.38.197':139
'82.##1.237.191':139
'82.##1.63.185':139
'82.##1.124.178':139
'82.##1.116.24':139
'82.##1.85.197':139
'82.##1.164.218':139
'82.##1.25.164':139
'82.##1.185.241':139
'82.##1.103.44':139
'82.##1.144.245':445
'82.##1.5.174':445
'82.##1.247.117':139
'82.##1.130.190':445
'82.##1.15.251':445
'82.#41.27.0':445
'82.##1.63.62':445
'82.##1.205.201':445
'82.##1.43.58':445
'82.##1.157.30':139
'82.##1.126.39':139
'82.##1.24.46':139
'82.##1.242.48':139
'82.##1.39.56':139
'82.##1.75.130':139
'82.##1.117.107':139
'82.##1.123.100':139
'82.##1.31.191':139
'82.##1.211.171':139
'82.##1.211.135':445
'82.##1.148.114':445
'82.##1.39.55':445
'82.##1.44.197':445
'82.##1.113.231':445
'82.##1.145.237':445
'82.##1.194.199':445
'82.##1.132.71':445
'82.##1.195.146':445
'82.##1.95.70':445
'82.##1.20.52':445
'82.##1.56.190':445
'82.##1.63.212':445
'82.##1.22.39':445
'82.##1.190.131':445
'82.##1.25.69':445
'82.##1.5.105':445
'82.##1.52.17':445
'82.##1.216.57':445
'82.##1.92.164':445
'82.##1.141.97':139
'82.##1.63.212':139
'82.##1.25.69':139
'82.##1.190.131':139
'82.##1.56.190':139
'82.##1.216.57':139
'82.##1.52.17':139
'82.##1.20.52':139
'82.##1.92.164':139
'82.##1.5.105':139
'82.##1.22.39':139
'82.##1.5.174':139
'82.##1.15.251':139
'82.##1.144.245':139
'82.##1.130.190':139
'82.##1.205.201':139
'82.##1.63.62':139
'82.##1.211.135':139
'82.##1.43.58':139
'82.#41.27.0':139
'82.##1.44.197':139
'82.##1.121.216':139
'82.##1.1.209':139
'82.##1.71.191':139
'82.##1.216.130':139
'82.##1.45.65':139
'82.##1.90.31':139
'82.##1.13.227':139
'82.##1.116.249':139
'82.##1.191.220':139
'82.##1.246.160':139
'82.##1.39.55':139
'82.##1.145.237':139
'82.##1.113.231':139
'82.##1.148.114':139
'82.##1.195.146':139
'82.##1.132.71':139
'82.##1.69.207':139
'82.##1.95.70':139
'82.##1.194.199':139
'82.##1.6.252':445
'82.##1.148.252':445
'82.##1.26.76':139
'82.##1.181.220':445
'82.##1.82.158':445
'82.##1.157.38':139
'82.##1.83.45':139
'82.##1.26.76':445
'82.##1.144.253':139
'82.##1.82.158':139
'82.##1.132.71':9988
'82.##1.69.207':9988
'82.##1.95.70':9988
'82.##1.194.199':9988
'82.##1.71.191':9988
'82.##1.6.252':139
'82.##1.148.252':139
'82.##1.191.220':9988
'82.##1.181.220':139
'82.##1.192.109':139
'82.##1.224.67':139
'82.##1.18.73':139
'82.##1.123.53':139
'82.##1.157.239':139
'82.##1.43.19':139
'82.##1.1.227':139
'82.##1.135.31':139
'82.##1.134.43':139
'82.##1.72.222':139
'82.##1.163.137':139
'82.##1.237.212':139
'82.#41.14.1':139
'82.##1.14.80':139
'82.##1.213.13':139
'82.##1.166.21':139
'82.##1.223.54':139
'82.##1.77.191':139
'82.##1.196.4':139
'82.##1.221.149':139
'82.##1.195.146':9988
'82.##1.242.48':445
'82.##1.39.56':445
'82.##1.13.227':445
'82.##1.141.97':445
'82.##1.126.39':445
'82.##1.31.191':445
'82.##1.211.171':445
'82.##1.24.46':445
'82.##1.75.130':445
'82.##1.90.31':445
'82.##1.71.191':445
'82.##1.216.130':445
'82.##1.69.207':445
'82.##1.246.160':445
'82.##1.121.216':445
'82.##1.116.249':445
'82.##1.191.220':445
'82.##1.1.209':445
'82.##1.45.65':445
'82.##1.117.107':445
'82.##1.56.190':9988
'82.##1.63.212':9988
'82.##1.63.62':9988
'82.##1.211.135':9988
'82.##1.216.57':9988
'82.##1.52.17':9988
'82.##1.148.114':9988
'82.##1.92.164':9988
'82.##1.5.105':9988
'82.#41.27.0':9988
'82.##1.247.117':445
'82.##1.130.190':9988
'82.##1.123.100':445
'82.##1.157.30':445
'82.##1.144.245':9988
'82.##1.205.201':9988
'82.##1.43.58':9988
'82.##1.5.174':9988
'82.##1.15.251':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней