Trojan.Starman.5056

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER3e0c.dir00\svchost.exe.mdmp 16325836412032200

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3e0c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'65.##8.166.197':445
'65.##8.209.166':445
'65.##8.43.27':445
'65.##8.171.159':445
'65.##8.20.209':445
'65.##8.185.168':445
'65.##8.168.58':445
'65.#18.50.4':445
'65.##8.78.107':445
'65.##8.2.162':445
'65.#18.19.7':445
'65.##8.46.17':445
'65.##8.100.155':445
'65.##8.83.47':445
'65.##8.248.17':445
'65.##8.73.63':445
'65.##8.176.165':445
'65.##8.182.141':445
'65.##8.207.138':445
'65.##8.198.220':139
'65.##8.137.198':139
'65.##8.103.67':445
'65.##8.118.226':139
'65.##8.82.128':139
'65.##8.255.171':139
'65.##8.194.199':139
'65.##8.147.183':139
'65.##8.171.231':139
'65.##8.89.202':445
'65.##8.69.70':445
'65.##8.95.94':445
'65.##8.17.168':445
'65.##8.181.18':445
'65.##8.174.32':445
'65.#18.12.6':445
'65.##8.65.205':445
'65.##8.113.66':445
'65.##8.44.130':445
'65.##8.44.130':139
'65.#18.12.6':139
'65.##8.174.32':139
'65.##8.113.66':139
'65.##8.65.205':139
'65.#18.0.67':445
'65.#18.95.0':445
'65.##8.89.202':139
'65.##8.103.67':139
'65.##8.95.94':139
'65.#18.50.4':139
'65.##8.78.107':139
'65.##8.209.166':139
'65.##8.20.209':139
'65.##8.185.168':139
'65.##8.181.18':139
'65.##8.69.70':139
'65.##8.168.58':139
'65.##8.17.168':139
'65.##8.68.49':445
'65.##8.33.224':445
'65.##8.241.3':445
'65.##8.248.240':445
'65.##8.221.40':445
'65.#18.23.5':445
'65.##8.101.254':445
'65.##8.228.223':445
'65.##8.13.153':445
'65.#18.3.48':445
'65.##8.151.173':445
'65.##8.38.181':445
'65.#18.38.3':445
'65.##8.142.118':445
'65.##8.142.107':445
'65.##8.53.13':445
'65.##8.3.116':445
'65.##8.179.107':445
'65.##8.187.93':445
'65.##8.194.199':445
'65.##8.220.67':445
'65.##8.171.231':445
'65.##8.255.171':445
'65.##8.39.220':445
'65.##8.104.22':445
'65.##8.96.103':445
'65.##8.130.220':445
'65.##8.21.204':445
'65.##8.147.183':445
'65.##8.192.222':139
'65.##8.112.100':139
'65.##8.118.36':139
'65.##8.210.153':139
'65.##8.53.177':139
'65.##8.137.198':445
'65.##8.82.128':445
'65.##8.118.226':445
'65.##8.198.220':445
'65.##8.13.32':445
'65.##8.249.121':445
'65.##8.135.100':445
'65.##8.47.136':445
'65.##8.26.102':445
'65.##8.178.253':445
'65.##8.171.214':445
'65.##8.15.45':445
'65.##8.136.50':445
'65.##8.100.196':445
'65.##8.123.20':445
'65.##8.3.210':445
'65.##8.159.51':445
'65.##8.30.173':445
'65.##8.5.121':445
'65.##8.46.117':445
'65.##8.126.161':445
'65.##8.162.195':445
'65.##8.39.178':445
'65.##8.39.178':139
'65.##8.46.117':139
'65.##8.5.121':139
'65.##8.162.195':139
'65.##8.126.161':139
'65.##8.47.136':139
'65.##8.13.32':139
'65.##8.100.196':139
'65.##8.135.100':139
'65.##8.3.210':139
'65.##8.130.220':139
'65.##8.21.204':139
'65.##8.220.67':139
'65.##8.39.220':139
'65.##8.104.22':139
'65.##8.30.173':139
'65.##8.123.20':139
'65.##8.96.103':139
'65.##8.159.51':139
'65.##8.171.173':139
'65.##8.112.75':139
'65.##8.56.17':139
'65.##8.65.139':139
'65.##8.25.26':139
'65.##8.14.149':139
'65.##8.176.14':139
'65.##8.59.160':139
'65.##8.149.29':139
'65.#18.9.84':139
'65.##8.15.45':139
'65.##8.136.50':139
'65.##8.249.121':139
'65.##8.26.102':139
'65.##8.178.253':139
'65.##8.199.36':139
'65.##8.84.199':139
'65.##8.171.214':139
'65.##8.36.171':139
'65.##8.166.197':139
'65.##8.178.42':139
'65.##8.69.140':445
'65.##8.210.58':139
'65.##8.78.136':139
'65.##8.236.72':445
'65.##8.217.2':445
'65.##8.161.119':445
'65.##8.146.202':445
'65.##8.123.146':445
'65.##8.49.217':139
'65.##8.124.52':139
'65.##8.79.124':139
'65.##8.209.123':139
'65.##8.76.220':139
'65.##8.54.111':139
'65.##8.207.140':139
'65.##8.160.7':139
'65.##8.155.172':139
'65.##8.198.118':139
'65.##8.62.132':445
'65.##8.185.56':445
'65.##8.22.246':445
'65.##8.22.94':445
'65.##8.146.185':445
'65.##8.236.47':445
'65.##8.28.108':445
'65.##8.217.156':445
'65.##8.71.249':445
'65.##8.62.184':445
'65.##8.77.238':445
'65.##8.56.82':445
'65.##8.205.161':445
'65.##8.50.223':445
'65.##8.73.65':445
'65.##8.153.56':445
'65.#18.22.9':445
'65.##8.19.84':445
'65.##8.69.155':445
'65.##8.69.155':139
'65.##8.153.56':139
'65.##8.73.65':139
'65.##8.19.84':139
'65.#18.22.9':139
'65.##8.22.94':139
'65.##8.62.132':139
'65.##8.62.184':139
'65.##8.22.246':139
'65.##8.56.82':139
'65.##8.146.202':139
'65.##8.123.146':139
'65.##8.236.72':139
'65.##8.69.140':139
'65.##8.217.2':139
'65.##8.50.223':139
'65.##8.77.238':139
'65.##8.161.119':139
'65.##8.205.161':139
'65.##8.49.200':139
'65.##8.215.252':139
'65.##8.128.168':139
'65.##8.122.220':139
'65.##8.136.51':139
'65.##8.43.204':139
'65.##8.211.74':139
'65.##8.98.29':139
'65.##8.187.146':139
'65.##8.38.146':139
'65.##8.217.156':139
'65.##8.71.249':139
'65.##8.185.56':139
'65.##8.146.185':139
'65.##8.236.47':139
'65.##8.254.120':139
'65.##8.37.254':139
'65.##8.28.108':139
'65.##8.57.109':139
'65.##8.179.107':139
'65.##8.187.93':139
'65.##8.38.181':139
'65.##8.142.107':139
'65.##8.53.13':139
'65.##8.241.3':139
'65.##8.248.240':139
'65.##8.3.116':139
'65.#18.3.48':139
'65.##8.151.173':139
'65.##8.122.220':9988
'65.##8.215.252':9988
'65.##8.217.156':9988
'65.##8.57.109':9988
'65.##8.98.29':9988
'65.#18.38.3':139
'65.##8.142.118':139
'65.#18.0.67':139
'65.#18.95.0':139
'65.##8.182.141':139
'65.##8.207.138':139
'65.##8.46.17':139
'65.##8.248.17':139
'65.##8.73.63':139
'65.##8.43.27':139
'65.##8.171.159':139
'65.##8.176.165':139
'65.##8.2.162':139
'65.#18.19.7':139
'65.##8.221.40':139
'65.##8.228.223':139
'65.##8.68.49':139
'65.##8.33.224':139
'65.#18.23.5':139
'65.##8.100.155':139
'65.##8.83.47':139
'65.##8.13.153':139
'65.##8.101.254':139
'65.##8.211.74':445
'65.##8.209.123':445
'65.##8.187.146':445
'65.##8.43.204':445
'65.##8.76.220':445
'65.##8.54.111':445
'65.##8.155.172':445
'65.##8.124.52':445
'65.##8.79.124':445
'65.##8.98.29':445
'65.##8.37.254':445
'65.##8.38.146':445
'65.##8.57.109':445
'65.##8.254.120':445
'65.##8.128.168':445
'65.##8.215.252':445
'65.##8.136.51':445
'65.##8.122.220':445
'65.##8.49.200':445
'65.##8.205.161':9988
'65.##8.50.223':9988
'65.##8.69.140':9988
'65.##8.217.2':9988
'65.##8.73.65':9988
'65.#18.22.9':9988
'65.##8.185.56':9988
'65.##8.19.84':9988
'65.##8.153.56':9988
'65.##8.236.72':9988
'65.##8.160.7':445
'65.##8.49.217':445
'65.##8.198.118':445
'65.##8.207.140':445
'65.##8.210.58':445
'65.##8.123.146':9988
'65.##8.146.202':9988
'65.##8.78.136':445
'65.##8.178.42':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней