Trojan.Starman.5097

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER551a.dir00\svchost.exe.mdmp 16325836412032192

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER551a.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'58.##3.66.175':139
'58.##3.93.110':139
'58.##3.175.160':139
'58.##3.97.204':139
'58.##3.240.157':139
'58.##3.121.192':139
'58.##3.35.40':139
'58.##3.103.166':139
'58.##3.98.113':139
'58.##3.85.83':139
'58.##3.109.87':445
'58.##3.114.222':445
'58.##3.46.150':445
'58.##3.238.110':445
'58.##3.216.240':445
'58.##3.56.131':139
'58.##3.204.198':139
'58.##3.4.124':139
'58.##3.148.66':445
'58.##3.173.122':445
'58.##3.31.207':139
'58.##3.35.40':445
'58.##3.31.207':445
'58.##3.121.192':445
'58.##3.85.83':445
'58.##3.103.166':445
'58.##3.102.65':139
'58.##3.8.186':139
'58.#03.38.9':139
'58.##3.63.83':445
'58.##3.172.63':139
'58.##3.204.198':445
'58.##3.97.204':445
'58.##3.56.131':445
'58.##3.63.83':139
'58.##3.4.124':445
'58.##3.93.110':445
'58.##3.98.113':445
'58.##3.66.175':445
'58.##3.240.157':445
'58.##3.175.160':445
'58.##3.111.10':445
'58.#03.7.90':445
'58.##3.189.160':445
'58.##3.173.122':139
'58.##3.114.222':139
'58.##3.148.66':139
'58.##3.31.136':445
'58.##3.117.14':445
'58.##3.71.217':445
'58.##3.192.142':445
'58.##3.135.192':445
'58.##3.96.185':139
'58.##3.10.241':139
'58.##3.255.50':139
'58.##3.46.186':139
'58.##3.224.102':139
'58.##3.46.150':139
'58.##3.109.87':139
'58.##3.216.240':139
'58.##3.111.10':139
'58.##3.238.110':139
'58.##3.38.209':445
'58.##3.182.151':445
'58.##3.141.182':445
'58.##3.161.154':445
'58.##3.27.111':445
'58.##3.17.11':445
'58.##3.96.185':445
'58.##3.10.241':445
'58.##3.255.50':445
'58.##3.46.186':445
'58.##3.224.102':445
'58.##3.148.154':445
'58.##3.80.149':445
'58.##3.24.242':445
'58.##3.131.229':445
'58.##3.157.233':445
'58.##3.41.89':445
'58.##3.139.171':445
'58.##3.95.77':445
'58.##3.40.80':445
'58.##3.110.40':445
'58.##3.162.43':445
'58.##3.93.162':445
'58.##3.229.127':445
'58.##3.130.193':445
'58.##3.118.60':445
'58.#03.7.29':445
'58.##3.203.100':445
'58.##3.17.120':445
'58.##3.67.214':445
'58.##3.245.44':445
'58.##3.102.108':445
'58.##3.250.21':445
'58.##3.249.165':445
'58.##3.49.90':445
'58.##3.165.189':445
'58.##3.36.215':445
'58.##3.247.220':445
'58.##3.190.104':445
'58.##3.170.77':445
'58.##3.67.109':445
'58.##3.231.202':445
'58.##3.126.148':139
'58.##3.120.115':139
'58.##3.251.112':139
'58.##3.168.62':139
'58.##3.150.41':139
'58.##3.62.49':139
'58.##3.10.232':139
'58.##3.53.78':139
'58.##3.195.37':139
'58.##3.80.66':139
'58.##3.203.129':445
'58.#03.9.63':445
'58.##3.22.137':445
'58.##3.159.11':445
'58.#03.5.82':445
'58.##3.111.94':139
'58.##3.42.160':139
'58.##3.7.135':139
'58.##3.182.203':139
'58.##3.224.35':139
'58.##3.128.251':445
'58.##3.190.104':139
'58.##3.36.215':139
'58.##3.67.109':139
'58.##3.250.21':139
'58.##3.170.77':139
'58.##3.229.127':139
'58.##3.162.43':139
'58.##3.118.60':139
'58.##3.247.220':139
'58.##3.130.193':139
'58.##3.180.217':139
'58.##3.151.44':139
'58.##3.217.250':139
'58.##3.104.112':139
'58.##3.56.244':139
'58.##3.249.165':139
'58.##3.102.108':139
'58.##3.165.189':139
'58.##3.128.251':139
'58.##3.49.90':139
'58.##3.93.162':139
'58.##3.102.65':445
'58.##3.8.186':445
'58.#03.38.9':445
'58.#03.9.63':139
'58.##3.172.63':445
'58.##3.180.217':445
'58.##3.151.44':445
'58.##3.217.250':445
'58.##3.104.112':445
'58.##3.56.244':445
'58.#03.7.29':139
'58.##3.203.100':139
'58.##3.17.120':139
'58.##3.67.214':139
'58.##3.245.44':139
'58.##3.22.137':139
'58.##3.203.129':139
'58.#03.5.82':139
'58.##3.231.202':139
'58.##3.159.11':139
'58.##3.141.182':139
'58.##3.248.42':445
'58.##3.36.123':445
'58.##3.159.187':445
'58.##3.208.59':445
'58.##3.130.2':445
'58.##3.94.248':445
'58.##3.117.137':445
'58.##3.235.152':445
'58.##3.222.207':445
'58.##3.178.125':445
'58.##3.25.170':139
'58.##3.81.123':139
'58.##3.168.90':139
'58.##3.4.199':139
'58.##3.142.47':139
'58.##3.49.223':139
'58.##3.88.15':445
'58.##3.129.123':139
'58.##3.113.241':139
'58.##3.128.249':139
'58.##3.179.192':445
'58.##3.163.190':445
'58.##3.28.120':445
'58.##3.1.153':445
'58.##3.52.39':445
'58.##3.182.167':445
'58.##3.114.66':445
'58.##3.104.230':445
'58.##3.74.84':445
'58.##3.206.147':445
'58.##3.192.62':445
'58.##3.76.36':445
'58.##3.34.142':445
'58.##3.139.99':445
'58.##3.241.101':445
'58.##3.46.99':445
'58.##3.141.61':445
'58.##3.113.203':445
'58.##3.62.224':445
'58.##3.89.34':445
'58.##3.23.89':445
'58.##3.236.4':139
'58.##3.46.99':139
'58.##3.139.99':139
'58.##3.241.101':139
'58.##3.117.137':139
'58.##3.179.192':139
'58.##3.23.89':139
'58.##3.62.224':139
'58.##3.89.34':139
'58.##3.76.36':139
'58.##3.34.142':139
'58.##3.159.187':139
'58.##3.130.2':139
'58.##3.88.15':139
'58.##3.36.123':139
'58.##3.248.42':139
'58.##3.235.152':139
'58.##3.94.248':139
'58.##3.178.125':139
'58.##3.208.59':139
'58.##3.222.207':139
'58.##3.141.61':139
'58.##3.241.28':139
'58.##3.70.79':139
'58.##3.61.217':139
'58.##3.104.230':139
'58.##3.222.203':139
'58.##3.97.48':139
'58.##3.174.128':139
'58.##3.173.171':139
'58.##3.68.198':139
'58.##3.170.119':139
'58.##3.1.153':139
'58.##3.28.120':139
'58.##3.182.167':139
'58.##3.113.203':139
'58.##3.52.39':139
'58.##3.192.62':139
'58.##3.114.66':139
'58.##3.74.84':139
'58.##3.163.190':139
'58.##3.206.147':139
'58.##3.169.16':445
'58.##3.228.215':445
'58.##3.117.159':445
'58.##3.2.236':445
'58.##3.49.209':445
'58.##3.23.152':445
'58.#03.7.90':139
'58.##3.191.184':445
'58.##3.19.229':445
'58.##3.127.240':445
'58.##3.23.152':139
'58.##3.240.106':445
'58.##3.191.184':139
'58.##3.19.229':139
'58.##3.127.240':139
'58.##3.122.53':445
'58.##3.219.78':445
'58.##3.20.159':445
'58.##3.158.185':445
'58.##3.248.216':445
'58.##3.189.160':139
'58.##3.95.77':139
'58.##3.41.89':139
'58.##3.110.40':139
'58.##3.80.149':139
'58.##3.40.80':139
'58.##3.161.154':139
'58.##3.182.151':139
'58.##3.17.11':139
'58.##3.139.171':139
'58.##3.27.111':139
'58.##3.31.136':139
'58.##3.117.14':139
'58.##3.71.217':139
'58.##3.192.142':139
'58.##3.135.192':139
'58.##3.24.242':139
'58.##3.148.154':139
'58.##3.157.233':139
'58.##3.38.209':139
'58.##3.131.229':139
'58.##3.228.215':139
'58.##3.25.170':445
'58.##3.81.123':445
'58.##3.168.90':445
'58.##3.4.199':445
'58.##3.142.47':445
'58.##3.129.123':445
'58.##3.208.59':9988
'58.##3.49.223':445
'58.##3.113.241':445
'58.##3.128.249':445
'58.##3.70.79':445
'58.##3.68.198':445
'58.##3.241.28':445
'58.##3.222.203':445
'58.##3.61.217':445
'58.##3.174.128':445
'58.##3.236.4':445
'58.##3.97.48':445
'58.##3.170.119':445
'58.##3.173.171':445
'58.##3.235.152':9988
'58.##3.20.159':139
'58.##3.122.53':139
'58.##3.248.216':139
'58.##3.240.106':139
'58.##3.158.185':139
'58.##3.117.159':139
'58.##3.169.16':139
'58.##3.49.209':139
'58.##3.219.78':139
'58.##3.2.236':139
'58.##3.139.99':9988
'58.##3.141.61':9988
'58.##3.241.101':9988
'58.##3.179.192':9988
'58.##3.46.99':9988
'58.##3.68.198':9988
'58.##3.173.171':9988
'58.##3.114.66':9988
'58.##3.113.203':9988
'58.##3.28.120':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней