Trojan.Starman.6491

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERf383.dir00\svchost.exe.mdmp 16325836412027964

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERf383.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.##.22.107':139
'64.##.162.14':139
'64.##.97.135':139
'64.##.42.241':139
'64.##.130.19':139
'64.##.43.162':139
'64.##.141.159':139
'64.##.105.171':139
'64.##.234.213':139
'64.#9.6.87':139
'64.##.43.150':139
'64.##.66.124':139
'64.##.197.186':139
'64.##.68.204':139
'64.##.156.45':139
'64.##.214.205':139
'64.##.227.61':139
'64.##.108.46':139
'64.##.139.188':139
'64.##.79.190':139
'64.##.191.162':139
'64.##.214.10':139
'64.##.101.122':139
'64.##.124.168':139
'64.##.74.229':445
'64.##.217.180':445
'64.##.125.54':445
'64.##.212.193':445
'64.##.240.116':445
'64.##.150.175':445
'64.##.198.115':445
'64.##.184.101':445
'64.##.35.242':445
'64.##.255.15':445
'64.##.108.84':445
'64.##.21.201':445
'64.##.237.159':445
'64.##.145.245':445
'64.##.146.13':445
'64.#9.82.50':139
'64.#9.80.24':445
'64.##.75.203':445
'64.#9.13.45':445
'64.#9.18.80':445
'64.##.250.78':445
'64.##.122.178':445
'64.##.134.43':445
'64.#9.8.190':445
'64.##.156.227':445
'64.##.35.106':445
'64.##.111.206':445
'64.#9.35.68':445
'64.##.49.140':445
'64.#9.80.24':139
'64.##.146.13':139
'64.#9.58.63':445
'64.##.209.98':445
'64.##.100.182':445
'64.##.117.216':445
'64.##.120.17':445
'64.##.162.218':445
'64.##.149.239':445
'64.##.208.61':445
'64.#9.60.32':445
'64.##.64.163':445
'64.#9.14.10':445
'64.##.237.63':445
'64.##.136.48':445
'64.##.24.204':445
'64.##.139.97':445
'64.##.75.203':139
'64.##.108.84':139
'64.##.35.242':139
'64.##.255.15':139
'64.##.217.180':139
'64.##.150.175':139
'64.##.198.115':139
'64.##.105.218':139
'64.##.74.103':139
'64.##.134.237':139
'64.##.184.101':139
'64.##.22.247':139
'64.##.74.229':139
'64.##.134.43':139
'64.##.250.78':139
'64.##.122.178':139
'64.##.237.159':139
'64.##.145.245':139
'64.#9.13.45':139
'64.##.240.116':139
'64.##.125.54':139
'64.##.212.193':139
'64.#9.18.80':139
'64.##.21.201':139
'64.#9.4.182':139
'64.#9.53.33':139
'64.##.76.179':139
'64.#9.8.42':139
'64.#9.6.165':139
'64.#9.38.81':139
'64.##.114.206':139
'64.#9.7.200':139
'64.#9.64.17':139
'64.##.152.197':139
'64.##.40.146':139
'64.##.32.212':139
'64.##.158.214':139
'64.#9.72.70':139
'64.##.214.35':139
'64.##.131.132':139
'64.##.111.79':139
'64.##.115.22':139
'64.##.104.81':139
'64.##.166.211':139
'64.#9.56.48':139
'64.##.205.145':139
'64.##.47.205':139
'64.##.149.235':139
'64.##.143.214':445
'64.##.233.142':445
'64.##.212.226':445
'64.##.131.122':445
'64.##.11.249':445
'64.##.199.232':445
'64.##.137.169':445
'64.##.77.159':445
'64.#9.6.242':445
'64.##.175.155':445
'64.##.241.185':445
'64.#9.35.71':445
'64.##.98.106':139
'64.##.144.41':139
'64.##.236.189':139
'64.#9.1.253':139
'64.#9.1.193':139
'64.##.16.126':139
'64.##.20.254':445
'64.##.231.174':445
'64.##.198.192':139
'64.##.252.146':139
'64.##.51.177':139
'64.##.66.124':445
'64.##.42.241':445
'64.##.79.190':445
'64.##.191.162':445
'64.##.139.188':445
'64.##.130.19':445
'64.##.43.162':445
'64.#9.6.87':445
'64.##.162.14':445
'64.##.97.135':445
'64.##.22.107':445
'64.##.101.122':445
'64.##.74.103':445
'64.##.214.205':445
'64.##.105.218':445
'64.##.22.247':445
'64.##.134.237':445
'64.##.227.61':445
'64.##.108.46':445
'64.##.214.10':445
'64.##.68.204':445
'64.##.156.45':445
'64.##.197.186':445
'64.##.43.150':445
'64.##.241.185':139
'64.#9.6.242':139
'64.##.175.155':139
'64.##.233.142':139
'64.##.199.232':139
'64.##.137.169':139
'64.##.199.202':139
'64.#9.15.3':139
'64.##.247.31':139
'64.##.77.159':139
'64.##.106.157':139
'64.##.143.214':139
'64.##.124.168':445
'64.#9.82.50':445
'64.##.105.171':445
'64.##.234.213':445
'64.##.141.159':445
'64.##.20.254':139
'64.##.11.249':139
'64.##.212.226':139
'64.##.131.122':139
'64.##.231.174':139
'64.#9.35.71':139
'64.##.22.195':445
'64.##.241.169':445
'64.##.106.168':445
'64.#9.41.72':445
'64.##.109.139':445
'64.##.239.241':445
'64.##.19.121':445
'64.##.206.111':445
'64.##.103.170':445
'64.##.145.19':445
'64.##.111.228':445
'64.##.228.144':445
'64.#9.2.161':445
'64.##.186.182':139
'64.#9.7.222':445
'64.##.226.220':139
'64.##.181.182':139
'64.#9.82.86':139
'64.#9.73.7':445
'64.##.144.221':445
'64.##.66.200':445
'64.#9.29.82':445
'64.#9.85.73':445
'64.##.148.237':445
'64.##.90.226':445
'64.#9.7.132':445
'64.##.87.110':445
'64.#9.94.35':445
'64.#9.4.75':445
'64.##.48.175':445
'64.##.58.202':445
'64.##.133.254':445
'64.##.148.186':445
'64.##.122.82':445
'64.##.250.205':445
'64.#9.59.93':445
'64.##.35.181':445
'64.##.230.91':445
'64.#9.69.28':445
'64.##.189.42':445
'64.##.225.250':445
'64.##.152.143':445
'64.##.75.240':445
'64.##.183.46':445
'64.##.14.116':445
'64.#9.78.25':445
'64.#9.9.105':445
'64.##.211.170':445
'64.##.228.144':139
'64.##.111.228':139
'64.##.145.19':139
'64.##.106.168':139
'64.##.19.121':139
'64.##.206.111':139
'64.##.152.143':139
'64.##.230.91':139
'64.##.75.240':139
'64.##.103.170':139
'64.#9.9.105':139
'64.##.239.241':139
'64.##.148.237':139
'64.#9.29.82':139
'64.#9.85.73':139
'64.#9.7.222':139
'64.#9.73.7':139
'64.##.144.221':139
'64.#9.41.72':139
'64.##.241.169':139
'64.##.109.139':139
'64.##.66.200':139
'64.#9.2.161':139
'64.##.225.250':139
'64.#9.59.93':139
'64.##.133.254':139
'64.##.250.205':139
'64.#9.7.132':139
'64.##.48.175':139
'64.##.122.82':139
'64.##.165.96':139
'64.##.182.79':139
'64.##.155.149':139
'64.##.148.186':139
'64.##.246.59':139
'64.#9.94.35':139
'64.#9.69.28':139
'64.##.183.46':139
'64.##.189.42':139
'64.##.90.226':139
'64.##.211.170':139
'64.#9.78.25':139
'64.##.58.202':139
'64.##.87.110':139
'64.#9.4.75':139
'64.##.14.116':139
'64.##.35.181':139
'64.##.209.98':139
'64.##.100.182':139
'64.##.49.140':139
'64.#9.8.190':139
'64.##.156.227':139
'64.#9.58.63':139
'64.##.16.208':445
'64.##.65.242':445
'64.##.95.227':445
'64.#9.53.44':445
'64.##.130.90':445
'64.##.35.106':139
'64.##.24.204':139
'64.##.139.97':139
'64.##.64.163':139
'64.##.120.17':139
'64.##.162.218':139
'64.##.136.48':139
'64.##.111.206':139
'64.#9.35.68':139
'64.##.117.216':139
'64.#9.14.10':139
'64.##.237.63':139
'64.##.191.207':445
'64.##.14.100':445
'64.#9.38.66':445
'64.##.225.125':445
'64.##.193.31':445
'64.#9.1.45':445
'64.#9.33.38':445
'64.#9.12.39':445
'64.##.13.165':445
'64.##.38.252':445
'64.##.159.63':445
'64.##.47.251':445
'64.##.161.146':445
'64.#9.128.1':445
'64.#9.213.7':445
'64.##.159.158':445
'64.#9.5.54':445
'64.##.158.28':445
'64.##.60.144':445
'64.##.31.134':445
'64.##.192.48':445
'64.##.65.238':445
'64.##.71.186':445
'64.##.117.116':445
'64.##.130.90':139
'64.##.95.227':139
'64.#9.53.44':139
'64.##.206.111':9988
'64.#9.69.28':9988
'64.##.16.208':139
'64.##.158.28':139
'64.##.159.158':139
'64.#9.5.54':139
'64.##.65.242':139
'64.##.191.207':139
'64.##.19.121':9988
'64.#9.82.86':445
'64.##.181.182':445
'64.##.165.96':445
'64.##.246.59':445
'64.##.155.149':445
'64.##.182.79':445
'64.##.106.168':9988
'64.##.228.144':9988
'64.#9.7.222':9988
'64.##.226.220':445
'64.##.186.182':445
'64.#9.128.1':139
'64.##.47.251':139
'64.##.38.252':139
'64.##.159.63':139
'64.#9.38.66':139
'64.#9.33.38':139
'64.#9.12.39':139
'64.#9.60.32':139
'64.##.149.239':139
'64.##.208.61':139
'64.##.13.165':139
'64.##.22.195':139
'64.##.14.100':139
'64.##.117.116':139
'64.##.65.238':139
'64.##.71.186':139
'64.#9.213.7':139
'64.##.60.144':139
'64.##.31.134':139
'64.#9.1.45':139
'64.##.225.125':139
'64.##.193.31':139
'64.##.192.48':139
'64.##.161.146':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней