Trojan.Starman.5987

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER35c8.dir00\svchost.exe.mdmp 16325836412032260

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER35c8.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'80.##8.155.76':139
'80.##8.7.155':139
'80.##8.125.93':139
'80.##8.12.237':139
'80.##8.124.7':139
'80.##8.12.237':445
'80.##8.155.76':445
'80.##8.157.97':139
'80.##8.125.93':445
'80.##8.234.74':445
'80.##8.59.55':445
'80.##8.100.111':445
'80.##8.110.44':445
'80.##8.112.98':445
'80.##8.189.62':445
'80.##8.114.55':445
'80.#48.2.22':445
'80.##8.116.186':445
'80.##8.191.76':445
'80.##8.7.155':445
'80.##8.228.181':139
'80.##8.167.42':139
'80.##8.80.149':139
'80.##8.171.79':139
'80.##8.235.188':139
'80.##8.201.185':139
'80.##8.216.253':139
'80.##8.91.108':139
'80.##8.31.112':139
'80.##8.148.207':139
'80.##8.77.49':139
'80.##8.84.138':139
'80.##8.124.7':445
'80.##8.157.97':445
'80.##8.28.116':139
'80.##8.146.165':139
'80.##8.61.10':139
'80.##8.185.84':139
'80.##8.193.214':139
'80.##8.170.64':445
'80.##8.63.205':445
'80.##8.31.208':445
'80.##8.51.178':445
'80.##8.176.208':445
'80.##8.41.210':445
'80.##8.51.157':445
'80.##8.20.163':445
'80.#48.84.8':445
'80.##8.70.188':445
'80.##8.252.48':445
'80.##8.114.55':139
'80.#48.2.22':139
'80.##8.116.186':139
'80.##8.191.76':139
'80.##8.234.74':139
'80.##8.44.40':445
'80.##8.28.180':445
'80.##8.198.124':445
'80.##8.186.163':445
'80.##8.228.254':445
'80.##8.68.217':445
'80.##8.29.128':445
'80.##8.173.235':445
'80.##8.99.214':445
'80.##8.203.68':445
'80.##8.93.110':445
'80.##8.124.236':445
'80.##8.221.202':445
'80.##8.109.222':445
'80.##8.236.38':445
'80.#48.6.60':445
'80.##8.159.75':445
'80.##8.77.196':445
'80.##8.122.37':445
'80.##8.135.138':445
'80.##8.148.109':445
'80.##8.106.191':445
'80.##8.24.135':445
'80.##8.171.32':445
'80.##8.21.136':445
'80.##8.96.139':445
'80.##8.72.63':445
'80.##8.172.98':445
'80.##8.104.178':445
'80.##8.45.139':445
'80.##8.76.234':445
'80.##8.104.134':445
'80.##8.17.162':445
'80.##8.31.97':445
'80.##8.31.112':445
'80.##8.201.185':445
'80.##8.235.188':445
'80.##8.91.108':445
'80.##8.216.253':445
'80.##8.23.121':445
'80.##8.69.177':445
'80.##8.101.211':445
'80.##8.91.102':445
'80.##8.70.80':445
'80.##8.23.235':445
'80.##8.35.13':139
'80.##8.143.252':445
'80.##8.140.16':445
'80.##8.185.94':139
'80.##8.86.144':139
'80.##8.151.236':139
'80.##8.52.185':139
'80.##8.32.83':139
'80.##8.100.240':445
'80.##8.9.253':445
'80.##8.173.9':445
'80.##8.63.223':445
'80.##8.253.63':445
'80.##8.28.40':445
'80.##8.147.83':445
'80.##8.30.38':445
'80.##8.224.83':445
'80.##8.20.92':445
'80.##8.167.42':445
'80.##8.45.139':139
'80.##8.76.234':139
'80.##8.104.134':139
'80.##8.17.162':139
'80.##8.70.80':139
'80.##8.9.253':139
'80.##8.173.9':139
'80.##8.63.223':139
'80.##8.253.63':139
'80.##8.104.178':139
'80.##8.23.121':139
'80.##8.69.177':139
'80.##8.101.211':139
'80.##8.91.102':139
'80.##8.31.97':139
'80.##8.21.136':139
'80.##8.96.139':139
'80.##8.72.63':139
'80.##8.172.98':139
'80.##8.28.40':139
'80.##8.193.214':445
'80.##8.146.165':445
'80.##8.28.116':445
'80.##8.185.84':445
'80.##8.61.10':445
'80.##8.171.79':445
'80.##8.228.181':445
'80.##8.148.207':445
'80.##8.80.149':445
'80.##8.84.138':445
'80.##8.147.83':139
'80.##8.30.38':139
'80.##8.224.83':139
'80.##8.20.92':139
'80.##8.100.240':139
'80.##8.23.235':139
'80.##8.77.49':445
'80.##8.143.252':139
'80.##8.140.16':139
'80.##8.0.216':445
'80.##8.142.190':445
'80.##8.170.27':139
'80.##8.122.240':445
'80.##8.89.67':445
'80.##8.149.241':445
'80.##8.63.118':445
'80.##8.44.45':445
'80.#48.9.3':445
'80.##8.129.109':139
'80.##8.66.26':139
'80.##8.47.41':139
'80.##8.253.41':139
'80.##8.218.216':139
'80.##8.11.55':139
'80.##8.180.253':139
'80.##8.165.60':139
'80.##8.143.28':139
'80.##8.130.116':139
'80.##8.129.63':445
'80.##8.253.87':445
'80.##8.77.240':445
'80.##8.191.100':445
'80.##8.81.183':445
'80.##8.77.44':445
'80.##8.22.105':445
'80.##8.249.19':445
'80.##8.227.149':445
'80.##8.43.211':445
'80.##8.100.192':445
'80.##8.185.242':445
'80.##8.120.182':445
'80.##8.210.129':445
'80.##8.139.210':445
'80.#48.42.3':445
'80.##8.139.187':445
'80.##8.27.231':445
'80.##8.104.24':445
'80.##8.191.185':445
'80.##8.30.116':139
'80.##8.120.182':139
'80.#48.42.3':139
'80.##8.139.210':139
'80.##8.185.242':139
'80.##8.104.24':139
'80.##8.27.231':139
'80.##8.100.192':139
'80.##8.191.185':139
'80.##8.139.187':139
'80.##8.210.129':139
'80.##8.122.240':139
'80.#48.9.3':139
'80.##8.44.45':139
'80.##8.0.216':139
'80.##8.142.190':139
'80.##8.63.118':139
'80.##8.129.63':139
'80.##8.89.67':139
'80.##8.149.241':139
'80.##8.191.100':139
'80.##8.66.71':139
'80.##8.165.25':139
'80.##8.104.101':139
'80.##8.21.154':139
'80.##8.183.47':139
'80.##8.160.143':139
'80.##8.174.46':139
'80.##8.231.182':139
'80.##8.68.87':139
'80.##8.211.103':139
'80.##8.77.240':139
'80.##8.77.44':139
'80.##8.81.183':139
'80.##8.253.87':139
'80.##8.227.149':139
'80.##8.249.19':139
'80.##8.217.161':139
'80.##8.43.211':139
'80.##8.22.105':139
'80.##8.20.163':139
'80.##8.228.254':139
'80.##8.70.188':139
'80.##8.51.157':139
'80.##8.77.196':139
'80.##8.159.75':139
'80.##8.135.138':139
'80.##8.122.37':139
'80.#48.6.60':139
'80.#48.84.8':139
'80.##8.28.180':139
'80.##8.252.48':139
'80.##8.186.163':139
'80.##8.44.40':139
'80.##8.51.178':139
'80.##8.31.208':139
'80.##8.41.210':139
'80.##8.176.208':139
'80.##8.63.205':139
'80.##8.24.135':139
'80.##8.124.236':139
'80.##8.170.64':139
'80.##8.109.222':139
'80.##8.93.110':139
'80.##8.110.44':139
'80.##8.100.111':139
'80.##8.189.62':139
'80.##8.112.98':139
'80.##8.59.55':139
'80.##8.221.202':139
'80.##8.106.191':139
'80.##8.236.38':139
'80.##8.171.32':139
'80.##8.148.109':139
'80.##8.173.235':139
'80.##8.29.128':139
'80.##8.203.68':139
'80.##8.99.214':139
'80.##8.68.217':139
'80.##8.198.124':139
'80.##8.253.41':445
'80.##8.218.216':445
'80.##8.174.46':445
'80.##8.30.116':445
'80.##8.66.26':445
'80.##8.143.28':445
'80.##8.130.116':445
'80.##8.47.41':445
'80.##8.11.55':445
'80.##8.160.143':445
'80.##8.104.101':445
'80.##8.21.154':445
'80.##8.217.161':445
'80.##8.211.103':445
'80.##8.66.71':445
'80.##8.231.182':445
'80.##8.68.87':445
'80.##8.165.25':445
'80.##8.183.47':445
'80.##8.180.253':445
'80.##8.191.100':9988
'80.##8.77.44':9988
'80.##8.27.231':9988
'80.##8.100.192':9988
'80.##8.211.103':9988
'80.##8.160.143':9988
'80.##8.174.46':9988
'80.##8.66.71':9988
'80.##8.68.87':9988
'80.##8.139.187':9988
'80.##8.170.27':445
'80.##8.63.118':9988
'80.##8.165.60':445
'80.##8.129.109':445
'80.##8.149.241':9988
'80.##8.139.210':9988
'80.##8.185.242':9988
'80.##8.129.63':9988
'80.##8.210.129':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней