Trojan.Starman.5001

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERbb40.dir00\svchost.exe.mdmp 16325836412031984

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERbb40.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'22#.#58.111.188':139
'22#.#58.123.189':139
'22#.#58.100.109':139
'22#.#58.102.233':139
'22#.#58.72.178':139
'22#.#58.2.51':139
'22#.#58.167.221':139
'22#.#58.245.89':139
'22#.#58.26.124':139
'22#.#58.7.40':139
'22#.#58.210.168':139
'22#.#58.39.218':139
'22#.#58.142.45':139
'22#.#58.27.193':139
'22#.#58.138.100':139
'22#.#58.64.112':139
'22#.#58.86.224':139
'22#.#58.202.3':139
'22#.#58.94.23':139
'22#.#58.165.197':139
'22#.#58.227.7':139
'22#.#58.117.90':139
'22#.#58.202.3':445
'22#.#58.210.168':445
'22#.#58.86.224':445
'22#.#58.227.7':445
'22#.#58.94.23':445
'22#.#58.111.188':445
'22#.#58.123.189':445
'22#.#58.100.109':445
'22#.#58.102.233':445
'22#.#58.72.178':445
'22#.#58.165.197':445
'22#.#58.222.162':139
'22#.#58.208.222':139
'22#.#58.63.163':139
'22#.#58.162.116':139
'22#.#58.117.162':139
'22#.#58.39.218':445
'22#.#58.142.45':445
'22#.#58.27.193':445
'22#.#58.138.100':445
'22#.#58.64.112':445
'22#.#58.153.240':139
'22#.#58.157.246':139
'22#.#58.21.111':139
'22#.#58.228.12':139
'22#.#58.116.50':139
'22#.#58.20.163':445
'22#.#58.44.183':445
'22#.#58.63.27':139
'22#.#58.52.21':139
'22#.#58.194.28':139
'22#.#58.80.186':139
'22#.#58.31.110':139
'22#.#58.44.120':139
'22#.#58.208.39':139
'22#.#58.86.183':139
'22#.#58.46.54':139
'22#.#58.226.254':139
'22#.#58.16.118':139
'22#.#58.238.250':139
'22#.#58.77.7':139
'22#.#58.5.73':139
'22#.#58.164.230':445
'22#.#58.116.50':445
'22#.#58.21.111':445
'22#.#58.228.12':445
'22#.#58.16.118':445
'22#.#58.80.186':445
'22#.#58.194.28':445
'22#.#58.63.27':445
'22#.#58.52.21':445
'22#.#58.153.240':445
'22#.#58.157.246':445
'22#.#58.226.254':445
'22#.#58.46.54':445
'22#.#58.208.39':445
'22#.#58.86.183':445
'22#.#58.10.180':445
'22#.#58.133.249':445
'22#.#58.5.73':445
'22#.#58.238.250':445
'22#.#58.77.7':445
'22#.#58.31.110':445
'22#.#58.44.120':445
'22#.#58.19.46':445
'22#.#58.206.203':445
'22#.#58.46.171':445
'22#.#58.255.171':445
'22#.#58.98.137':445
'22#.#58.3.139':139
'22#.#58.28.200':139
'22#.#58.91.56':139
'22#.#58.70.133':139
'22#.#58.130.101':139
'22#.#58.206.248':445
'22#.#58.238.1':445
'22#.#58.49.160':445
'22#.#58.1.209':445
'22#.#58.121.181':445
'22#.#58.123.86':445
'22#.#58.28.146':445
'22#.#58.248.38':445
'22#.#58.115.113':445
'22#.#58.41.130':445
'22#.#58.37.140':445
'22#.#58.46.27':139
'22#.#58.39.21':139
'22#.#58.71.254':139
'22#.#58.115.208':139
'22#.#58.23.19':139
'22#.#58.145.70':139
'22#.#58.2.82':139
'22#.#58.135.2':139
'22#.#58.120.48':139
'22#.#58.196.227':139
'22#.#58.131.197':139
'22#.#58.221.247':139
'22#.#58.70.87':139
'22#.#58.141.195':139
'22#.#58.213.107':139
'22#.#58.172.25':139
'22#.#58.14.254':139
'22#.#58.183.64':139
'22#.#58.117.103':139
'22#.#58.85.245':139
'22#.#58.144.122':139
'22#.#58.87.31':139
'22#.#58.172.214':139
'22#.#58.137.2':139
'22#.#58.180.24':139
'22#.#58.111.209':139
'22#.#58.13.112':139
'22#.#58.121.181':139
'22#.#58.123.86':139
'22#.#58.211.112':139
'22#.#58.187.22':139
'22#.#58.49.120':139
'22#.#58.208.222':445
'22#.#58.2.51':445
'22#.#58.167.221':445
'22#.#58.245.89':445
'22#.#58.26.124':445
'22#.#58.7.40':445
'22#.#58.63.163':445
'22#.#58.222.162':445
'22#.#58.117.162':445
'22#.#58.117.90':445
'22#.#58.162.116':445
'22#.#58.1.209':139
'22#.#58.13.112':445
'22#.#58.180.24':445
'22#.#58.111.209':445
'22#.#58.19.46':139
'22#.#58.206.203':139
'22#.#58.49.120':445
'22#.#58.211.112':445
'22#.#58.187.22':445
'22#.#58.172.214':445
'22#.#58.137.2':445
'22#.#58.46.171':139
'22#.#58.37.140':139
'22#.#58.115.113':139
'22#.#58.41.130':139
'22#.#58.238.1':139
'22#.#58.49.160':139
'22#.#58.255.171':139
'22#.#58.98.137':139
'22#.#58.206.248':139
'22#.#58.28.146':139
'22#.#58.248.38':139
'22#.#58.133.249':139
'22#.#58.68.246':445
'22#.#58.18.193':445
'22#.#58.13.34':445
'22#.#58.234.116':445
'22#.#58.25.176':445
'22#.#58.44.5':445
'22#.#58.217.231':445
'22#.#58.40.213':445
'22#.#58.160.60':445
'22#.#58.71.160':445
'22#.#58.195.36':445
'22#.#58.66.224':139
'22#.#58.166.100':139
'22#.#58.53.121':139
'22#.#58.76.252':139
'22#.#58.121.76':139
'22#.#58.51.30':445
'22#.#58.49.165':445
'22#.#58.97.46':139
'22#.#58.158.166':139
'22#.#58.200.106':139
'22#.#58.37.215':445
'22#.#58.192.207':445
'22#.#58.24.72':445
'22#.#58.229.245':445
'22#.#58.141.90':445
'22#.#58.19.80':445
'22#.#58.15.89':445
'22#.#58.213.68':445
'22#.#58.31.244':445
'22#.#58.41.220':445
'22#.#58.123.144':445
'22#.#58.83.15':445
'22#.#58.30.196':445
'22#.#58.41.8':445
'22#.#58.24.45':445
'22#.#58.65.212':445
'22#.#58.167.179':445
'22#.#58.199.31':445
'22#.#58.15.182':445
'22#.#58.249.77':445
'22#.#58.82.238':445
'22#.#58.116.53':445
'22#.#58.65.212':139
'22#.#58.167.179':139
'22#.#58.37.215':139
'22#.#58.44.5':139
'22#.#58.217.231':139
'22#.#58.82.238':139
'22#.#58.116.53':139
'22#.#58.41.8':139
'22#.#58.24.45':139
'22#.#58.30.196':139
'22#.#58.40.213':139
'22#.#58.234.116':139
'22#.#58.25.176':139
'22#.#58.195.36':139
'22#.#58.49.165':139
'22#.#58.51.30':139
'22#.#58.160.60':139
'22#.#58.71.160':139
'22#.#58.18.193':139
'22#.#58.13.34':139
'22#.#58.68.246':139
'22#.#58.249.77':139
'22#.#58.174.134':139
'22#.#58.17.199':139
'22#.#58.193.212':139
'22#.#58.15.89':139
'22#.#58.213.68':139
'22#.#58.221.209':139
'22#.#58.32.11':139
'22#.#58.197.251':139
'22#.#58.240.224':139
'22#.#58.196.240':139
'22#.#58.31.244':139
'22#.#58.141.90':139
'22#.#58.19.80':139
'22#.#58.83.15':139
'22#.#58.199.31':139
'22#.#58.15.182':139
'22#.#58.41.220':139
'22#.#58.123.144':139
'22#.#58.24.72':139
'22#.#58.229.245':139
'22#.#58.192.207':139
'22#.#58.36.214':445
'22#.#58.103.124':445
'22#.#58.9.238':445
'22#.#58.44.237':139
'22#.#58.238.97':445
'22#.#58.21.237':445
'22#.#58.23.236':445
'22#.#58.41.43':445
'22#.#58.126.237':445
'22#.#58.47.4':445
'22#.#58.166.53':139
'22#.#58.120.192':139
'22#.#58.141.157':139
'22#.#58.90.110':139
'22#.#58.230.87':139
'22#.#58.223.141':139
'22#.#58.236.167':139
'22#.#58.224.235':139
'22#.#58.174.101':139
'22#.#58.20.144':139
'22#.#58.91.81':139
'22#.#58.98.92':445
'22#.#58.224.235':445
'22#.#58.166.53':445
'22#.#58.236.167':445
'22#.#58.91.81':445
'22#.#58.174.101':445
'22#.#58.164.230':139
'22#.#58.10.180':139
'22#.#58.44.183':139
'22#.#58.44.237':445
'22#.#58.20.163':139
'22#.#58.20.144':445
'22#.#58.57.234':445
'22#.#58.35.244':445
'22#.#58.206.110':445
'22#.#58.125.220':445
'22#.#58.13.5':445
'22#.#58.120.192':445
'22#.#58.141.157':445
'22#.#58.90.110':445
'22#.#58.230.87':445
'22#.#58.223.141':445
'22#.#58.200.106':445
'22#.#58.97.46':445
'22#.#58.158.166':445
'22#.#58.66.224':445
'22#.#58.166.100':445
'22#.#58.68.246':9988
'22#.#58.44.5':9988
'22#.#58.13.34':9988
'22#.#58.234.116':9988
'22#.#58.25.176':9988
'22#.#58.53.121':445
'22#.#58.240.224':445
'22#.#58.196.240':445
'22#.#58.17.199':445
'22#.#58.193.212':445
'22#.#58.174.134':445
'22#.#58.76.252':445
'22#.#58.121.76':445
'22#.#58.32.11':445
'22#.#58.197.251':445
'22#.#58.221.209':445
'22#.#58.217.231':9988
'22#.#58.23.236':139
'22#.#58.98.92':139
'22#.#58.21.237':139
'22#.#58.47.4':139
'22#.#58.41.43':139
'22#.#58.57.234':139
'22#.#58.35.244':139
'22#.#58.206.110':139
'22#.#58.125.220':139
'22#.#58.13.5':139
'22#.#58.126.237':139
'22#.#58.116.53':9988
'22#.#58.249.77':9988
'22#.#58.41.8':9988
'22#.#58.37.215':9988
'22#.#58.30.196':9988
'22#.#58.36.214':139
'22#.#58.103.124':139
'22#.#58.9.238':139
'22#.#58.123.144':9988
'22#.#58.238.97':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней