Trojan.Starman.5154

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER13d4.dir00\svchost.exe.mdmp 16325836412032140

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER13d4.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'12.##.54.200':445
'12.#9.7.54':445
'12.##.253.231':445
'12.#9.93.43':445
'12.##.235.24':445
'12.##.21.252':445
'12.#9.72.21':445
'12.##.33.212':445
'12.#9.4.225':445
'12.##.35.214':139
'12.#9.243.8':139
'12.##.218.107':139
'12.##.228.140':139
'12.##.102.132':139
'12.##.13.135':139
'12.##.104.30':445
'12.##.22.142':139
'12.#9.42.23':139
'12.##.22.142':445
'12.#9.42.23':445
'12.#9.243.8':445
'12.##.102.132':445
'12.##.13.135':445
'12.##.49.111':139
'12.##.131.240':139
'12.##.155.77':139
'12.##.53.144':139
'12.##.191.243':445
'12.##.152.159':445
'12.#9.88.72':445
'12.##.114.88':445
'12.#9.28.87':445
'12.##.228.140':445
'12.##.35.214':445
'12.##.56.193':445
'12.##.218.107':445
'12.##.56.193':139
'12.##.112.178':445
'12.##.166.156':445
'12.##.121.53':445
'12.##.78.239':445
'12.##.58.244':445
'12.##.151.181':445
'12.##.161.141':445
'12.##.192.130':445
'12.#9.6.5':445
'12.#9.53.17':445
'12.#9.3.76':445
'12.##.166.233':445
'12.##.36.149':445
'12.##.170.64':445
'12.##.102.118':445
'12.##.70.242':445
'12.##.69.170':445
'12.##.137.69':445
'12.##.21.252':139
'12.#9.72.21':139
'12.##.33.212':139
'12.#9.4.225':139
'12.#9.88.72':139
'12.##.152.159':139
'12.#9.28.87':139
'12.##.114.88':139
'12.##.191.243':139
'12.##.143.199':445
'12.##.104.30':139
'12.#9.80.98':445
'12.##.73.175':445
'12.##.253.231':139
'12.#9.7.54':139
'12.##.235.24':139
'12.#9.93.43':139
'12.##.54.200':139
'12.#9.5.103':139
'12.##.196.202':445
'12.##.105.186':139
'12.##.252.193':445
'12.##.203.77':445
'12.##.98.202':139
'12.#9.58.68':139
'12.##.119.79':139
'12.##.131.98':139
'12.##.239.131':139
'12.##.116.114':445
'12.##.45.130':445
'12.##.218.34':445
'12.##.114.121':445
'12.##.144.53':445
'12.##.38.156':445
'12.##.90.159':445
'12.##.106.45':445
'12.##.244.191':445
'12.##.21.138':139
'12.##.56.123':139
'12.##.89.126':139
'12.##.202.77':139
'12.##.72.110':139
'12.##.186.19':139
'12.##.43.186':139
'12.##.104.215':139
'12.##.34.160':139
'12.#9.33.71':139
'12.##.107.248':139
'12.#9.171.7':139
'12.##.209.28':139
'12.##.167.216':139
'12.##.122.135':139
'12.#9.9.204':139
'12.#9.7.246':139
'12.##.135.127':139
'12.##.151.107':445
'12.##.114.121':139
'12.##.116.114':139
'12.##.151.107':139
'12.##.218.34':139
'12.##.45.130':139
'12.##.244.191':139
'12.##.38.156':139
'12.##.144.53':139
'12.##.106.45':139
'12.##.248.211':139
'12.##.135.248':139
'12.##.219.184':139
'12.##.83.111':139
'12.##.97.111':139
'12.##.32.188':139
'12.##.61.163':139
'12.##.81.226':139
'12.##.187.81':139
'12.##.248.211':445
'12.##.135.248':445
'12.##.219.184':445
'12.##.83.111':445
'12.##.97.111':445
'12.##.32.188':445
'12.##.61.163':445
'12.##.81.226':445
'12.##.187.81':445
'12.##.203.77':139
'12.##.196.202':139
'12.##.90.159':139
'12.##.252.193':139
'12.##.155.77':445
'12.##.131.240':445
'12.#9.5.103':445
'12.##.53.144':445
'12.##.49.111':445
'12.#9.9.155':139
'12.##.114.18':139
'12.##.197.250':139
'12.##.109.197':139
'12.##.103.235':139
'12.##.104.233':445
'12.##.16.202':445
'12.##.245.11':445
'12.##.74.165':445
'12.##.245.144':139
'12.##.119.200':139
'12.#9.69.87':139
'12.#9.7.20':139
'12.##.56.226':139
'12.##.231.61':139
'12.##.250.230':139
'12.##.36.169':139
'12.##.112.96':139
'12.##.169.81':445
'12.##.155.194':445
'12.#9.46.39':445
'12.##.133.63':445
'12.##.59.232':445
'12.#9.62.59':445
'12.##.126.57':445
'12.##.15.177':445
'12.##.65.146':445
'12.##.106.251':445
'12.##.55.193':445
'12.##.15.109':445
'12.#9.76.75':445
'12.##.79.180':445
'12.##.230.49':445
'12.##.37.232':445
'12.##.183.126':445
'12.#9.14.65':445
'12.##.25.154':139
'12.##.230.49':139
'12.##.37.232':139
'12.##.183.126':139
'12.#9.14.65':139
'12.#9.46.39':139
'12.##.155.194':139
'12.##.59.232':139
'12.##.133.63':139
'12.##.169.81':139
'12.##.16.202':139
'12.##.74.165':139
'12.##.245.11':139
'12.##.104.233':139
'12.##.15.109':139
'12.##.55.193':139
'12.##.79.180':139
'12.#9.76.75':139
'12.##.106.251':139
'12.##.109.69':139
'12.##.244.79':139
'12.#9.19.94':139
'12.##.29.119':139
'12.##.162.174':139
'12.##.125.211':139
'12.##.242.153':139
'12.##.161.162':139
'12.##.142.161':139
'12.#9.62.59':139
'12.##.126.57':139
'12.##.15.177':139
'12.##.65.146':139
'12.##.191.235':139
'12.##.24.235':139
'12.##.106.24':139
'12.##.102.192':139
'12.#9.8.12':139
'12.##.191.235':445
'12.#9.53.17':139
'12.#9.3.76':139
'12.##.166.233':139
'12.##.36.149':139
'12.##.170.64':139
'12.##.102.118':139
'12.##.70.242':139
'12.##.69.170':139
'12.##.137.69':139
'12.##.65.146':9988
'12.##.223.94':139
'12.##.133.63':9988
'12.##.15.177':9988
'12.##.228.120':139
'12.##.90.177':139
'12.##.245.251':139
'12.##.32.228':139
'12.##.108.122':139
'12.##.143.199':139
'12.##.223.94':445
'12.#9.80.98':139
'12.##.73.175':139
'12.##.228.120':445
'12.##.90.177':445
'12.##.245.251':445
'12.##.32.228':445
'12.##.108.122':445
'12.##.112.178':139
'12.##.166.156':139
'12.##.121.53':139
'12.##.78.239':139
'12.##.58.244':139
'12.##.151.181':139
'12.##.161.141':139
'12.##.192.130':139
'12.#9.6.5':139
'12.#9.46.39':9988
'12.##.125.211':445
'12.##.242.153':445
'12.##.161.162':445
'12.##.142.161':445
'12.##.25.154':445
'12.##.245.144':445
'12.##.119.200':445
'12.#9.69.87':445
'12.#9.7.20':445
'12.##.24.235':445
'12.##.106.24':445
'12.##.102.192':445
'12.#9.8.12':445
'12.#9.19.94':445
'12.##.244.79':445
'12.##.162.174':445
'12.##.29.119':445
'12.##.109.69':445
'12.##.15.109':9988
'12.##.74.165':9988
'12.##.103.235':445
'12.##.245.11':9988
'12.##.104.233':9988
'12.#9.14.65':9988
'12.##.37.232':9988
'12.#9.76.75':9988
'12.##.183.126':9988
'12.##.112.96':445
'12.##.231.61':445
'12.##.56.226':445
'12.##.36.169':445
'12.##.250.230':445
'12.#9.9.155':445
'12.##.114.18':445
'12.##.197.250':445
'12.##.109.197':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней