Trojan.Starman.5256

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER2ac4.dir00\svchost.exe.mdmp 16325836412032268

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2ac4.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'72.#6.25.70':139
'72.##.129.25':139
'72.##.75.169':139
'72.##.209.89':139
'72.##.110.218':139
'72.##.194.246':139
'72.##.221.116':139
'72.##.140.112':139
'72.##.166.112':139
'72.##.70.117':139
'72.#6.90.31':139
'72.##.114.137':445
'72.##.159.114':445
'72.##.137.218':445
'72.##.37.152':445
'72.#6.5.129':445
'72.##.104.63':139
'72.##.92.140':139
'72.#6.8.47':139
'72.##.31.208':445
'72.##.44.250':139
'72.##.166.112':445
'72.##.70.117':445
'72.##.129.25':445
'72.##.75.169':445
'72.#6.25.70':445
'72.#6.81.17':445
'72.##.63.143':445
'72.##.221.116':445
'72.##.140.112':445
'72.##.194.246':445
'72.##.110.218':445
'72.##.129.129':139
'72.##.44.250':445
'72.##.129.213':139
'72.#6.81.17':139
'72.##.63.143':139
'72.#6.90.31':445
'72.##.209.89':445
'72.##.92.140':445
'72.#6.8.47':445
'72.##.104.63':445
'72.#6.145.1':445
'72.##.114.137':139
'72.##.159.114':139
'72.##.137.218':139
'72.##.37.152':139
'72.#6.5.129':139
'72.##.13.191':445
'72.##.242.19':445
'72.##.24.180':445
'72.##.31.208':139
'72.##.38.231':445
'72.#6.145.1':139
'72.##.107.58':139
'72.##.244.185':139
'72.##.76.187':139
'72.##.246.220':139
'72.##.224.151':139
'72.##.185.187':139
'72.#6.1.99':139
'72.##.121.81':139
'72.##.251.57':139
'72.##.46.179':139
'72.##.107.58':445
'72.##.244.185':445
'72.##.76.187':445
'72.##.246.220':445
'72.##.224.151':445
'72.##.185.187':445
'72.#6.1.99':445
'72.##.121.81':445
'72.##.251.57':445
'72.##.46.179':445
'72.##.123.71':445
'72.##.212.129':445
'72.##.123.230':445
'72.#6.63.93':445
'72.#6.56.73':445
'72.#6.89.15':445
'72.##.11.130':445
'72.##.122.131':445
'72.##.150.200':445
'72.#6.78.56':445
'72.##.136.110':445
'72.##.48.234':445
'72.##.187.184':445
'72.##.34.115':445
'72.##.128.94':445
'72.##.28.202':445
'72.##.201.58':445
'72.##.39.105':445
'72.##.65.169':445
'72.##.28.187':445
'72.#6.69.60':445
'72.#6.97.16':445
'72.##.36.113':445
'72.##.11.221':445
'72.#6.7.232':445
'72.##.142.132':445
'72.##.232.102':445
'72.#6.92.55':445
'72.#6.55.3':445
'72.##.55.134':445
'72.##.168.133':445
'72.##.133.219':445
'72.##.38.237':139
'72.##.214.147':139
'72.#6.237.7':139
'72.##.168.202':139
'72.#6.7.169':139
'72.##.117.239':139
'72.##.192.117':139
'72.##.132.179':139
'72.#6.50.13':139
'72.#6.17.76':139
'72.##.46.237':139
'72.##.101.212':139
'72.##.167.141':139
'72.#6.32.69':139
'72.#6.8.18':445
'72.##.68.178':445
'72.##.176.145':139
'72.##.199.176':139
'72.#6.4.165':139
'72.##.42.217':139
'72.##.151.254':139
'72.##.251.153':445
'72.##.36.113':139
'72.##.11.221':139
'72.#6.7.232':139
'72.##.142.132':139
'72.##.232.102':139
'72.#6.92.55':139
'72.#6.55.3':139
'72.##.55.134':139
'72.##.168.133':139
'72.##.133.219':139
'72.##.251.153':139
'72.##.55.124':139
'72.#6.91.90':139
'72.##.109.52':139
'72.##.129.213':445
'72.##.129.129':445
'72.##.217.210':139
'72.#6.9.241':139
'72.##.33.201':139
'72.#6.23.92':139
'72.##.61.135':139
'72.##.55.124':445
'72.#6.91.90':445
'72.##.109.52':445
'72.#6.8.18':139
'72.##.68.178':139
'72.##.217.210':445
'72.#6.9.241':445
'72.##.33.201':445
'72.#6.23.92':445
'72.##.61.135':445
'72.##.39.105':139
'72.##.34.115':139
'72.##.48.234':139
'72.##.28.202':139
'72.#6.97.16':139
'72.##.128.94':139
'72.##.65.169':139
'72.##.201.58':139
'72.#6.69.60':139
'72.##.187.184':139
'72.##.28.187':139
'72.##.123.71':139
'72.#6.29.59':445
'72.##.251.29':445
'72.##.157.49':445
'72.#6.91.27':445
'72.##.101.121':445
'72.##.165.206':445
'72.##.228.84':445
'72.##.160.203':445
'72.##.246.231':445
'72.#6.89.57':445
'72.##.185.206':445
'72.##.82.251':139
'72.##.16.158':139
'72.##.163.156':139
'72.#6.58.5':139
'72.##.156.11':139
'72.##.145.115':445
'72.##.15.144':445
'72.##.89.140':139
'72.##.130.22':139
'72.##.213.168':139
'72.##.34.194':445
'72.##.89.234':445
'72.#6.5.37':445
'72.##.24.147':445
'72.#6.37.24':445
'72.##.230.172':445
'72.##.20.230':445
'72.##.210.252':445
'72.##.69.141':445
'72.##.25.104':445
'72.##.147.85':445
'72.#6.9.80':445
'72.##.125.177':445
'72.##.119.80':445
'72.#6.18.88':445
'72.##.227.193':445
'72.##.84.137':445
'72.##.222.152':445
'72.##.14.181':445
'72.#6.10.12':445
'72.##.172.158':445
'72.##.118.26':139
'72.##.227.193':139
'72.##.119.80':139
'72.#6.18.88':139
'72.##.165.206':139
'72.##.228.84':139
'72.##.172.158':139
'72.##.14.181':139
'72.#6.10.12':139
'72.#6.9.80':139
'72.##.125.177':139
'72.##.160.203':139
'72.#6.91.27':139
'72.##.101.121':139
'72.##.185.206':139
'72.##.15.144':139
'72.##.145.115':139
'72.##.246.231':139
'72.#6.89.57':139
'72.##.251.29':139
'72.##.157.49':139
'72.#6.29.59':139
'72.##.255.100':139
'72.##.105.45':139
'72.#6.98.73':139
'72.##.230.172':139
'72.##.20.230':139
'72.##.196.205':139
'72.##.228.204':139
'72.##.155.118':139
'72.##.232.146':139
'72.##.10.221':139
'72.##.210.252':139
'72.##.24.147':139
'72.#6.37.24':139
'72.##.147.85':139
'72.##.84.137':139
'72.##.222.152':139
'72.##.69.141':139
'72.##.25.104':139
'72.##.89.234':139
'72.#6.5.37':139
'72.##.34.194':139
'72.##.238.25':445
'72.##.244.201':445
'72.##.231.16':445
'72.##.130.114':445
'72.##.143.43':445
'72.##.217.57':445
'72.##.112.203':445
'72.##.228.173':445
'72.##.176.132':445
'72.##.80.162':445
'72.##.49.131':445
'72.##.164.171':139
'72.#6.93.65':139
'72.#6.28.68':139
'72.##.217.57':139
'72.##.112.203':139
'72.##.85.145':139
'72.#6.6.103':445
'72.#6.89.32':139
'72.##.242.146':139
'72.##.239.230':139
'72.##.212.129':139
'72.##.123.230':139
'72.#6.63.93':139
'72.#6.56.73':139
'72.#6.89.15':139
'72.##.11.130':139
'72.##.122.131':139
'72.##.150.200':139
'72.#6.78.56':139
'72.##.136.110':139
'72.##.242.19':139
'72.##.242.146':445
'72.##.239.230':445
'72.#6.93.65':445
'72.#6.28.68':445
'72.##.164.171':445
'72.##.24.180':139
'72.##.13.191':139
'72.##.38.231':139
'72.#6.89.32':445
'72.##.85.145':445
'72.##.228.173':139
'72.##.130.22':445
'72.##.213.168':445
'72.##.16.158':445
'72.##.163.156':445
'72.##.82.251':445
'72.##.15.144':9988
'72.#6.91.27':9988
'72.##.145.115':9988
'72.##.89.140':445
'72.##.185.206':9988
'72.##.156.11':445
'72.##.232.146':445
'72.##.10.221':445
'72.##.105.45':445
'72.#6.98.73':445
'72.##.255.100':445
'72.##.118.26':445
'72.#6.58.5':445
'72.##.228.204':445
'72.##.155.118':445
'72.##.196.205':445
'72.##.130.114':139
'72.##.143.43':139
'72.##.49.131':139
'72.#6.37.24':9988
'72.#6.6.103':139
'72.##.176.132':139
'72.##.80.162':139
'72.##.244.201':139
'72.##.231.16':139
'72.##.238.25':139
'72.##.24.147':9988
'72.#6.18.88':9988
'72.##.227.193':9988
'72.#6.89.57':9988
'72.##.101.121':9988
'72.##.157.49':9988
'72.##.222.152':9988
'72.##.147.85':9988
'72.##.125.177':9988
'72.##.119.80':9988
'72.#6.9.80':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней