Trojan.Starman.4958

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd7e6.dir00\svchost.exe.mdmp 16325836412029440

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERd7e6.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.##1.86.204':139
'64.##1.90.59':139
'64.#51.37.8':139
'64.##1.169.183':139
'64.##1.189.113':139
'64.#51.37.8':445
'64.##1.169.183':445
'64.##1.143.194':139
'64.##1.107.123':139
'64.##1.43.235':445
'64.##1.191.192':445
'64.##1.172.182':445
'64.##1.236.232':445
'64.##1.126.74':445
'64.##1.76.86':445
'64.##1.79.232':445
'64.##1.159.233':445
'64.##1.62.194':445
'64.##1.61.96':445
'64.##1.86.204':445
'64.##1.1.189':139
'64.##1.93.59':139
'64.##1.215.231':139
'64.##1.188.182':139
'64.##1.247.186':139
'64.##1.224.74':139
'64.#51.99.5':139
'64.##1.10.162':139
'64.##1.42.228':139
'64.##1.131.233':139
'64.##1.143.194':445
'64.##1.107.123':445
'64.##1.90.59':445
'64.##1.189.113':445
'64.##1.135.100':139
'64.##1.11.240':139
'64.##1.198.197':139
'64.##1.33.181':139
'64.##1.161.56':139
'64.##1.55.79':445
'64.##1.18.131':445
'64.##1.68.42':445
'64.##1.107.114':445
'64.##1.100.168':445
'64.##1.240.160':445
'64.##1.123.93':445
'64.##1.94.46':445
'64.##1.220.240':445
'64.##1.89.55':445
'64.##1.98.12':445
'64.##1.61.96':139
'64.##1.79.232':139
'64.##1.76.86':139
'64.##1.62.194':139
'64.##1.159.233':139
'64.##1.251.17':445
'64.##1.4.254':445
'64.##1.43.235':139
'64.##1.17.107':445
'64.##1.71.173':445
'64.##1.213.160':445
'64.##1.60.77':445
'64.##1.21.159':445
'64.##1.59.82':445
'64.#51.7.65':445
'64.##1.226.164':445
'64.##1.79.226':445
'64.##1.42.60':445
'64.##1.164.239':445
'64.##1.131.128':445
'64.#51.9.3':445
'64.##1.182.175':445
'64.##1.246.206':445
'64.##1.2.246':445
'64.##1.212.11':445
'64.##1.211.159':445
'64.##1.115.38':445
'64.##1.106.145':445
'64.##1.159.198':445
'64.##1.29.199':139
'64.##1.238.237':445
'64.##1.170.99':445
'64.##1.49.61':445
'64.##1.17.234':445
'64.##1.33.198':445
'64.##1.114.28':445
'64.##1.89.251':445
'64.##1.214.238':445
'64.##1.21.125':445
'64.##1.90.177':445
'64.#51.99.5':445
'64.##1.29.199':445
'64.##1.42.228':445
'64.##1.224.74':445
'64.##1.44.140':445
'64.#51.9.85':445
'64.##1.212.9':445
'64.##1.23.234':445
'64.##1.167.53':445
'64.##1.117.135':445
'64.##1.158.185':139
'64.##1.168.195':139
'64.##1.121.252':445
'64.##1.56.27':445
'64.##1.92.63':139
'64.##1.168.98':139
'64.##1.153.43':139
'64.##1.80.115':139
'64.##1.99.148':139
'64.##1.44.241':445
'64.##1.68.170':445
'64.##1.15.69':445
'64.##1.231.230':445
'64.##1.119.29':445
'64.##1.242.238':445
'64.##1.187.56':445
'64.##1.139.221':445
'64.##1.200.105':445
'64.##1.141.70':445
'64.##1.10.162':445
'64.##1.21.125':139
'64.##1.114.28':139
'64.##1.33.198':139
'64.##1.214.238':139
'64.##1.89.251':139
'64.##1.119.29':139
'64.##1.68.170':139
'64.##1.117.135':139
'64.##1.231.230':139
'64.##1.170.99':139
'64.##1.167.53':139
'64.#51.9.85':139
'64.##1.44.140':139
'64.##1.23.234':139
'64.##1.212.9':139
'64.##1.17.234':139
'64.##1.238.237':139
'64.##1.90.177':139
'64.##1.49.61':139
'64.##1.15.69':139
'64.##1.198.197':445
'64.##1.131.233':445
'64.##1.161.56':445
'64.##1.11.240':445
'64.##1.215.231':445
'64.##1.93.59':445
'64.##1.247.186':445
'64.##1.188.182':445
'64.##1.1.189':445
'64.##1.33.181':445
'64.##1.141.70':139
'64.##1.187.56':139
'64.##1.242.238':139
'64.##1.200.105':139
'64.##1.139.221':139
'64.##1.56.27':139
'64.##1.135.100':445
'64.##1.44.241':139
'64.##1.121.252':139
'64.##1.172.182':139
'64.##1.185.162':445
'64.##1.24.21':445
'64.##1.87.99':139
'64.##1.21.41':445
'64.##1.164.98':445
'64.##1.99.20':445
'64.##1.66.221':445
'64.##1.6.252':445
'64.##1.235.7':445
'64.##1.21.37':139
'64.##1.131.134':139
'64.##1.234.218':139
'64.##1.81.55':139
'64.##1.16.97':139
'64.##1.25.112':139
'64.##1.149.109':139
'64.##1.37.149':139
'64.#51.2.29':139
'64.##1.175.236':139
'64.##1.75.138':445
'64.##1.63.146':445
'64.##1.99.228':445
'64.##1.16.210':445
'64.##1.98.158':445
'64.##1.178.222':445
'64.##1.183.65':445
'64.##1.153.183':445
'64.##1.197.0':445
'64.##1.65.177':445
'64.##1.91.47':445
'64.##1.183.237':445
'64.##1.226.183':445
'64.##1.30.181':445
'64.##1.6.165':445
'64.##1.194.226':445
'64.##1.24.38':445
'64.##1.10.40':445
'64.##1.205.194':445
'64.##1.74.135':445
'64.##1.35.14':139
'64.##1.226.183':139
'64.##1.194.226':139
'64.##1.6.165':139
'64.##1.183.237':139
'64.##1.205.194':139
'64.##1.10.40':139
'64.##1.16.210':139
'64.##1.74.135':139
'64.##1.24.38':139
'64.##1.30.181':139
'64.##1.24.21':139
'64.##1.164.98':139
'64.##1.185.162':139
'64.##1.21.41':139
'64.##1.6.252':139
'64.##1.66.221':139
'64.##1.75.138':139
'64.##1.235.7':139
'64.##1.99.20':139
'64.##1.91.47':139
'64.##1.22.137':139
'64.##1.147.11':139
'64.#51.5.79':139
'64.##1.243.211':139
'64.#51.4.79':139
'64.##1.67.102':139
'64.##1.212.67':139
'64.##1.82.76':139
'64.##1.31.49':139
'64.##1.225.193':139
'64.##1.178.222':139
'64.##1.99.228':139
'64.##1.63.146':139
'64.##1.98.158':139
'64.##1.197.0':139
'64.##1.153.183':139
'64.##1.0.154':139
'64.##1.65.177':139
'64.##1.183.65':139
'64.##1.0.154':445
'64.##1.89.55':139
'64.##1.123.93':139
'64.##1.240.160':139
'64.##1.220.240':139
'64.##1.94.46':139
'64.##1.2.246':139
'64.#51.9.3':139
'64.##1.71.173':139
'64.##1.246.206':139
'64.##1.68.42':139
'64.##1.17.107':139
'64.##1.251.17':139
'64.##1.72.124':445
'64.##1.72.150':445
'64.##1.4.254':139
'64.##1.100.168':139
'64.##1.18.131':139
'64.##1.98.12':139
'64.##1.107.114':139
'64.##1.182.175':139
'64.##1.164.239':139
'64.##1.226.164':139
'64.#51.7.65':139
'64.##1.42.60':139
'64.##1.79.226':139
'64.##1.126.74':139
'64.##1.191.192':139
'64.##1.55.79':139
'64.##1.236.232':139
'64.##1.60.77':139
'64.##1.159.198':139
'64.##1.211.159':139
'64.##1.212.11':139
'64.##1.106.145':139
'64.##1.115.38':139
'64.##1.59.82':139
'64.##1.213.160':139
'64.##1.131.128':139
'64.##1.21.159':139
'64.##1.16.144':445
'64.##1.16.97':445
'64.##1.131.134':445
'64.##1.35.14':445
'64.##1.81.55':445
'64.##1.234.218':445
'64.##1.175.236':445
'64.##1.149.109':445
'64.##1.25.112':445
'64.#51.2.29':445
'64.##1.212.67':445
'64.##1.243.211':445
'64.##1.22.137':445
'64.##1.225.193':445
'64.#51.5.79':445
'64.##1.147.11':445
'64.##1.31.49':445
'64.##1.67.102':445
'64.#51.4.79':445
'64.##1.82.76':445
'64.##1.37.149':445
'64.##1.153.183':9988
'64.##1.225.193':9988
'64.##1.65.177':9988
'64.##1.183.65':9988
'64.##1.243.211':9988
'64.##1.72.124':139
'64.##1.72.150':139
'64.##1.67.102':9988
'64.##1.16.144':139
'64.##1.99.228':9988
'64.##1.21.41':9988
'64.##1.185.162':9988
'64.##1.21.37':445
'64.##1.87.99':445
'64.##1.235.7':9988
'64.##1.205.194':9988
'64.##1.24.38':9988
'64.##1.66.221':9988
'64.##1.226.183':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней