Trojan.Starman.4999

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER3942.dir00\svchost.exe.mdmp 16325836412032172

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3942.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'80.##9.187.249':139
'80.##9.90.150':445
'80.##9.118.6':139
'80.##9.188.132':139
'80.##9.255.66':445
'80.##9.239.151':445
'80.##9.120.3':445
'80.##9.97.209':445
'80.##9.105.209':445
'80.##9.45.183':139
'80.##9.241.228':139
'80.##9.108.90':139
'80.##9.52.34':139
'80.##9.135.145':139
'80.##9.167.108':139
'80.##9.165.245':139
'80.##9.68.40':139
'80.##9.36.166':139
'80.##9.227.221':139
'80.#19.65.5':445
'80.##9.242.177':445
'80.##9.108.254':445
'80.##9.53.206':445
'80.##9.52.34':445
'80.##9.108.90':445
'80.##9.167.108':445
'80.##9.135.145':445
'80.##9.241.228':445
'80.##9.110.125':445
'80.##9.165.35':445
'80.##9.154.165':445
'80.##9.99.194':445
'80.##9.93.134':445
'80.##9.47.154':445
'80.##9.99.52':445
'80.##9.28.99':445
'80.##9.211.47':445
'80.##9.52.211':445
'80.##9.242.177':139
'80.##9.209.168':445
'80.##9.14.246':445
'80.##9.6.115':445
'80.##9.169.6':445
'80.#19.32.6':445
'80.##9.21.17':445
'80.##9.134.161':445
'80.##9.90.178':445
'80.##9.15.149':445
'80.##9.115.22':445
'80.##9.172.13':445
'80.##9.80.86':445
'80.##9.134.161':139
'80.##9.52.187':445
'80.##9.66.203':445
'80.##9.77.96':445
'80.##9.22.209':445
'80.##9.73.78':445
'80.##9.14.165':445
'80.##9.52.211':139
'80.##9.99.52':139
'80.##9.47.154':139
'80.##9.211.47':139
'80.##9.28.99':139
'80.##9.53.206':139
'80.#19.65.5':139
'80.##9.110.125':139
'80.##9.108.254':139
'80.##9.154.165':139
'80.##9.97.209':139
'80.##9.105.209':139
'80.##9.90.150':139
'80.##9.255.66':139
'80.##9.239.151':139
'80.##9.93.134':139
'80.##9.165.35':139
'80.##9.120.3':139
'80.##9.99.194':139
'80.##9.76.170':139
'80.##9.81.39':139
'80.##9.145.48':139
'80.##9.25.117':139
'80.##9.79.102':139
'80.##9.181.43':139
'80.##9.103.157':139
'80.##9.216.144':139
'80.##9.83.42':139
'80.##9.122.144':139
'80.##9.131.113':445
'80.##9.71.134':445
'80.##9.11.46':445
'80.##9.39.74':445
'80.##9.8.174':445
'80.##9.95.70':139
'80.##9.132.108':139
'80.##9.15.156':139
'80.##9.168.112':139
'80.##9.220.19':139
'80.##9.110.169':139
'80.##9.117.178':139
'80.##9.30.36':139
'80.##9.35.44':139
'80.##9.78.220':139
'80.##9.229.162':139
'80.##9.113.172':139
'80.##9.65.113':139
'80.##9.178.151':139
'80.##9.80.102':139
'80.##9.3.160':139
'80.##9.15.239':139
'80.##9.85.109':139
'80.##9.13.212':139
'80.##9.82.192':139
'80.##9.151.83':139
'80.##9.71.233':139
'80.##9.178.142':139
'80.##9.46.34':445
'80.##9.83.38':139
'80.##9.238.211':139
'80.##9.73.224':139
'80.##9.131.120':139
'80.##9.79.238':139
'80.##9.171.98':139
'80.##9.15.94':139
'80.##9.30.68':139
'80.##9.133.40':139
'80.##9.3.215':139
'80.##9.165.245':445
'80.##9.68.40':445
'80.##9.36.166':445
'80.##9.227.221':445
'80.##9.45.183':445
'80.##9.187.249':445
'80.##9.215.187':139
'80.##9.118.6':445
'80.##9.188.132':445
'80.##9.238.211':445
'80.##9.79.238':445
'80.##9.131.120':445
'80.##9.83.38':445
'80.##9.30.68':445
'80.##9.15.94':445
'80.##9.18.69':445
'80.##9.133.40':445
'80.##9.171.98':445
'80.##9.73.224':445
'80.##9.11.46':139
'80.##9.39.74':139
'80.##9.18.69':139
'80.##9.46.34':139
'80.##9.131.113':139
'80.##9.215.187':445
'80.##9.3.215':445
'80.##9.71.134':139
'80.##9.8.174':139
'80.##9.12.75':445
'80.##9.239.50':445
'80.##9.105.240':139
'80.##9.218.95':139
'80.##9.50.240':445
'80.##9.118.0':445
'80.##9.202.117':445
'80.##9.51.239':445
'80.##9.126.196':445
'80.##9.184.1':139
'80.##9.119.16':139
'80.##9.92.219':139
'80.##9.96.114':139
'80.##9.176.78':139
'80.##9.48.236':139
'80.##9.53.39':139
'80.##9.124.53':139
'80.##9.27.60':139
'80.##9.98.148':139
'80.##9.104.181':445
'80.##9.131.217':445
'80.##9.80.175':445
'80.##9.4.150':445
'80.##9.99.35':445
'80.##9.193.31':445
'80.##9.26.193':445
'80.##9.139.67':445
'80.##9.29.103':445
'80.##9.53.86':445
'80.##9.184.233':445
'80.##9.109.236':445
'80.##9.120.124':445
'80.##9.233.224':445
'80.##9.0.146':445
'80.#19.8.88':445
'80.##9.83.97':445
'80.##9.159.71':445
'80.##9.251.5':445
'80.##9.40.50':139
'80.##9.159.71':139
'80.##9.251.5':139
'80.##9.109.236':139
'80.##9.0.146':139
'80.#19.8.88':139
'80.##9.80.175':139
'80.##9.4.150':139
'80.##9.83.97':139
'80.##9.53.86':139
'80.##9.184.233':139
'80.##9.51.239':139
'80.##9.239.50':139
'80.##9.12.75':139
'80.##9.50.240':139
'80.##9.126.196':139
'80.##9.120.124':139
'80.##9.233.224':139
'80.##9.118.0':139
'80.##9.202.117':139
'80.##9.59.229':139
'80.##9.151.113':139
'80.##9.41.12':139
'80.##9.36.40':139
'80.##9.90.245':139
'80.##9.106.242':139
'80.##9.6.212':139
'80.##9.185.33':139
'80.##9.0.204':139
'80.##9.255.73':139
'80.##9.99.35':139
'80.##9.139.67':139
'80.##9.104.181':139
'80.##9.131.217':139
'80.##9.29.103':139
'80.##9.132.26':139
'80.##9.113.223':139
'80.##9.193.31':139
'80.##9.26.193':139
'80.##9.164.143':445
'80.##9.224.28':445
'80.##9.146.76':139
'80.##9.187.122':139
'80.##9.169.56':445
'80.##9.93.49':445
'80.##9.60.93':445
'80.##9.196.215':445
'80.##9.49.106':445
'80.##9.60.93':139
'80.##9.184.1':9988
'80.##9.164.143':139
'80.##9.98.148':9988
'80.##9.124.53':9988
'80.##9.224.28':139
'80.##9.49.106':139
'80.##9.93.49':139
'80.##9.169.56':139
'80.##9.196.215':139
'80.##9.169.6':139
'80.##9.209.168':139
'80.##9.115.22':139
'80.##9.6.115':139
'80.##9.14.246':139
'80.##9.15.149':139
'80.##9.21.17':139
'80.#19.32.6':139
'80.##9.90.178':139
'80.##9.22.209':139
'80.##9.52.187':139
'80.##9.172.13':139
'80.##9.146.76':445
'80.##9.187.122':445
'80.##9.80.86':139
'80.##9.14.165':139
'80.##9.77.96':139
'80.##9.66.203':139
'80.##9.73.78':139
'80.##9.27.60':9988
'80.##9.40.50':445
'80.##9.96.114':445
'80.##9.106.242':445
'80.##9.6.212':445
'80.##9.176.78':445
'80.##9.48.236':445
'80.##9.27.60':445
'80.##9.119.16':445
'80.##9.92.219':445
'80.##9.0.204':445
'80.##9.255.73':445
'80.##9.41.12':445
'80.##9.132.26':445
'80.##9.113.223':445
'80.##9.36.40':445
'80.##9.90.245':445
'80.##9.185.33':445
'80.##9.59.229':445
'80.##9.151.113':445
'80.##9.131.217':9988
'80.##9.99.35':9988
'80.##9.109.236':9988
'80.##9.104.181':9988
'80.##9.139.67':9988
'80.##9.6.212':9988
'80.##9.92.219':9988
'80.##9.0.204':9988
'80.##9.59.229':9988
'80.##9.233.224':9988
'80.##9.124.53':445
'80.##9.184.1':445
'80.##9.98.148':445
'80.##9.53.39':445
'80.##9.105.240':445
'80.##9.202.117':9988
'80.##9.120.124':9988
'80.##9.218.95':445
'80.##9.12.75':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней