Trojan.Starman.5206

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERcc87.dir00\svchost.exe.mdmp 16325836412030780

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERcc87.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'58.##.184.254':139
'58.##.76.133':139
'58.##.53.122':139
'58.##.19.115':139
'58.#5.122.8':139
'58.#5.4.217':139
'58.##.102.56':139
'58.##.111.48':139
'58.##.51.238':139
'58.##.224.171':139
'58.##.203.41':139
'58.##.137.230':139
'58.##.42.169':139
'58.##.88.192':139
'58.##.132.100':139
'58.##.13.152':139
'58.##.119.77':139
'58.##.113.199':139
'58.##.185.242':139
'58.##.246.42':139
'58.##.245.225':139
'58.##.180.57':139
'58.##.185.242':445
'58.##.119.77':445
'58.##.245.225':445
'58.##.42.169':445
'58.##.246.42':445
'58.#5.122.8':445
'58.##.53.122':445
'58.##.19.115':445
'58.##.113.199':445
'58.##.203.41':445
'58.##.137.230':445
'58.##.163.184':139
'58.##.99.216':139
'58.##.65.234':139
'58.##.10.151':139
'58.##.235.10':139
'58.##.13.152':445
'58.##.88.192':445
'58.##.132.100':445
'58.##.114.215':139
'58.##.15.113':445
'58.##.108.128':139
'58.##.81.202':139
'58.##.72.134':139
'58.##.107.214':139
'58.#5.74.0':139
'58.##.113.185':139
'58.##.134.59':445
'58.#5.9.111':139
'58.##.238.81':139
'58.#5.5.74':139
'58.#5.2.74':139
'58.##.158.52':139
'58.#5.8.160':139
'58.##.52.160':139
'58.##.143.234':139
'58.#5.27.37':139
'58.##.124.49':139
'58.##.89.161':139
'58.##.214.215':139
'58.##.37.172':139
'58.##.157.222':139
'58.#5.7.104':445
'58.##.108.128':445
'58.##.81.202':445
'58.##.72.134':445
'58.##.107.214':445
'58.#5.74.0':445
'58.##.113.185':445
'58.##.15.113':139
'58.#5.9.111':445
'58.##.238.81':445
'58.#5.5.74':445
'58.#5.2.74':445
'58.##.158.52':445
'58.#5.8.160':445
'58.##.52.160':445
'58.##.143.234':445
'58.#5.27.37':445
'58.##.124.49':445
'58.##.89.161':445
'58.##.214.215':445
'58.##.37.172':445
'58.##.157.222':445
'58.##.184.254':445
'58.##.132.37':139
'58.##.249.28':139
'58.##.14.244':445
'58.##.217.239':445
'58.##.13.218':445
'58.#5.86.67':139
'58.##.227.178':139
'58.##.222.183':139
'58.##.165.66':139
'58.##.183.135':139
'58.##.239.188':445
'58.##.115.245':445
'58.##.51.135':445
'58.##.55.196':445
'58.#5.41.71':445
'58.#5.65.60':445
'58.##.18.174':445
'58.##.188.239':445
'58.##.87.249':445
'58.#5.107.0':445
'58.##.35.176':445
'58.##.125.217':139
'58.##.71.119':139
'58.##.110.230':139
'58.##.25.119':139
'58.#5.57.19':139
'58.##.11.165':139
'58.#5.15.18':139
'58.##.250.138':139
'58.##.196.74':139
'58.##.26.215':139
'58.##.234.238':139
'58.##.225.64':139
'58.##.169.196':139
'58.##.52.192':139
'58.##.187.229':139
'58.##.54.211':139
'58.##.45.104':139
'58.##.230.20':139
'58.#5.0.231':139
'58.##.121.136':139
'58.##.121.35':139
'58.##.46.121':139
'58.##.21.132':139
'58.##.230.34':139
'58.#5.24.84':139
'58.##.99.216':445
'58.##.114.215':445
'58.##.49.178':139
'58.#5.14.49':139
'58.##.36.212':139
'58.#5.62.93':139
'58.##.219.115':139
'58.##.163.184':445
'58.##.111.48':445
'58.#5.4.217':445
'58.##.224.171':445
'58.##.76.133':445
'58.##.51.238':445
'58.##.235.10':445
'58.##.65.234':445
'58.##.10.151':445
'58.##.102.56':445
'58.##.180.57':445
'58.#5.41.71':139
'58.##.21.132':445
'58.##.230.34':445
'58.#5.24.84':445
'58.##.13.218':139
'58.##.14.244':139
'58.##.49.178':445
'58.#5.14.49':445
'58.##.36.212':445
'58.#5.62.93':445
'58.##.219.115':445
'58.##.217.239':139
'58.##.51.135':139
'58.#5.107.0':139
'58.##.115.245':139
'58.#5.65.60':139
'58.##.55.196':139
'58.##.188.239':139
'58.##.239.188':139
'58.##.18.174':139
'58.##.35.176':139
'58.##.87.249':139
'58.##.119.26':445
'58.##.195.118':445
'58.##.25.223':445
'58.##.175.219':445
'58.##.36.128':445
'58.##.250.107':445
'58.##.86.253':445
'58.#5.67.96':445
'58.##.11.252':445
'58.##.227.63':445
'58.##.159.159':445
'58.##.182.253':139
'58.##.85.183':139
'58.##.253.151':139
'58.#5.66.17':139
'58.##.60.154':139
'58.##.250.41':445
'58.#5.0.250':445
'58.##.201.90':139
'58.##.139.98':139
'58.##.88.162':139
'58.##.156.234':445
'58.#5.2.177':445
'58.##.187.197':445
'58.##.140.51':445
'58.##.203.230':445
'58.##.131.86':445
'58.#5.42.53':445
'58.##.244.57':445
'58.##.192.166':445
'58.##.214.227':445
'58.##.77.162':445
'58.##.93.225':445
'58.##.186.123':445
'58.##.63.186':445
'58.##.151.104':445
'58.##.228.216':445
'58.##.25.108':445
'58.##.137.112':445
'58.#5.3.227':445
'58.#5.3.184':445
'58.##.175.63':445
'58.##.183.175':445
'58.##.228.216':139
'58.##.25.108':139
'58.##.156.234':139
'58.##.250.107':139
'58.##.86.253':139
'58.##.175.63':139
'58.##.183.175':139
'58.##.63.186':139
'58.##.151.104':139
'58.##.186.123':139
'58.#5.67.96':139
'58.##.175.219':139
'58.##.36.128':139
'58.##.159.159':139
'58.##.250.41':139
'58.#5.0.250':139
'58.##.11.252':139
'58.##.227.63':139
'58.##.195.118':139
'58.##.25.223':139
'58.##.119.26':139
'58.#5.3.184':139
'58.#5.94.68':139
'58.##.17.103':139
'58.##.118.75':139
'58.#5.42.53':139
'58.##.244.57':139
'58.##.12.170':139
'58.##.119.229':139
'58.#5.41.94':139
'58.##.152.119':139
'58.##.183.34':139
'58.##.192.166':139
'58.##.203.230':139
'58.##.131.86':139
'58.##.93.225':139
'58.##.137.112':139
'58.#5.3.227':139
'58.##.214.227':139
'58.##.77.162':139
'58.##.187.197':139
'58.##.140.51':139
'58.#5.2.177':139
'58.##.118.75':445
'58.##.53.239':445
'58.##.227.20':445
'58.##.124.84':445
'58.##.72.214':139
'58.##.213.160':445
'58.##.212.188':445
'58.##.145.212':445
'58.##.126.23':445
'58.##.80.151':445
'58.##.179.173':445
'58.##.77.152':139
'58.#5.42.36':139
'58.##.227.146':139
'58.##.238.112':139
'58.#5.73.99':139
'58.##.71.170':139
'58.##.141.76':139
'58.##.199.19':139
'58.#5.15.33':139
'58.##.45.158':139
'58.#5.97.46':139
'58.##.132.155':445
'58.#5.15.33':445
'58.##.141.76':445
'58.#5.97.46':445
'58.##.227.146':445
'58.##.45.158':445
'58.##.134.59':139
'58.#5.7.104':139
'58.##.72.214':445
'58.##.199.19':445
'58.##.77.152':445
'58.#5.42.36':445
'58.##.177.211':445
'58.##.177.48':445
'58.##.153.114':445
'58.##.141.123':445
'58.##.116.253':445
'58.##.71.170':445
'58.##.238.112':445
'58.#5.73.99':445
'58.##.221.40':445
'58.##.249.47':445
'58.##.201.90':445
'58.#5.0.250':9988
'58.##.88.162':445
'58.##.85.183':445
'58.##.139.98':445
'58.##.25.223':9988
'58.##.195.118':9988
'58.##.175.219':9988
'58.##.250.41':9988
'58.##.159.159':9988
'58.##.182.253':445
'58.##.183.34':445
'58.#5.41.94':445
'58.##.152.119':445
'58.#5.94.68':445
'58.##.17.103':445
'58.##.60.154':445
'58.##.253.151':445
'58.#5.66.17':445
'58.##.12.170':445
'58.##.119.229':445
'58.##.250.107':9988
'58.##.141.123':139
'58.##.116.253':139
'58.##.132.155':139
'58.##.212.188':139
'58.##.145.212':139
'58.##.221.40':139
'58.##.249.47':139
'58.##.177.48':139
'58.##.153.114':139
'58.##.177.211':139
'58.##.126.23':139
'58.#5.42.53':9988
'58.##.213.160':139
'58.##.203.230':9988
'58.##.63.186':9988
'58.#5.3.184':9988
'58.##.80.151':139
'58.##.179.173':139
'58.##.227.20':139
'58.##.124.84':139
'58.##.53.239':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней