Trojan.Starman.5203

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER27aa.dir00\svchost.exe.mdmp 16325836412032144

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER27aa.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'88.##6.19.101':445
'88.##6.37.244':445
'88.##6.114.115':445
'88.##6.204.138':445
'88.##6.96.33':445
'88.##6.22.73':445
'88.##6.48.211':445
'88.##6.78.26':445
'88.##6.97.249':445
'88.#56.0.44':445
'88.##6.146.3':139
'88.##6.22.56':445
'88.##6.70.100':139
'88.##6.137.3':139
'88.##6.221.146':445
'88.##6.174.237':445
'88.##6.178.235':445
'88.##6.226.220':445
'88.##6.213.54':445
'88.##6.211.73':445
'88.##6.39.215':445
'88.##6.18.172':445
'88.##6.185.20':445
'88.##6.176.9':445
'88.##6.251.137':445
'88.##6.169.118':445
'88.##6.133.64':445
'88.##6.27.77':445
'88.##6.65.152':445
'88.##6.20.253':445
'88.##6.65.215':445
'88.#56.66.6':445
'88.##6.60.133':445
'88.##6.47.60':445
'88.##6.140.217':445
'88.##6.77.51':445
'88.##6.146.101':445
'88.##6.235.7':445
'88.##6.139.169':445
'88.##6.140.217':139
'88.##6.235.7':139
'88.##6.65.215':139
'88.#56.66.6':139
'88.##6.139.169':139
'88.##6.20.253':139
'88.##6.185.20':139
'88.##6.77.51':139
'88.##6.146.101':139
'88.##6.47.60':139
'88.##6.96.33':139
'88.##6.78.26':139
'88.##6.19.101':139
'88.##6.37.244':139
'88.##6.97.249':139
'88.##6.211.73':139
'88.##6.60.133':139
'88.##6.22.73':139
'88.##6.48.211':139
'88.##6.176.9':139
'88.##6.18.12':139
'88.##6.15.242':139
'88.##6.218.248':139
'88.##6.80.63':139
'88.##6.203.127':139
'88.##6.239.168':139
'88.##6.66.239':139
'88.##6.34.253':139
'88.##6.168.215':139
'88.##6.41.57':139
'88.##6.251.137':139
'88.##6.27.77':139
'88.##6.39.215':139
'88.##6.18.172':139
'88.##6.65.152':139
'88.##6.184.229':139
'88.##6.140.203':139
'88.##6.169.118':139
'88.##6.133.64':139
'88.##6.220.159':139
'88.##6.39.221':139
'88.##6.38.173':139
'88.##6.18.132':139
'88.##6.118.40':139
'88.##6.109.146':139
'88.##6.168.67':139
'88.##6.10.55':139
'88.##6.81.189':139
'88.##6.71.235':139
'88.##6.147.161':139
'88.##6.77.242':139
'88.##6.86.15':139
'88.##6.131.145':139
'88.##6.136.136':139
'88.##6.58.22':139
'88.##6.219.136':139
'88.##6.57.137':139
'88.##6.86.167':139
'88.##6.160.6':139
'88.##6.10.77':445
'88.##6.118.129':445
'88.##6.118.203':445
'88.##6.31.119':445
'88.##6.206.117':445
'88.##6.137.223':445
'88.##6.131.100':445
'88.##6.112.236':445
'88.##6.204.109':445
'88.##6.144.171':445
'88.##6.98.167':139
'88.##6.11.120':139
'88.##6.234.59':139
'88.##6.116.109':139
'88.##6.196.126':139
'88.##6.50.60':445
'88.##6.243.49':445
'88.##6.158.240':139
'88.##6.100.96':139
'88.##6.70.100':445
'88.##6.137.3':445
'88.##6.239.168':445
'88.##6.66.239':445
'88.##6.146.3':445
'88.##6.144.171':139
'88.##6.118.203':139
'88.##6.50.60':139
'88.##6.243.49':139
'88.##6.168.215':445
'88.##6.41.57':445
'88.##6.218.248':445
'88.##6.184.229':445
'88.##6.140.203':445
'88.##6.80.63':445
'88.##6.203.127':445
'88.##6.34.253':445
'88.##6.18.12':445
'88.##6.15.242':445
'88.##6.31.119':139
'88.##6.83.81':139
'88.##6.21.228':139
'88.#56.17.7':139
'88.##6.230.132':139
'88.##6.24.218':139
'88.##6.119.10':139
'88.##6.76.180':139
'88.##6.110.233':139
'88.##6.230.61':139
'88.##6.102.227':139
'88.##6.206.117':139
'88.##6.112.236':139
'88.##6.10.77':139
'88.##6.118.129':139
'88.##6.204.109':139
'88.##6.30.87':139
'88.##6.120.171':139
'88.##6.137.223':139
'88.##6.131.100':139
'88.##6.93.85':445
'88.##6.61.15':445
'88.##6.12.182':139
'88.##6.58.209':139
'88.##6.57.153':445
'88.##6.179.181':445
'88.##6.246.120':445
'88.#56.6.41':445
'88.##6.250.5':445
'88.##6.28.201':139
'88.##6.112.177':139
'88.##6.253.112':139
'88.##6.53.161':139
'88.##6.194.20':139
'88.##6.46.253':139
'88.##6.176.200':139
'88.##6.17.130':139
'88.##6.79.47':139
'88.##6.6.254':139
'88.##6.137.246':445
'88.##6.249.97':445
'88.##6.140.69':445
'88.##6.22.180':445
'88.##6.17.89':445
'88.##6.240.212':445
'88.##6.219.179':445
'88.##6.73.180':445
'88.##6.37.35':445
'88.##6.179.241':445
'88.##6.132.117':445
'88.##6.133.73':445
'88.##6.7.206':445
'88.##6.100.138':445
'88.##6.187.100':445
'88.##6.103.40':445
'88.##6.27.70':445
'88.##6.108.27':445
'88.##6.0.219':445
'88.##6.236.106':445
'88.##6.103.40':139
'88.##6.0.219':139
'88.##6.133.73':139
'88.##6.7.206':139
'88.##6.236.106':139
'88.##6.132.117':139
'88.##6.22.180':139
'88.##6.27.70':139
'88.##6.108.27':139
'88.##6.187.100':139
'88.##6.57.153':139
'88.#56.6.41':139
'88.##6.93.85':139
'88.##6.61.15':139
'88.##6.250.5':139
'88.##6.137.246':139
'88.##6.100.138':139
'88.##6.179.181':139
'88.##6.246.120':139
'88.##6.17.89':139
'88.##6.18.14':139
'88.#56.4.71':139
'88.##6.108.0':139
'88.##6.20.217':139
'88.##6.220.3':139
'88.##6.191.226':139
'88.##6.178.24':139
'88.##6.193.220':139
'88.##6.33.103':139
'88.##6.169.5':139
'88.##6.240.212':139
'88.##6.37.35':139
'88.##6.249.97':139
'88.##6.140.69':139
'88.##6.179.241':139
'88.##6.64.49':139
'88.#56.6.5':139
'88.##6.219.179':139
'88.##6.73.180':139
'88.##6.250.232':139
'88.##6.111.251':139
'88.##6.13.188':139
'88.##6.6.217':139
'88.##6.132.111':139
'88.##6.117.82':445
'88.##6.97.168':445
'88.##6.29.132':139
'88.##6.158.29':139
'88.##6.44.154':139
'88.##6.219.179':9988
'88.##6.193.220':9988
'88.##6.37.35':9988
'88.##6.179.241':9988
'88.##6.117.82':139
'88.##6.244.174':139
'88.##6.235.162':139
'88.##6.97.168':139
'88.##6.152.181':139
'88.##6.152.181':445
'88.##6.226.220':139
'88.##6.213.54':139
'88.##6.22.56':139
'88.##6.221.146':139
'88.##6.174.237':139
'88.##6.114.115':139
'88.##6.204.138':139
'88.##6.178.235':139
'88.#56.0.44':139
'88.##6.158.29':445
'88.##6.44.154':445
'88.##6.13.188':445
'88.##6.244.174':445
'88.##6.235.162':445
'88.##6.6.217':445
'88.##6.132.111':445
'88.##6.29.132':445
'88.##6.250.232':445
'88.##6.111.251':445
'88.##6.53.161':445
'88.##6.194.20':445
'88.##6.191.226':445
'88.##6.178.24':445
'88.##6.112.177':445
'88.##6.79.47':445
'88.##6.6.254':445
'88.##6.253.112':445
'88.##6.46.253':445
'88.##6.33.103':445
'88.##6.169.5':445
'88.##6.108.0':445
'88.##6.64.49':445
'88.#56.6.5':445
'88.##6.20.217':445
'88.##6.220.3':445
'88.##6.193.220':445
'88.##6.18.14':445
'88.#56.4.71':445
'88.##6.176.200':445
'88.##6.7.206':9988
'88.##6.0.219':9988
'88.##6.100.138':9988
'88.##6.133.73':9988
'88.##6.236.106':9988
'88.##6.17.89':9988
'88.##6.240.212':9988
'88.##6.108.27':9988
'88.##6.22.180':9988
'88.##6.187.100':9988
'88.##6.12.182':445
'88.##6.58.209':445
'88.##6.17.130':445
'88.##6.28.201':445
'88.##6.93.85':9988
'88.#56.6.41':9988
'88.##6.250.5':9988
'88.##6.61.15':9988
'88.##6.57.153':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней