Trojan.Starman.5096

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'64.##.37.124':445
'64.##.50.217':445
'64.##.23.107':445
'64.##.85.202':445
'64.#6.168.2':445
'64.#6.0.163':445
'64.##.136.205':445
'64.##.79.236':445
'64.##.49.243':445
'64.##.247.160':445
'64.#6.97.5':445
'64.##.121.89':445
'64.##.95.154':445
'64.#6.41.21':445
'64.#6.38.44':445
'64.##.131.33':445
'64.##.51.135':445
'64.##.92.162':445
'64.##.22.225':445
'64.##.210.136':445
'64.##.88.220':445
'64.##.147.121':445
'64.##.150.158':445
'64.##.204.24':445
'64.#6.5.56':445
'64.##.56.132':445
'64.#6.0.111':445
'64.##.245.71':445
'64.##.85.232':445
'64.##.230.213':445
'64.##.101.207':445
'64.##.212.101':445
'64.##.86.208':445
'64.##.206.231':445
'64.#6.4.35':445
'64.##.192.63':445
'64.##.102.83':445
'64.##.139.191':445
'64.##.193.210':445
'64.##.40.103':445
'64.##.101.207':139
'64.##.212.101':139
'64.##.86.208':139
'64.##.206.231':139
'64.#6.4.35':139
'64.##.192.63':139
'64.##.102.83':139
'64.##.139.191':139
'64.##.193.210':139
'64.##.210.136':139
'64.##.37.124':139
'64.##.50.217':139
'64.##.23.107':139
'64.##.85.202':139
'64.#6.168.2':139
'64.#6.0.163':139
'64.##.136.205':139
'64.##.79.236':139
'64.##.49.243':139
'64.##.230.213':139
'64.#6.9.204':139
'64.##.215.171':139
'64.#6.20.66':139
'64.#6.69.99':139
'64.##.60.253':139
'64.#6.38.76':445
'64.#6.1.60':445
'64.#6.24.89':445
'64.##.208.31':445
'64.##.125.54':139
'64.##.88.220':139
'64.##.147.121':139
'64.##.150.158':139
'64.##.204.24':139
'64.#6.5.56':139
'64.##.56.132':139
'64.#6.0.111':139
'64.##.245.71':139
'64.##.85.232':139
'64.##.74.201':139
'64.##.26.130':139
'64.##.158.221':139
'64.##.157.127':139
'64.##.73.155':139
'64.#6.5.99':139
'64.#6.186.0':445
'64.##.233.71':139
'64.##.180.235':139
'64.##.191.251':139
'64.##.111.64':139
'64.##.205.193':139
'64.##.162.67':139
'64.##.214.105':139
'64.##.132.59':139
'64.##.124.104':139
'64.##.75.124':139
'64.##.93.134':139
'64.##.104.172':139
'64.##.134.110':445
'64.##.123.127':445
'64.##.69.202':445
'64.#6.78.82':445
'64.##.71.118':445
'64.##.166.69':445
'64.##.170.72':445
'64.#6.235.2':445
'64.##.42.167':445
'64.##.38.174':445
'64.##.82.194':445
'64.##.142.158':445
'64.##.240.199':445
'64.#6.11.29':445
'64.##.87.153':445
'64.##.214.200':445
'64.##.199.243':445
'64.##.132.244':445
'64.##.170.216':445
'64.##.253.103':445
'64.##.161.129':139
'64.##.142.158':139
'64.##.240.199':139
'64.#6.11.29':139
'64.##.87.153':139
'64.##.214.200':139
'64.##.199.243':139
'64.##.132.244':139
'64.##.170.216':139
'64.##.253.103':139
'64.##.134.110':139
'64.#6.69.99':445
'64.#6.9.204':445
'64.##.125.54':445
'64.#6.20.66':445
'64.##.215.171':445
'64.##.17.139':445
'64.#6.186.0':139
'64.##.60.253':445
'64.##.17.139':139
'64.##.82.194':139
'64.##.248.79':139
'64.##.12.249':139
'64.##.29.208':139
'64.##.146.201':139
'64.#6.59.84':139
'64.##.237.41':139
'64.##.18.199':139
'64.##.94.112':139
'64.##.21.167':139
'64.##.25.215':139
'64.##.123.127':139
'64.##.69.202':139
'64.#6.78.82':139
'64.##.71.118':139
'64.##.166.69':139
'64.##.170.72':139
'64.#6.235.2':139
'64.##.42.167':139
'64.##.38.174':139
'64.#6.48.86':445
'64.##.128.199':445
'64.##.197.169':139
'64.#6.94.89':445
'64.##.18.197':445
'64.##.103.228':445
'64.##.163.251':445
'64.#6.45.45':445
'64.##.117.192':445
'64.##.205.196':139
'64.#6.5.209':139
'64.##.158.136':139
'64.##.238.105':139
'64.##.72.103':139
'64.##.149.62':139
'64.##.243.197':139
'64.##.117.147':139
'64.##.151.171':139
'64.##.11.154':139
'64.##.80.105':445
'64.#6.12.81':445
'64.#6.94.86':445
'64.##.130.29':445
'64.##.110.145':445
'64.##.73.145':445
'64.##.214.168':445
'64.##.105.84':445
'64.##.235.22':445
'64.##.136.234':445
'64.##.122.98':445
'64.##.141.171':445
'64.#6.7.107':445
'64.#6.3.209':445
'64.##.171.172':445
'64.#6.68.10':445
'64.##.255.239':445
'64.##.141.85':445
'64.##.137.67':445
'64.#6.56.66':445
'64.##.106.178':139
'64.#6.7.107':139
'64.#6.68.10':139
'64.##.171.172':139
'64.##.141.171':139
'64.##.137.67':139
'64.##.141.85':139
'64.##.122.98':139
'64.#6.56.66':139
'64.##.255.239':139
'64.#6.3.209':139
'64.##.128.199':139
'64.##.18.197':139
'64.#6.48.86':139
'64.#6.94.89':139
'64.#6.45.45':139
'64.##.163.251':139
'64.##.80.105':139
'64.##.117.192':139
'64.##.103.228':139
'64.##.130.29':139
'64.##.116.211':139
'64.##.52.186':139
'64.##.109.224':139
'64.##.165.195':139
'64.#6.88.53':139
'64.##.226.116':139
'64.##.250.199':139
'64.##.130.226':139
'64.##.117.254':139
'64.##.248.220':139
'64.#6.94.86':139
'64.##.73.145':139
'64.##.110.145':139
'64.#6.12.81':139
'64.##.235.22':139
'64.##.105.84':139
'64.##.31.201':139
'64.##.136.234':139
'64.##.214.168':139
'64.##.218.212':139
'64.##.52.205':139
'64.##.58.101':139
'64.##.212.224':139
'64.##.230.59':445
'64.##.180.28':445
'64.##.58.101':445
'64.#6.77.72':445
'64.##.26.167':445
'64.##.180.28':139
'64.##.122.98':9988
'64.#6.88.53':9988
'64.##.214.168':9988
'64.#6.68.10':9988
'64.##.44.208':139
'64.#6.77.72':139
'64.##.26.167':139
'64.##.44.208':445
'64.##.230.59':139
'64.##.212.224':445
'64.##.121.89':139
'64.#6.38.44':139
'64.#6.41.21':139
'64.#6.97.5':139
'64.##.92.162':139
'64.##.51.135':139
'64.##.247.160':139
'64.##.22.225':139
'64.##.131.33':139
'64.##.95.154':139
'64.##.66.195':139
'64.##.66.195':445
'64.##.218.212':445
'64.##.52.205':445
'64.#6.24.89':139
'64.#6.1.60':139
'64.##.40.103':139
'64.##.208.31':139
'64.#6.38.76':139
'64.##.73.145':9988
'64.##.238.105':445
'64.##.72.103':445
'64.##.250.199':445
'64.##.106.178':445
'64.#6.5.209':445
'64.##.151.171':445
'64.##.11.154':445
'64.##.158.136':445
'64.##.149.62':445
'64.##.226.116':445
'64.##.109.224':445
'64.##.165.195':445
'64.##.31.201':445
'64.##.248.220':445
'64.##.116.211':445
'64.##.130.226':445
'64.##.117.254':445
'64.##.52.186':445
'64.#6.88.53':445
'64.##.243.197':445
'64.##.80.105':9988
'64.##.165.195':9988
'64.##.255.239':9988
'64.##.171.172':9988
'64.##.235.22':9988
'64.##.130.226':9988
'64.##.105.84':9988
'64.##.137.67':9988
'64.##.248.220':9988
'64.#6.3.209':9988
'64.##.197.169':445
'64.#6.48.86':9988
'64.##.117.147':445
'64.##.205.196':445
'64.#6.94.89':9988
'64.#6.45.45':9988
'64.#6.56.66':9988
'64.##.128.199':9988
'64.##.18.197':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней