Trojan.Starman.5481

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERba25.dir00\svchost.exe.mdmp 16325836412032148

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERba25.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'12.##6.130.239':445
'12.##6.215.73':445
'12.##6.70.114':445
'12.##6.159.186':445
'12.##6.185.91':445
'12.##6.252.82':445
'12.##6.96.84':445
'12.##6.249.141':445
'12.##6.10.159':445
'12.#26.5.18':445
'12.##6.248.4':445
'12.#26.64.2':445
'12.##6.186.56':445
'12.##6.175.244':445
'12.##6.163.0':445
'12.##6.109.193':445
'12.#26.18.8':139
'12.##6.116.189':445
'12.##6.72.71':445
'12.##6.28.32':445
'12.##6.18.223':445
'12.##6.168.127':445
'12.#26.10.9':445
'12.##6.77.109':445
'12.#26.6.50':445
'12.##6.144.8':445
'12.##6.32.173':139
'12.##6.50.152':139
'12.##6.208.50':139
'12.##6.78.157':445
'12.##6.139.15':445
'12.#26.18.8':445
'12.##6.205.77':139
'12.##6.128.205':139
'12.##6.188.73':139
'12.##6.117.208':139
'12.##6.3.117':139
'12.##6.82.123':139
'12.##6.109.136':445
'12.##6.136.246':445
'12.##6.172.24':445
'12.##6.49.27':445
'12.##6.25.16':445
'12.##6.14.128':445
'12.##6.116.239':445
'12.##6.76.16':445
'12.##6.101.62':445
'12.##6.59.10':445
'12.##6.210.84':445
'12.##6.9.231':445
'12.#26.82.9':445
'12.#26.10.9':139
'12.##6.77.109':139
'12.#26.6.50':139
'12.##6.175.244':139
'12.##6.163.0':139
'12.##6.109.193':139
'12.##6.186.56':139
'12.##6.159.186':139
'12.##6.185.91':139
'12.##6.28.32':139
'12.##6.18.223':139
'12.##6.168.127':139
'12.##6.72.71':139
'12.##6.54.154':445
'12.##6.23.60':445
'12.##6.4.113':445
'12.##6.174.230':139
'12.##6.201.180':445
'12.##6.119.201':445
'12.##6.58.88':445
'12.##6.174.230':445
'12.##6.116.189':139
'12.##6.247.4':445
'12.##6.225.246':445
'12.##6.189.225':445
'12.##6.252.82':139
'12.##6.210.84':139
'12.##6.9.231':139
'12.#26.82.9':139
'12.##6.136.246':139
'12.##6.172.24':139
'12.##6.49.27':139
'12.##6.109.136':139
'12.##6.78.157':139
'12.##6.139.15':139
'12.##6.76.16':139
'12.##6.101.62':139
'12.##6.59.10':139
'12.##6.116.239':139
'12.#26.5.18':139
'12.##6.248.4':139
'12.#26.64.2':139
'12.##6.130.239':139
'12.##6.215.73':139
'12.##6.70.114':139
'12.##6.144.8':139
'12.##6.25.16':139
'12.##6.14.128':139
'12.##6.96.84':139
'12.##6.249.141':139
'12.##6.10.159':139
'12.#26.7.6':139
'12.##6.124.90':445
'12.##6.202.69':445
'12.##6.224.164':445
'12.##6.38.133':445
'12.##6.134.225':445
'12.##6.90.232':445
'12.##6.195.164':445
'12.##6.230.114':445
'12.##6.177.235':445
'12.##6.213.213':445
'12.##6.100.19':445
'12.##6.26.14':445
'12.##6.128.177':445
'12.##6.238.11':445
'12.##6.29.41':445
'12.##6.13.92':445
'12.##6.40.70':445
'12.##6.12.21':445
'12.##6.25.187':445
'12.##6.191.215':445
'12.##6.80.182':445
'12.##6.145.159':445
'12.##6.159.166':445
'12.##6.251.148':445
'12.##6.214.251':445
'12.##6.242.229':445
'12.##6.187.24':139
'12.##6.191.186':139
'12.##6.53.33':139
'12.##6.41.71':445
'12.##6.70.131':445
'12.##6.187.107':139
'12.##6.3.205':139
'12.##6.168.19':139
'12.##6.243.249':139
'12.##6.115.1':139
'12.##6.193.114':139
'12.##6.170.193':139
'12.##6.0.197':445
'12.##6.78.75':445
'12.##6.23.141':445
'12.##6.65.55':445
'12.##6.18.141':445
'12.##6.10.243':445
'12.##6.70.239':445
'12.##6.20.232':445
'12.##6.80.29':445
'12.##6.23.80':445
'12.##6.79.154':445
'12.##6.105.79':445
'12.##6.32.105':445
'12.##6.159.166':139
'12.##6.251.148':139
'12.##6.214.251':139
'12.##6.238.11':139
'12.##6.29.41':139
'12.##6.13.92':139
'12.##6.128.177':139
'12.##6.38.133':139
'12.##6.134.225':139
'12.##6.191.215':139
'12.##6.80.182':139
'12.##6.145.159':139
'12.##6.25.187':139
'12.##6.117.208':445
'12.##6.3.117':445
'12.##6.82.123':445
'12.##6.32.173':445
'12.##6.50.152':445
'12.##6.208.50':445
'12.#26.7.6':445
'12.##6.40.70':139
'12.##6.12.21':139
'12.##6.205.77':445
'12.##6.128.205':445
'12.##6.188.73':445
'12.##6.90.232':139
'12.##6.79.154':139
'12.##6.105.79':139
'12.##6.32.105':139
'12.##6.78.75':139
'12.##6.23.141':139
'12.##6.65.55':139
'12.##6.0.197':139
'12.##6.41.71':139
'12.##6.70.131':139
'12.##6.20.232':139
'12.##6.80.29':139
'12.##6.23.80':139
'12.##6.70.239':139
'12.##6.213.213':139
'12.##6.100.19':139
'12.##6.26.14':139
'12.##6.124.90':139
'12.##6.202.69':139
'12.##6.224.164':139
'12.##6.242.229':139
'12.##6.18.141':139
'12.##6.10.243':139
'12.##6.195.164':139
'12.##6.230.114':139
'12.##6.177.235':139
'12.##6.120.228':445
'12.##6.15.115':445
'12.##6.240.137':445
'12.##6.51.71':445
'12.##6.140.232':445
'12.##6.78.137':445
'12.#26.19.5':445
'12.##6.138.63':445
'12.##6.44.132':445
'12.##6.118.142':445
'12.##6.107.122':445
'12.##6.70.220':445
'12.##6.92.161':445
'12.##6.121.248':445
'12.##6.71.115':445
'12.##6.248.154':445
'12.##6.21.144':445
'12.##6.155.148':445
'12.##6.148.9':445
'12.##6.4.108':445
'12.#26.1.12':445
'12.##6.38.18':445
'12.##6.110.54':445
'12.##6.0.122':445
'12.##6.35.141':445
'12.##6.137.139':445
'12.##6.77.237':445
'12.##6.190.89':445
'12.##6.204.90':445
'12.##6.243.10':445
'12.##6.1.196':445
'12.##6.83.67':445
'12.##6.91.211':445
'12.##6.97.86':445
'12.##6.172.104':445
'12.##6.91.197':445
'12.##6.4.234':445
'12.##6.128.76':445
'12.##6.60.188':445
'12.##6.124.61':445
'12.##6.57.68':445
'12.##6.120.92':445
'12.##6.117.46':445
'12.##6.105.179':445
'12.##6.61.149':445
'12.##6.121.185':445
'12.##6.177.136':445
'12.##6.96.172':445
'12.##6.158.230':445
'12.##6.113.158':445
'12.##6.46.106':445
'12.##6.15.115':139
'12.##6.120.228':139
'12.##6.240.137':139
'12.##6.51.71':139
'12.##6.140.232':139
'12.##6.78.137':139
'12.#26.19.5':139
'12.##6.138.63':139
'12.##6.44.132':139
'12.##6.118.142':139
'12.##6.107.122':139
'12.##6.70.220':139
'12.##6.92.161':139
'12.##6.21.144':139
'12.##6.155.148':139
'12.##6.248.154':139
'12.##6.148.9':139
'12.##6.110.54':139
'12.##6.71.115':139
'12.##6.4.108':139
'12.#26.1.12':139
'12.##6.38.18':139
'12.##6.121.248':139
'12.##6.0.122':139
'12.##6.35.141':139
'12.##6.137.139':139
'12.##6.77.237':139
'12.##6.190.89':139
'12.##6.204.90':139
'12.##6.243.10':139
'12.##6.1.196':139
'12.##6.83.67':139
'12.##6.91.211':139
'12.##6.97.86':139
'12.##6.172.104':139
'12.##6.91.197':139
'12.##6.4.234':139
'12.##6.128.76':139
'12.##6.60.188':139
'12.##6.124.61':139
'12.##6.57.68':139
'12.##6.120.92':139
'12.##6.117.46':139
'12.##6.105.179':139
'12.##6.61.149':139
'12.##6.121.185':139
'12.##6.177.136':139
'12.##6.96.172':139
'12.##6.158.230':139
'12.##6.113.158':139
'12.##6.46.106':139
'12.##6.155.148':9988
'12.#26.50.6':445
'12.##6.148.124':445
'12.##6.5.130':445
'12.##6.206.49':445
'12.##6.19.91':445
'12.##6.148.80':445
'12.##6.245.18':445
'12.##6.207.91':445
'12.##6.0.153':445
'12.##6.219.221':445
'12.##6.69.61':445
'12.##6.19.90':445
'12.##6.240.190':445
'12.##6.72.240':445
'12.##6.153.74':445
'12.##6.222.150':445
'12.##6.180.209':139
'12.##6.200.170':445
'12.#26.3.58':445
'12.##6.121.199':445
'12.##6.157.188':445
'12.#26.1.54':445
'12.##6.62.127':445
'12.##6.230.15':445
'12.##6.32.82':445
'12.##6.251.129':445
'12.##6.201.180':139
'12.##6.119.201':139
'12.##6.54.154':139
'12.##6.76.225':445
'12.##6.209.202':445
'12.##6.180.209':445
'12.##6.225.246':139
'12.##6.189.225':139
'12.##6.58.88':139
'12.##6.23.60':139
'12.##6.4.113':139
'12.##6.247.4':139
'12.##6.34.18':445
'12.##6.1.175':445
'12.##6.225.224':445
'12.##6.7.225':445
'12.##6.236.53':445
'12.##6.6.237':445
'12.##6.204.6':445
'12.##6.15.241':445
'12.##6.111.233':445
'12.##6.145.108':445
'12.##6.190.7':445
'12.##6.224.189':445
'12.##6.77.145':445
'12.##6.62.127':139
'12.##6.230.15':139
'12.##6.32.82':139
'12.##6.72.240':139
'12.##6.153.74':139
'12.##6.222.150':139
'12.##6.240.190':139
'12.##6.206.49':139
'12.##6.19.91':139
'12.##6.121.199':139
'12.##6.157.188':139
'12.#26.1.54':139
'12.#26.3.58':139
'12.##6.38.18':9988
'12.#26.19.5':9988
'12.##6.138.63':9988
'12.##6.110.54':9988
'12.##6.0.122':9988
'12.##6.148.9':9988
'12.##6.83.67':9988
'12.##6.190.89':9988
'12.##6.200.170':139
'12.##6.158.230':9988
'12.##6.46.106':9988
'12.##6.243.10':9988
'12.##6.148.80':139
'12.##6.190.7':139
'12.##6.224.189':139
'12.##6.77.145':139
'12.##6.1.175':139
'12.##6.225.224':139
'12.##6.7.225':139
'12.##6.34.18':139
'12.##6.76.225':139
'12.##6.209.202':139
'12.##6.15.241':139
'12.##6.111.233':139
'12.##6.145.108':139
'12.##6.204.6':139
'12.##6.219.221':139
'12.##6.69.61':139
'12.##6.19.90':139
'12.#26.50.6':139
'12.##6.148.124':139
'12.##6.5.130':139
'12.##6.251.129':139
'12.##6.236.53':139
'12.##6.6.237':139
'12.##6.245.18':139
'12.##6.207.91':139
'12.##6.0.153':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней