Trojan.Starman.5602

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERcff7.dir00\svchost.exe.mdmp 16325836412032176

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERcff7.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'82.##6.146.127':445
'82.##6.237.114':139
'82.##6.63.180':445
'82.##6.235.174':445
'82.#96.5.86':139
'82.##6.42.34':139
'82.##6.92.42':139
'82.##6.237.114':445
'82.#96.5.86':445
'82.##6.91.155':445
'82.##6.236.204':445
'82.##6.89.37':445
'82.#96.76.2':445
'82.##6.33.145':445
'82.##6.141.218':445
'82.#96.9.5':445
'82.#96.79.8':445
'82.##6.209.47':445
'82.##6.134.143':445
'82.##6.166.91':139
'82.##6.162.48':139
'82.##6.155.162':139
'82.##6.85.82':139
'82.##6.225.162':139
'82.##6.65.156':139
'82.##6.87.249':139
'82.##6.214.36':139
'82.##6.224.57':139
'82.##6.150.32':139
'82.##6.158.211':139
'82.##6.156.159':139
'82.##6.167.156':139
'82.##6.142.166':139
'82.##6.159.142':139
'82.##6.86.69':139
'82.##6.71.180':139
'82.##6.39.130':139
'82.##6.105.2':139
'82.##6.163.239':139
'82.##6.8.114':445
'82.##6.230.222':445
'82.#96.26.9':445
'82.##6.47.215':445
'82.##6.126.196':445
'82.##6.70.108':445
'82.##6.204.43':445
'82.##6.111.228':445
'82.##6.170.97':445
'82.##6.92.28':445
'82.##6.215.15':445
'82.##6.235.174':139
'82.##6.146.127':139
'82.##6.91.155':139
'82.##6.63.180':139
'82.#96.8.50':445
'82.##6.223.27':445
'82.##6.16.75':445
'82.##6.228.8':445
'82.##6.141.215':445
'82.##6.114.210':445
'82.#96.87.6':445
'82.##6.115.58':445
'82.##6.139.141':445
'82.##6.188.185':445
'82.##6.91.230':445
'82.#96.32.3':445
'82.##6.190.71':445
'82.##6.105.205':445
'82.##6.169.137':445
'82.##6.144.163':445
'82.##6.212.28':445
'82.##6.100.211':445
'82.##6.226.136':445
'82.##6.91.239':445
'82.##6.234.2':445
'82.##6.155.253':445
'82.##6.85.224':445
'82.##6.23.253':445
'82.##6.183.231':445
'82.##6.65.126':445
'82.##6.3.216':445
'82.##6.11.226':445
'82.##6.187.216':445
'82.##6.225.27':445
'82.##6.98.24':445
'82.##6.70.21':445
'82.##6.21.197':445
'82.##6.114.246':445
'82.##6.144.100':445
'82.##6.162.48':445
'82.##6.155.162':445
'82.##6.85.82':445
'82.##6.225.162':445
'82.##6.65.156':445
'82.##6.87.249':445
'82.##6.214.36':445
'82.##6.224.57':445
'82.##6.150.32':445
'82.##6.60.73':445
'82.##6.171.168':445
'82.##6.23.87':445
'82.##6.48.69':445
'82.##6.169.48':445
'82.##6.127.207':445
'82.##6.145.63':139
'82.##6.202.55':139
'82.##6.5.121':445
'82.#96.56.6':139
'82.##6.10.244':445
'82.##6.229.28':445
'82.##6.214.108':445
'82.##6.134.47':445
'82.##6.28.31':445
'82.##6.213.148':445
'82.##6.197.116':445
'82.##6.133.134':445
'82.##6.252.82':445
'82.##6.39.234':445
'82.##6.158.211':445
'82.##6.28.31':139
'82.##6.229.28':139
'82.##6.60.73':139
'82.##6.134.47':139
'82.##6.214.108':139
'82.##6.39.234':139
'82.##6.197.116':139
'82.##6.213.148':139
'82.##6.252.82':139
'82.##6.70.21':139
'82.##6.187.216':139
'82.##6.65.126':139
'82.##6.144.100':139
'82.##6.11.226':139
'82.##6.3.216':139
'82.##6.98.24':139
'82.##6.21.197':139
'82.##6.225.27':139
'82.##6.114.246':139
'82.##6.133.134':139
'82.##6.156.159':445
'82.##6.167.156':445
'82.##6.142.166':445
'82.##6.159.142':445
'82.##6.86.69':445
'82.##6.71.180':445
'82.##6.39.130':445
'82.##6.105.2':445
'82.##6.163.239':445
'82.##6.166.91':445
'82.##6.169.48':139
'82.##6.171.168':139
'82.##6.10.244':139
'82.##6.48.69':139
'82.##6.23.87':139
'82.##6.42.34':445
'82.##6.92.42':445
'82.##6.127.207':139
'82.##6.5.121':139
'82.##6.212.207':445
'82.##6.207.121':445
'82.##6.11.80':139
'82.##6.54.153':445
'82.##6.34.47':445
'82.##6.7.158':445
'82.##6.28.86':445
'82.##6.180.85':445
'82.##6.236.10':445
'82.##6.153.242':139
'82.##6.223.139':139
'82.##6.78.20':139
'82.##6.103.225':139
'82.##6.49.190':139
'82.##6.199.238':139
'82.##6.104.191':139
'82.##6.62.79':139
'82.##6.88.238':139
'82.##6.191.89':139
'82.##6.46.169':445
'82.##6.174.140':445
'82.##6.177.81':445
'82.##6.1.121':445
'82.##6.10.252':445
'82.##6.128.177':445
'82.##6.221.33':445
'82.##6.30.134':445
'82.##6.169.42':445
'82.##6.169.175':445
'82.##6.121.23':445
'82.##6.39.47':445
'82.##6.164.85':445
'82.##6.91.79':445
'82.##6.9.115':445
'82.##6.87.40':445
'82.##6.222.164':445
'82.##6.40.96':445
'82.##6.213.86':445
'82.##6.250.212':445
'82.##6.168.181':139
'82.##6.164.85':139
'82.##6.87.40':139
'82.##6.9.115':139
'82.##6.39.47':139
'82.##6.213.86':139
'82.##6.40.96':139
'82.##6.121.23':139
'82.##6.250.212':139
'82.##6.222.164':139
'82.##6.91.79':139
'82.##6.46.169':139
'82.##6.34.47':139
'82.##6.236.10':139
'82.##6.7.158':139
'82.##6.54.153':139
'82.##6.212.207':139
'82.##6.28.86':139
'82.##6.180.85':139
'82.##6.207.121':139
'82.##6.1.121':139
'82.##6.186.127':139
'82.##6.19.113':139
'82.##6.150.209':139
'82.##6.128.149':139
'82.##6.54.194':139
'82.#96.51.5':139
'82.#96.8.87':139
'82.##6.122.46':139
'82.##6.55.122':139
'82.##6.221.142':139
'82.##6.177.81':139
'82.##6.128.177':139
'82.##6.10.252':139
'82.##6.174.140':139
'82.##6.169.42':139
'82.##6.30.134':139
'82.##6.25.43':139
'82.##6.169.175':139
'82.##6.221.33':139
'82.##6.212.28':139
'82.##6.100.211':139
'82.##6.226.136':139
'82.##6.91.239':139
'82.##6.234.2':139
'82.##6.155.253':139
'82.##6.85.224':139
'82.##6.23.253':139
'82.##6.183.231':139
'82.##6.114.210':139
'82.##6.230.222':139
'82.#96.26.9':139
'82.##6.47.215':139
'82.##6.126.196':139
'82.##6.70.108':139
'82.##6.204.43':139
'82.##6.111.228':139
'82.##6.170.97':139
'82.##6.92.28':139
'82.##6.144.163':139
'82.##6.236.204':139
'82.##6.89.37':139
'82.#96.76.2':139
'82.##6.33.145':139
'82.##6.141.218':139
'82.#96.9.5':139
'82.#96.79.8':139
'82.##6.209.47':139
'82.##6.134.143':139
'82.##6.8.114':139
'82.#96.87.6':139
'82.##6.115.58':139
'82.##6.139.141':139
'82.##6.188.185':139
'82.##6.91.230':139
'82.#96.32.3':139
'82.##6.190.71':139
'82.##6.105.205':139
'82.##6.169.137':139
'82.##6.215.15':139
'82.##6.103.225':445
'82.##6.49.190':445
'82.#96.8.87':445
'82.##6.168.181':445
'82.##6.223.139':445
'82.##6.88.238':445
'82.##6.191.89':445
'82.##6.78.20':445
'82.##6.199.238':445
'82.#96.51.5':445
'82.##6.150.209':445
'82.##6.128.149':445
'82.##6.25.43':445
'82.##6.221.142':445
'82.##6.186.127':445
'82.##6.122.46':445
'82.##6.55.122':445
'82.##6.19.113':445
'82.##6.54.194':445
'82.##6.104.191':445
'82.##6.30.134':9988
'82.##6.122.46':9988
'82.##6.10.252':9988
'82.##6.221.33':9988
'82.#96.8.50':139
'82.##6.223.27':139
'82.##6.16.75':139
'82.##6.228.8':139
'82.##6.141.215':139
'82.##6.1.121':9988
'82.##6.11.80':445
'82.##6.54.153':9988
'82.##6.62.79':445
'82.##6.153.242':445
'82.##6.212.207':9988
'82.##6.213.86':9988
'82.##6.250.212':9988
'82.##6.9.115':9988
'82.##6.164.85':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней