Trojan.Starman.5609

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERa1ab.dir00\svchost.exe.mdmp 16325836412032260

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERa1ab.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'88.##8.160.40':445
'88.##8.129.49':445
'88.##8.79.89':445
'88.##8.189.34':445
'88.##8.245.20':139
'88.##8.134.7':445
'88.##8.36.134':139
'88.##8.134.7':139
'88.##8.245.20':445
'88.##8.175.138':445
'88.##8.83.245':445
'88.##8.33.136':445
'88.##8.41.157':445
'88.##8.138.158':445
'88.##8.133.202':445
'88.#68.0.28':445
'88.##8.99.120':445
'88.##8.162.141':445
'88.##8.226.26':445
'88.##8.41.77':139
'88.##8.233.54':139
'88.##8.18.111':139
'88.##8.148.237':139
'88.##8.176.6':139
'88.##8.158.105':139
'88.##8.44.125':139
'88.##8.109.55':139
'88.##8.64.95':139
'88.##8.67.176':139
'88.##8.183.119':139
'88.##8.201.140':139
'88.##8.113.193':139
'88.##8.248.93':139
'88.#68.3.15':139
'88.##8.191.162':139
'88.##8.151.127':139
'88.##8.24.60':139
'88.##8.171.191':139
'88.##8.168.198':139
'88.##8.54.147':445
'88.##8.65.106':445
'88.##8.244.215':445
'88.##8.50.196':445
'88.##8.129.50':445
'88.##8.88.19':445
'88.##8.75.67':445
'88.##8.72.250':445
'88.##8.84.254':445
'88.##8.132.51':445
'88.##8.196.199':445
'88.##8.189.34':139
'88.##8.160.40':139
'88.##8.175.138':139
'88.##8.79.89':139
'88.##8.129.49':139
'88.##8.96.91':445
'88.##8.240.170':445
'88.##8.234.53':445
'88.##8.92.234':445
'88.##8.214.83':445
'88.##8.123.25':445
'88.##8.174.74':445
'88.##8.201.186':445
'88.##8.71.202':445
'88.##8.206.207':445
'88.##8.153.7':445
'88.##8.152.199':445
'88.##8.33.205':445
'88.##8.55.136':445
'88.##8.178.37':445
'88.##8.98.212':445
'88.##8.92.67':445
'88.##8.231.153':445
'88.##8.239.64':445
'88.##8.149.30':445
'88.##8.26.185':445
'88.#68.3.0':445
'88.##8.239.148':445
'88.##8.139.239':445
'88.##8.185.193':445
'88.##8.46.231':445
'88.##8.20.150':445
'88.##8.193.194':445
'88.##8.186.221':445
'88.##8.143.183':445
'88.##8.26.77':445
'88.##8.154.57':445
'88.##8.55.62':445
'88.##8.200.148':445
'88.##8.233.54':445
'88.##8.18.111':445
'88.##8.148.237':445
'88.##8.176.6':445
'88.##8.158.105':445
'88.##8.44.125':445
'88.##8.109.55':445
'88.##8.64.95':445
'88.##8.67.176':445
'88.##8.217.17':445
'88.##8.145.131':445
'88.##8.157.41':445
'88.##8.92.233':445
'88.##8.200.7':445
'88.##8.155.23':445
'88.##8.37.122':139
'88.##8.87.173':139
'88.##8.143.137':445
'88.##8.144.116':445
'88.##8.201.161':445
'88.##8.184.232':445
'88.##8.226.227':445
'88.##8.113.217':445
'88.##8.2.243':445
'88.##8.204.147':445
'88.##8.83.243':445
'88.##8.121.135':445
'88.##8.2.217':445
'88.##8.30.111':445
'88.##8.183.119':445
'88.##8.2.243':139
'88.##8.184.232':139
'88.##8.217.17':139
'88.##8.113.217':139
'88.##8.226.227':139
'88.##8.30.111':139
'88.##8.83.243':139
'88.##8.204.147':139
'88.##8.2.217':139
'88.##8.26.77':139
'88.##8.193.194':139
'88.##8.185.193':139
'88.##8.200.148':139
'88.##8.20.150':139
'88.##8.46.231':139
'88.##8.55.62':139
'88.##8.143.183':139
'88.##8.186.221':139
'88.##8.154.57':139
'88.##8.121.135':139
'88.##8.201.140':445
'88.##8.113.193':445
'88.##8.248.93':445
'88.#68.3.15':445
'88.##8.191.162':445
'88.##8.151.127':445
'88.##8.24.60':445
'88.##8.171.191':445
'88.##8.168.198':445
'88.##8.41.77':445
'88.##8.200.7':139
'88.##8.145.131':139
'88.##8.201.161':139
'88.##8.92.233':139
'88.##8.157.41':139
'88.##8.144.116':139
'88.##8.36.134':445
'88.##8.155.23':139
'88.##8.143.137':139
'88.##8.99.120':139
'88.##8.145.221':445
'88.##8.238.179':445
'88.##8.175.24':139
'88.##8.33.34':445
'88.##8.33.231':445
'88.##8.120.187':445
'88.##8.94.96':445
'88.##8.231.121':445
'88.##8.188.24':445
'88.##8.27.204':139
'88.##8.116.253':139
'88.##8.76.244':139
'88.##8.65.110':139
'88.##8.41.212':139
'88.##8.31.180':139
'88.##8.98.240':139
'88.##8.167.71':139
'88.##8.135.145':139
'88.##8.20.177':139
'88.##8.87.245':445
'88.##8.93.114':445
'88.##8.196.104':445
'88.##8.11.215':445
'88.#68.3.98':445
'88.##8.166.52':445
'88.##8.90.217':445
'88.##8.95.90':445
'88.##8.234.165':445
'88.##8.73.170':445
'88.#68.18.3':445
'88.##8.1.250':445
'88.##8.73.198':445
'88.##8.88.125':445
'88.##8.251.40':445
'88.##8.53.213':445
'88.##8.82.229':445
'88.##8.23.138':445
'88.##8.238.196':445
'88.##8.67.69':445
'88.##8.183.20':139
'88.##8.73.198':139
'88.##8.53.213':139
'88.##8.251.40':139
'88.##8.1.250':139
'88.##8.238.196':139
'88.##8.23.138':139
'88.#68.18.3':139
'88.##8.67.69':139
'88.##8.82.229':139
'88.##8.88.125':139
'88.##8.33.34':139
'88.##8.145.221':139
'88.##8.231.121':139
'88.##8.33.231':139
'88.##8.238.179':139
'88.##8.94.96':139
'88.##8.87.245':139
'88.##8.188.24':139
'88.##8.120.187':139
'88.##8.11.215':139
'88.##8.57.100':139
'88.##8.7.156':139
'88.##8.17.23':139
'88.##8.100.101':139
'88.##8.192.72':139
'88.##8.161.118':139
'88.##8.21.162':139
'88.##8.156.192':139
'88.##8.15.95':139
'88.##8.45.231':139
'88.##8.196.104':139
'88.##8.166.52':139
'88.#68.3.98':139
'88.##8.93.114':139
'88.##8.234.165':139
'88.##8.95.90':139
'88.##8.231.95':139
'88.##8.73.170':139
'88.##8.90.217':139
'88.##8.239.64':139
'88.##8.98.212':139
'88.##8.214.83':139
'88.##8.231.153':139
'88.##8.92.67':139
'88.##8.139.239':139
'88.##8.26.185':139
'88.##8.149.30':139
'88.##8.239.148':139
'88.##8.72.250':139
'88.##8.129.50':139
'88.##8.65.106':139
'88.##8.196.199':139
'88.##8.50.196':139
'88.##8.244.215':139
'88.##8.132.51':139
'88.##8.75.67':139
'88.##8.88.19':139
'88.##8.84.254':139
'88.#68.3.0':139
'88.##8.138.158':139
'88.##8.83.245':139
'88.##8.54.147':139
'88.##8.41.157':139
'88.##8.33.136':139
'88.##8.226.26':139
'88.#68.0.28':139
'88.##8.133.202':139
'88.##8.162.141':139
'88.##8.152.199':139
'88.##8.71.202':139
'88.##8.123.25':139
'88.##8.178.37':139
'88.##8.201.186':139
'88.##8.174.74':139
'88.##8.55.136':139
'88.##8.153.7':139
'88.##8.206.207':139
'88.##8.33.205':139
'88.##8.240.170':139
'88.##8.65.110':445
'88.##8.41.212':445
'88.##8.21.162':445
'88.##8.183.20':445
'88.##8.116.253':445
'88.##8.135.145':445
'88.##8.20.177':445
'88.##8.76.244':445
'88.##8.31.180':445
'88.##8.161.118':445
'88.##8.17.23':445
'88.##8.100.101':445
'88.##8.231.95':445
'88.##8.45.231':445
'88.##8.57.100':445
'88.##8.156.192':445
'88.##8.15.95':445
'88.##8.7.156':445
'88.##8.192.72':445
'88.##8.98.240':445
'88.##8.234.165':9988
'88.##8.95.90':9988
'88.##8.196.104':9988
'88.##8.166.52':9988
'88.##8.231.95':9988
'88.##8.92.234':139
'88.##8.96.91':139
'88.##8.100.101':9988
'88.##8.234.53':139
'88.##8.93.114':9988
'88.##8.175.24':445
'88.##8.87.245':9988
'88.##8.167.71':445
'88.##8.27.204':445
'88.##8.231.121':9988
'88.##8.11.215':9988
'88.#68.3.98':9988
'88.##8.238.196':9988
'88.##8.82.229':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней