Trojan.Starman.5636

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER2edc.dir00\svchost.exe.mdmp 16325836412032196

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2edc.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'81.##.134.181':139
'81.##.36.135':139
'81.#0.18.25':139
'81.##.91.138':139
'81.##.111.202':139
'81.##.65.189':139
'81.##.117.174':139
'81.##.95.193':139
'81.##.138.122':139
'81.##.252.107':139
'81.##.20.217':139
'81.##.92.240':139
'81.##.125.93':139
'81.##.239.112':445
'81.##.173.206':445
'81.##.112.173':445
'81.#0.77.5':139
'81.##.217.30':139
'81.##.117.41':139
'81.##.216.41':139
'81.##.63.194':139
'81.##.111.202':445
'81.#0.18.25':445
'81.##.91.138':445
'81.##.217.30':445
'81.##.20.217':445
'81.##.252.107':445
'81.##.95.193':445
'81.##.138.122':445
'81.##.134.181':445
'81.##.36.135':445
'81.#0.77.5':445
'81.#0.179.5':139
'81.##.70.241':139
'81.##.10.118':139
'81.##.236.117':139
'81.##.161.236':139
'81.##.63.194':445
'81.##.117.41':445
'81.##.216.41':445
'81.##.92.240':445
'81.##.125.93':445
'81.##.123.245':445
'81.##.123.245':139
'81.##.173.206':139
'81.##.28.186':139
'81.##.125.202':139
'81.##.186.47':139
'81.#0.1.183':445
'81.##.114.128':445
'81.##.183.18':445
'81.##.112.173':139
'81.##.239.112':139
'81.##.127.26':139
'81.##.52.154':139
'81.##.163.14':139
'81.#0.180.9':139
'81.##.184.182':139
'81.##.110.82':139
'81.##.200.43':139
'81.##.127.94':139
'81.#0.32.64':139
'81.##.202.253':139
'81.##.179.16':139
'81.#0.32.64':445
'81.##.200.43':445
'81.##.179.16':445
'81.##.163.14':445
'81.##.202.253':445
'81.##.186.47':445
'81.##.28.186':445
'81.##.125.202':445
'81.##.127.94':445
'81.##.127.26':445
'81.##.52.154':445
'81.##.160.179':445
'81.##.198.225':445
'81.##.169.245':445
'81.##.107.19':445
'81.##.197.218':445
'81.##.110.82':445
'81.#0.180.9':445
'81.##.184.182':445
'81.##.11.199':445
'81.##.124.144':445
'81.##.65.189':445
'81.##.107.172':445
'81.##.194.28':445
'81.##.121.141':445
'81.#0.84.34':445
'81.#0.60.84':445
'81.##.217.116':139
'81.##.192.217':139
'81.##.162.185':445
'81.#0.251.5':445
'81.##.194.88':445
'81.##.134.67':445
'81.##.183.16':445
'81.#0.59.80':445
'81.#0.17.4':445
'81.#0.69.62':445
'81.##.23.184':445
'81.##.46.144':445
'81.##.105.224':445
'81.##.125.123':445
'81.##.114.165':445
'81.##.14.149':445
'81.##.149.161':139
'81.##.239.149':139
'81.##.193.169':139
'81.##.255.49':139
'81.##.108.49':139
'81.#0.8.110':139
'81.#0.250.2':139
'81.##.126.152':139
'81.##.138.239':139
'81.##.89.121':139
'81.##.119.189':139
'81.#0.106.5':139
'81.##.67.105':139
'81.#0.5.178':139
'81.##.114.203':139
'81.#0.72.91':139
'81.#0.28.97':139
'81.##.23.168':139
'81.##.157.136':139
'81.##.206.66':139
'81.##.136.206':139
'81.##.92.236':445
'81.##.92.236':139
'81.#0.69.62':139
'81.##.28.124':139
'81.##.229.211':139
'81.#0.33.12':139
'81.#0.59.80':139
'81.##.114.165':139
'81.##.183.16':139
'81.##.23.184':139
'81.#0.17.4':139
'81.##.106.61':139
'81.##.10.118':445
'81.#0.179.5':445
'81.##.161.236':445
'81.##.117.174':445
'81.##.236.117':445
'81.##.196.65':139
'81.#0.83.41':139
'81.##.69.164':139
'81.##.70.241':445
'81.##.165.73':139
'81.##.69.164':445
'81.##.196.65':445
'81.##.165.73':445
'81.##.194.88':139
'81.##.162.185':139
'81.#0.33.12':445
'81.##.28.124':445
'81.##.229.211':445
'81.#0.83.41':445
'81.##.106.61':445
'81.#0.251.5':139
'81.##.105.224':139
'81.##.134.67':139
'81.##.46.144':139
'81.##.14.149':139
'81.##.125.123':139
'81.##.107.172':139
'81.##.194.28':139
'81.##.121.141':139
'81.#0.84.34':139
'81.#0.60.84':139
'81.##.124.144':139
'81.##.62.120':445
'81.##.193.107':445
'81.#0.1.113':445
'81.#0.58.24':445
'81.#0.88.39':445
'81.##.53.129':445
'81.##.100.139':445
'81.##.30.235':445
'81.#0.21.45':445
'81.##.74.164':445
'81.##.66.215':445
'81.##.33.216':139
'81.#0.67.33':139
'81.#0.56.19':139
'81.#0.89.43':139
'81.##.223.59':139
'81.##.63.193':445
'81.##.193.199':445
'81.#0.41.17':139
'81.#0.2.68':139
'81.#0.95.2':139
'81.#0.130.5':445
'81.##.157.230':445
'81.##.222.215':445
'81.##.56.118':445
'81.##.106.233':445
'81.##.91.196':445
'81.##.106.111':445
'81.#0.11.88':445
'81.##.78.154':445
'81.##.62.173':445
'81.#0.16.51':445
'81.##.248.93':445
'81.##.154.189':445
'81.##.113.95':445
'81.##.162.33':445
'81.##.160.121':445
'81.#0.39.4':445
'81.##.71.102':445
'81.##.160.144':445
'81.##.84.125':445
'81.##.237.42':445
'81.##.42.167':139
'81.##.160.121':139
'81.##.113.95':139
'81.##.162.33':139
'81.##.53.129':139
'81.##.100.139':139
'81.##.237.42':139
'81.##.160.144':139
'81.##.84.125':139
'81.##.248.93':139
'81.##.154.189':139
'81.##.30.235':139
'81.#0.58.24':139
'81.#0.88.39':139
'81.##.66.215':139
'81.##.193.199':139
'81.##.63.193':139
'81.#0.21.45':139
'81.##.74.164':139
'81.##.193.107':139
'81.#0.1.113':139
'81.##.62.120':139
'81.##.202.181':139
'81.#0.12.37':139
'81.##.255.105':139
'81.##.91.196':139
'81.##.106.111':139
'81.##.14.119':139
'81.#0.168.9':139
'81.##.180.141':139
'81.##.255.114':139
'81.##.181.21':139
'81.#0.11.88':139
'81.##.56.118':139
'81.##.106.233':139
'81.#0.16.51':139
'81.#0.39.4':139
'81.##.71.102':139
'81.##.78.154':139
'81.##.62.173':139
'81.##.157.230':139
'81.##.222.215':139
'81.#0.130.5':139
'81.##.255.105':445
'81.##.79.109':445
'81.##.216.68':445
'81.##.13.147':445
'81.##.135.216':445
'81.##.103.79':445
'81.#0.10.42':445
'81.##.216.137':445
'81.##.144.151':445
'81.#0.35.34':445
'81.##.151.34':445
'81.##.168.211':445
'81.##.209.128':139
'81.##.16.210':139
'81.##.119.192':139
'81.##.127.246':139
'81.##.137.203':139
'81.##.56.111':139
'81.##.144.96':139
'81.##.183.184':139
'81.##.126.24':139
'81.##.220.78':139
'81.##.114.128':139
'81.##.107.19':139
'81.#0.1.183':139
'81.##.144.96':445
'81.##.183.18':139
'81.##.198.225':139
'81.##.11.199':139
'81.##.160.179':139
'81.##.197.218':139
'81.##.169.245':139
'81.##.56.111':445
'81.##.137.203':445
'81.##.119.192':445
'81.##.127.246':445
'81.##.57.122':445
'81.#0.112.2':445
'81.##.220.78':445
'81.##.183.184':445
'81.##.126.24':445
'81.##.209.128':445
'81.##.16.210':445
'81.#0.112.2':139
'81.#0.95.2':445
'81.#0.41.17':445
'81.#0.2.68':445
'81.##.33.216':445
'81.#0.67.33':445
'81.#0.88.39':9988
'81.#0.1.113':9988
'81.##.66.215':9988
'81.#0.58.24':9988
'81.##.193.199':9988
'81.#0.56.19':445
'81.##.181.21':445
'81.##.180.141':445
'81.##.255.114':445
'81.##.202.181':445
'81.#0.12.37':445
'81.#0.89.43':445
'81.##.223.59':445
'81.##.42.167':445
'81.##.14.119':445
'81.#0.168.9':445
'81.##.216.68':139
'81.#0.35.34':139
'81.##.79.109':139
'81.##.103.79':139
'81.##.13.147':139
'81.##.216.137':139
'81.##.57.122':139
'81.#0.10.42':139
'81.##.151.34':139
'81.##.144.151':139
'81.##.135.216':139
'81.##.160.121':9988
'81.##.113.95':9988
'81.##.162.33':9988
'81.##.62.120':9988
'81.##.100.139':9988
'81.##.157.230':9988
'81.##.168.211':139
'81.##.222.215':9988
'81.##.248.93':9988
'81.##.84.125':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней