Trojan.Starman.5791

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd50b.dir00\svchost.exe.mdmp 16325836412028680

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERd50b.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'62.##8.30.229':445
'62.##8.13.243':139
'62.##8.197.190':445
'62.##8.73.130':445
'62.##8.99.195':139
'62.##8.21.197':139
'62.##8.254.106':139
'62.##8.13.243':445
'62.##8.99.195':445
'62.##8.123.239':445
'62.##8.64.207':445
'62.##8.253.138':445
'62.#08.14.4':445
'62.##8.166.149':445
'62.##8.20.58':445
'62.##8.66.238':445
'62.##8.40.23':445
'62.##8.235.197':445
'62.##8.123.71':445
'62.##8.242.253':139
'62.##8.84.230':139
'62.##8.254.84':139
'62.##8.29.83':139
'62.##8.230.76':139
'62.##8.162.253':139
'62.##8.78.212':139
'62.##8.125.102':139
'62.##8.172.0':139
'62.##8.48.187':139
'62.##8.232.127':139
'62.##8.177.254':139
'62.##8.82.243':139
'62.##8.237.55':139
'62.##8.80.79':139
'62.##8.87.181':139
'62.##8.230.38':139
'62.##8.126.108':139
'62.##8.11.192':139
'62.##8.237.177':139
'62.##8.103.205':445
'62.##8.214.234':445
'62.##8.39.245':445
'62.##8.124.96':445
'62.##8.39.215':445
'62.##8.14.185':445
'62.##8.219.74':445
'62.##8.172.190':445
'62.##8.197.232':445
'62.##8.106.216':445
'62.##8.30.229':139
'62.##8.107.9':445
'62.##8.197.190':139
'62.##8.73.130':139
'62.##8.35.185':445
'62.##8.83.229':445
'62.##8.11.25':445
'62.##8.253.241':445
'62.##8.54.207':445
'62.##8.243.129':445
'62.##8.10.171':445
'62.##8.89.187':445
'62.##8.97.53':445
'62.##8.170.97':445
'62.##8.215.75':445
'62.##8.28.53':445
'62.##8.218.213':445
'62.##8.48.137':445
'62.##8.232.93':445
'62.##8.53.175':445
'62.##8.84.221':445
'62.##8.22.91':445
'62.##8.13.212':445
'62.##8.187.162':445
'62.##8.27.226':445
'62.##8.43.177':445
'62.##8.174.212':445
'62.##8.42.105':445
'62.##8.153.243':445
'62.##8.216.25':445
'62.##8.221.250':445
'62.##8.47.175':445
'62.##8.25.149':445
'62.##8.229.133':445
'62.##8.57.233':445
'62.##8.143.192':445
'62.##8.124.171':445
'62.##8.84.140':445
'62.##8.125.102':445
'62.##8.230.76':445
'62.##8.84.230':445
'62.##8.232.127':445
'62.##8.29.83':445
'62.##8.254.84':445
'62.##8.48.187':445
'62.##8.78.212':445
'62.##8.162.253':445
'62.##8.172.0':445
'62.##8.76.85':445
'62.##8.142.22':445
'62.##8.191.46':445
'62.##8.113.46':445
'62.##8.159.142':445
'62.##8.211.159':445
'62.##8.59.13':139
'62.##8.164.172':139
'62.##8.238.100':445
'62.##8.234.20':445
'62.##8.201.68':445
'62.##8.107.135':445
'62.##8.22.242':445
'62.##8.135.206':445
'62.##8.90.89':445
'62.##8.106.23':445
'62.##8.107.20':445
'62.##8.37.134':445
'62.##8.166.105':445
'62.##8.212.165':445
'62.##8.90.89':139
'62.##8.22.242':139
'62.##8.135.206':139
'62.##8.107.135':139
'62.##8.106.23':139
'62.##8.107.20':139
'62.##8.201.68':139
'62.##8.166.105':139
'62.##8.212.165':139
'62.##8.76.85':139
'62.##8.216.25':139
'62.##8.221.250':139
'62.##8.47.175':139
'62.##8.25.149':139
'62.##8.229.133':139
'62.##8.57.233':139
'62.##8.143.192':139
'62.##8.124.171':139
'62.##8.84.140':139
'62.##8.37.134':139
'62.##8.177.254':445
'62.##8.82.243':445
'62.##8.237.55':445
'62.##8.80.79':445
'62.##8.87.181':445
'62.##8.230.38':445
'62.##8.126.108':445
'62.##8.11.192':445
'62.##8.237.177':445
'62.##8.242.253':445
'62.##8.159.142':139
'62.##8.211.159':139
'62.##8.113.46':139
'62.##8.142.22':139
'62.##8.238.100':139
'62.##8.21.197':445
'62.##8.254.106':445
'62.##8.191.46':139
'62.##8.234.20':139
'62.##8.123.239':139
'62.##8.15.19':445
'62.##8.132.88':445
'62.##8.138.183':139
'62.##8.43.178':139
'62.##8.195.11':445
'62.##8.110.136':445
'62.#08.26.8':445
'62.##8.158.138':445
'62.##8.168.87':445
'62.##8.148.10':139
'62.##8.201.211':139
'62.##8.61.202':139
'62.##8.142.181':139
'62.##8.23.166':139
'62.#08.75.2':139
'62.##8.69.179':139
'62.##8.184.105':139
'62.##8.96.99':139
'62.##8.154.198':139
'62.##8.9.249':445
'62.##8.44.185':445
'62.##8.38.83':445
'62.##8.181.212':445
'62.##8.101.45':445
'62.##8.217.210':445
'62.##8.133.45':445
'62.##8.59.198':445
'62.##8.101.217':445
'62.##8.124.124':445
'62.##8.213.57':445
'62.##8.206.187':445
'62.##8.111.168':445
'62.##8.62.102':445
'62.##8.240.125':445
'62.##8.161.45':445
'62.##8.248.185':445
'62.##8.57.249':445
'62.##8.43.15':445
'62.##8.186.54':445
'62.##8.161.45':139
'62.##8.43.15':139
'62.##8.206.187':139
'62.##8.111.168':139
'62.##8.186.54':139
'62.##8.213.57':139
'62.##8.181.212':139
'62.##8.248.185':139
'62.##8.57.249':139
'62.##8.240.125':139
'62.##8.195.11':139
'62.##8.158.138':139
'62.##8.132.88':139
'62.##8.15.19':139
'62.##8.168.87':139
'62.##8.9.249':139
'62.##8.62.102':139
'62.##8.110.136':139
'62.#08.26.8':139
'62.##8.101.45':139
'62.##8.19.55':139
'62.##8.22.119':139
'62.##8.115.181':139
'62.##8.226.36':139
'62.##8.145.192':139
'62.##8.117.109':139
'62.##8.63.228':139
'62.##8.61.176':139
'62.##8.13.90':139
'62.##8.117.22':139
'62.##8.217.210':139
'62.##8.101.217':139
'62.##8.44.185':139
'62.##8.38.83':139
'62.##8.124.124':139
'62.##8.25.44':139
'62.##8.45.21':139
'62.##8.133.45':139
'62.##8.59.198':139
'62.##8.13.212':139
'62.##8.84.221':139
'62.##8.243.129':139
'62.##8.187.162':139
'62.##8.22.91':139
'62.##8.153.243':139
'62.##8.43.177':139
'62.##8.27.226':139
'62.##8.42.105':139
'62.##8.219.74':139
'62.##8.124.96':139
'62.##8.103.205':139
'62.##8.106.216':139
'62.##8.39.245':139
'62.##8.214.234':139
'62.##8.197.232':139
'62.##8.14.185':139
'62.##8.39.215':139
'62.##8.172.190':139
'62.##8.174.212':139
'62.##8.64.207':139
'62.##8.253.138':139
'62.#08.14.4':139
'62.##8.166.149':139
'62.##8.20.58':139
'62.##8.66.238':139
'62.##8.40.23':139
'62.##8.235.197':139
'62.##8.123.71':139
'62.##8.218.213':139
'62.##8.170.97':139
'62.##8.10.171':139
'62.##8.53.175':139
'62.##8.97.53':139
'62.##8.89.187':139
'62.##8.232.93':139
'62.##8.28.53':139
'62.##8.215.75':139
'62.##8.48.137':139
'62.##8.142.181':445
'62.##8.23.166':445
'62.##8.117.109':445
'62.##8.63.228':445
'62.##8.201.211':445
'62.##8.96.99':445
'62.##8.154.198':445
'62.##8.61.202':445
'62.#08.75.2':445
'62.##8.13.90':445
'62.##8.117.22':445
'62.##8.115.181':445
'62.##8.25.44':445
'62.##8.45.21':445
'62.##8.226.36':445
'62.##8.145.192':445
'62.##8.61.176':445
'62.##8.19.55':445
'62.##8.22.119':445
'62.##8.69.179':445
'62.##8.96.99':9988
'62.##8.107.9':139
'62.##8.59.198':9988
'62.##8.117.22':9988
'62.##8.35.185':139
'62.##8.83.229':139
'62.##8.11.25':139
'62.##8.253.241':139
'62.##8.54.207':139
'62.##8.217.210':9988
'62.##8.138.183':445
'62.##8.43.178':445
'62.##8.184.105':445
'62.##8.148.10':445
'62.##8.168.87':9988
'62.##8.161.45':9988
'62.##8.43.15':9988
'62.##8.110.136':9988
'62.##8.206.187':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней