Trojan.Starman.5800

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'20#.#50.246.89':139
'20#.#50.57.246':139
'20#.#50.37.212':139
'20#.#50.89.224':139
'20#.#50.169.52':139
'20#.#50.10.45':445
'20#.#50.248.152':445
'20#.#50.162.15':139
'20#.#50.154.8':445
'20#.#50.127.84':139
'20#.#50.26.215':139
'20#.#50.238.206':139
'20#.#50.60.77':139
'20#.#50.221.242':139
'20#.#50.2.210':139
'20#.#50.5.167':139
'20#.#50.73.247':139
'20#.#50.144.78':139
'20#.#50.250.94':445
'20#.#50.122.147':445
'20#.#50.100.76':445
'20#.#50.233.29':445
'20#.#50.8.247':445
'20#.#50.83.236':445
'20#.#50.231.202':445
'20#.#50.209.67':445
'20#.#50.235.208':445
'20#.#50.117.89':445
'20#.#50.125.204':445
'20#.#50.82.244':445
'20#.#50.71.234':445
'20#.#50.136.125':445
'20#.#50.84.108':445
'20#.#50.230.111':445
'20#.#50.157.136':445
'20#.#50.12.162':445
'20#.#50.136.182':139
'20#.#50.157.136':139
'20#.#50.12.162':139
'20#.#50.125.204':139
'20#.#50.136.125':139
'20#.#50.84.108':139
'20#.#50.233.29':139
'20#.#50.250.94':139
'20#.#50.230.111':139
'20#.#50.100.76':139
'20#.#50.100.16':445
'20#.#50.154.8':139
'20#.#50.100.16':139
'20#.#50.236.206':445
'20#.#50.10.45':139
'20#.#50.71.234':139
'20#.#50.117.89':139
'20#.#50.248.152':139
'20#.#50.82.244':139
'20#.#50.21.86':139
'20#.#50.28.121':139
'20#.#50.209.95':139
'20#.#50.146.149':139
'20#.#50.13.29':139
'20#.#50.68.216':139
'20#.#50.255.14':139
'20#.#50.121.159':139
'20#.#50.36.122':139
'20#.#50.209.67':139
'20#.#50.235.208':139
'20#.#50.122.147':139
'20#.#50.8.247':139
'20#.#50.83.236':139
'20#.#50.100.209':139
'20#.#50.123.200':139
'20#.#50.231.202':139
'20#.#50.59.68':139
'20#.#50.60.91':139
'20#.#50.240.93':139
'20#.#50.245.110':139
'20#.#50.26.145':139
'20#.#50.94.240':139
'20#.#50.100.161':139
'20#.#50.69.124':139
'20#.#50.135.95':139
'20#.#50.12.126':139
'20#.#50.241.53':139
'20#.#50.238.132':139
'20#.#50.131.90':139
'20#.#50.167.136':139
'20#.#50.182.88':139
'20#.#50.41.71':139
'20#.#50.64.128':139
'20#.#50.93.85':139
'20#.#50.185.131':139
'20#.#50.255.55':139
'20#.#50.60.33':139
'20#.#50.88.236':139
'20#.#50.206.56':139
'20#.#50.83.92':139
'20#.#50.245.61':139
'20#.#50.91.76':139
'20#.#50.62.136':139
'20#.#50.4.62':139
'20#.#50.193.116':139
'20#.#50.8.123':139
'20#.#50.170.214':139
'20#.#50.165.219':139
'20#.#50.117.0':139
'20#.#50.170.120':139
'20#.#50.46.168':139
'20#.#50.137.49':139
'20#.#50.120.122':139
'20#.#50.6.119':139
'20#.#50.255.14':445
'20#.#50.136.182':445
'20#.#50.36.122':445
'20#.#50.68.216':445
'20#.#50.238.206':445
'20#.#50.26.215':445
'20#.#50.221.242':445
'20#.#50.60.77':445
'20#.#50.127.84':445
'20#.#50.123.200':445
'20#.#50.209.95':445
'20#.#50.59.68':445
'20#.#50.100.209':445
'20#.#50.146.149':445
'20#.#50.13.29':445
'20#.#50.121.159':445
'20#.#50.21.86':445
'20#.#50.28.121':445
'20#.#50.149.90':139
'20#.#50.90.62':445
'20#.#50.162.15':445
'20#.#50.90.62':139
'20#.#50.149.90':445
'20#.#50.186.135':139
'20#.#50.18.221':139
'20#.#50.55.149':139
'20#.#50.76.157':139
'20#.#50.2.210':445
'20#.#50.5.167':445
'20#.#50.73.247':445
'20#.#50.144.78':445
'20#.#50.37.212':445
'20#.#50.57.246':445
'20#.#50.169.52':445
'20#.#50.89.224':445
'20#.#50.246.89':445
'20#.#50.236.206':139
'20#.#50.178.44':139
'20#.#50.69.139':139
'20#.#50.116.115':139
'20#.#50.115.70':139
'20#.#50.202.142':139
'20#.#50.146.37':445
'20#.#50.166.229':445
'20#.#50.90.19':445
'20#.#50.37.90':445
'20#.#50.209.58':139
'20#.#50.7.211':139
'20#.#50.245.226':139
'20#.#50.130.129':139
'20#.#50.27.27':139
'20#.#50.183.220':139
'20#.#50.207.183':139
'20#.#50.117.4':139
'20#.#50.20.196':139
'20#.#50.15.171':445
'20#.#50.86.134':445
'20#.#50.4.66':445
'20#.#50.3.201':445
'20#.#50.122.93':445
'20#.#50.180.73':445
'20#.#50.125.62':445
'20#.#50.184.184':445
'20#.#50.18.215':445
'20#.#50.215.178':445
'20#.#50.48.96':445
'20#.#50.179.60':445
'20#.#50.153.22':445
'20#.#50.103.126':445
'20#.#50.31.163':445
'20#.#50.72.129':445
'20#.#50.242.140':445
'20#.#50.224.8':445
'20#.#50.106.235':139
'20#.#50.31.163':139
'20#.#50.72.129':139
'20#.#50.242.140':139
'20#.#50.224.8':139
'20#.#50.4.66':139
'20#.#50.86.134':139
'20#.#50.122.93':139
'20#.#50.3.201':139
'20#.#50.15.171':139
'20#.#50.146.37':139
'20#.#50.166.229':139
'20#.#50.90.19':139
'20#.#50.37.90':139
'20#.#50.179.60':139
'20#.#50.48.96':139
'20#.#50.103.126':139
'20#.#50.153.22':139
'20#.#50.215.178':139
'20#.#50.115.19':139
'20#.#50.16.130':139
'20#.#50.78.219':139
'20#.#50.28.159':139
'20#.#50.142.16':139
'20#.#50.245.148':139
'20#.#50.85.62':139
'20#.#50.60.142':139
'20#.#50.34.61':139
'20#.#50.180.73':139
'20#.#50.125.62':139
'20#.#50.184.184':139
'20#.#50.18.215':139
'20#.#50.246.72':139
'20#.#50.164.117':139
'20#.#50.156.184':139
'20#.#50.39.244':139
'20#.#50.112.39':139
'20#.#50.105.21':139
'20#.#50.214.9':139
'20#.#50.103.126':9988
'20#.#50.28.186':139
'20#.#50.179.249':139
'20#.#50.224.251':139
'20#.#50.172.236':139
'20#.#50.233.203':139
'20#.#50.252.68':139
'20#.#50.86.134':9988
'20#.#50.179.60':9988
'20#.#50.242.140':9988
'20#.#50.72.129':9988
'20#.#50.3.201':9988
'20#.#50.180.73':9988
'20#.#50.246.72':9988
'20#.#50.90.19':9988
'20#.#50.146.37':9988
'20#.#50.224.251':445
'20#.#50.172.236':445
'20#.#50.233.203':445
'20#.#50.252.68':445
'20#.#50.113.89':445
'20#.#50.8.27':445
'20#.#50.102.22':445
'20#.#50.9.138':445
'20#.#50.169.254':445
'20#.#50.169.254':139
'20#.#50.8.27':139
'20#.#50.113.89':139
'20#.#50.9.138':139
'20#.#50.102.22':139
'20#.#50.214.9':445
'20#.#50.179.249':445
'20#.#50.28.186':445
'20#.#50.105.21':445
'20#.#50.122.93':9988
'20#.#50.34.61':445
'20#.#50.245.148':445
'20#.#50.142.16':445
'20#.#50.60.142':445
'20#.#50.85.62':445
'20#.#50.130.129':445
'20#.#50.209.58':445
'20#.#50.106.235':445
'20#.#50.245.226':445
'20#.#50.112.39':445
'20#.#50.164.117':445
'20#.#50.246.72':445
'20#.#50.39.244':445
'20#.#50.156.184':445
'20#.#50.115.19':445
'20#.#50.16.130':445
'20#.#50.78.219':445
'20#.#50.28.159':445
'20#.#50.31.163':9988
'20#.#50.15.171':9988
'20#.#50.69.139':445
'20#.#50.202.142':445
'20#.#50.48.96':9988
'20#.#50.125.62':9988
'20#.#50.4.66':9988
'20#.#50.39.244':9988
'20#.#50.18.215':9988
'20#.#50.117.4':445
'20#.#50.20.196':445
'20#.#50.7.211':445
'20#.#50.27.27':445
'20#.#50.183.220':445
'20#.#50.115.70':445
'20#.#50.178.44':445
'20#.#50.207.183':445
'20#.#50.116.115':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней