Trojan.Starman.5294

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERcd77.dir00\svchost.exe.mdmp 16325836412032252

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERcd77.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'24.##8.29.124':139
'24.##8.136.153':139
'24.##8.242.55':139
'24.##8.117.31':139
'24.##8.90.94':445
'24.##8.117.31':445
'24.##8.29.124':445
'24.##8.17.229':445
'24.##8.242.55':445
'24.##8.17.229':139
'24.##8.56.173':445
'24.##8.119.56':445
'24.##8.123.202':445
'24.#38.57.1':445
'24.##8.85.119':445
'24.##8.104.251':445
'24.##8.90.94':139
'24.##8.100.85':445
'24.##8.228.208':445
'24.##8.35.164':139
'24.##8.115.169':139
'24.##8.214.35':139
'24.##8.14.224':139
'24.##8.66.169':139
'24.##8.97.78':139
'24.##8.17.33':139
'24.##8.152.251':139
'24.##8.108.72':139
'24.##8.36.154':139
'24.##8.255.103':139
'24.##8.61.108':139
'24.##8.136.153':445
'24.##8.103.136':139
'24.##8.56.157':139
'24.##8.28.41':139
'24.##8.12.198':139
'24.##8.226.169':139
'24.##8.10.196':139
'24.##8.202.165':445
'24.##8.190.61':445
'24.##8.62.92':445
'24.##8.150.66':445
'24.##8.36.36':445
'24.##8.15.60':445
'24.##8.106.32':445
'24.##8.184.46':445
'24.##8.150.15':445
'24.##8.94.149':445
'24.##8.75.14':445
'24.##8.75.55':445
'24.##8.69.19':445
'24.##8.228.208':139
'24.##8.104.251':139
'24.##8.223.228':445
'24.##8.231.4':445
'24.##8.11.202':445
'24.##8.189.71':445
'24.##8.47.120':445
'24.##8.172.105':445
'24.##8.79.74':445
'24.##8.70.241':445
'24.##8.143.109':445
'24.##8.86.238':445
'24.##8.70.160':445
'24.##8.42.12':445
'24.##8.80.86':445
'24.##8.12.80':445
'24.##8.240.250':445
'24.##8.236.6':445
'24.##8.59.176':445
'24.##8.75.189':445
'24.##8.108.17':445
'24.##8.236.184':445
'24.##8.10.24':445
'24.##8.250.79':445
'24.##8.15.156':445
'24.##8.72.229':445
'24.##8.24.17':139
'24.##8.153.157':445
'24.##8.138.232':445
'24.##8.233.82':445
'24.##8.157.209':445
'24.##8.197.201':445
'24.##8.66.203':445
'24.##8.255.176':445
'24.##8.201.223':445
'24.##8.244.201':445
'24.##8.35.39':445
'24.##8.108.72':445
'24.##8.97.78':445
'24.##8.66.169':445
'24.##8.152.251':445
'24.##8.17.33':445
'24.##8.153.221':445
'24.##8.244.202':445
'24.##8.24.17':445
'24.##8.225.23':445
'24.##8.19.239':445
'24.##8.49.148':139
'24.##8.105.163':445
'24.##8.182.105':445
'24.##8.114.94':139
'24.##8.97.80':139
'24.##8.78.28':139
'24.##8.93.233':139
'24.##8.154.135':139
'24.##8.162.188':445
'24.##8.110.163':445
'24.##8.191.110':445
'24.##8.10.89':445
'24.##8.217.31':445
'24.##8.70.150':445
'24.##8.126.220':445
'24.##8.58.27':445
'24.##8.29.191':445
'24.##8.123.107':445
'24.##8.115.169':445
'24.##8.255.176':139
'24.##8.10.89':139
'24.##8.244.201':139
'24.##8.66.203':139
'24.##8.217.31':139
'24.##8.70.150':139
'24.##8.29.191':139
'24.##8.110.163':139
'24.##8.191.110':139
'24.##8.201.223':139
'24.##8.244.202':139
'24.##8.35.39':139
'24.##8.225.23':139
'24.##8.153.221':139
'24.##8.233.82':139
'24.##8.138.232':139
'24.##8.197.201':139
'24.##8.157.209':139
'24.##8.153.157':139
'24.##8.10.196':445
'24.##8.28.41':445
'24.##8.56.157':445
'24.##8.226.169':445
'24.##8.12.198':445
'24.##8.14.224':445
'24.##8.35.164':445
'24.##8.36.154':445
'24.##8.214.35':445
'24.##8.61.108':445
'24.##8.58.27':139
'24.##8.162.188':139
'24.##8.123.107':139
'24.##8.126.220':139
'24.##8.105.163':139
'24.##8.103.136':445
'24.##8.255.103':445
'24.##8.182.105':139
'24.##8.19.239':139
'24.##8.100.85':139
'24.##8.166.128':445
'24.##8.54.113':445
'24.##8.255.58':139
'24.##8.238.254':139
'24.##8.114.26':445
'24.##8.231.77':445
'24.##8.138.134':445
'24.##8.42.55':445
'24.##8.22.141':445
'24.##8.58.83':139
'24.##8.164.234':139
'24.#38.1.35':139
'24.##8.140.15':139
'24.##8.183.165':139
'24.##8.224.0':139
'24.##8.62.180':139
'24.##8.58.60':139
'24.##8.18.148':139
'24.#38.4.49':139
'24.##8.2.103':445
'24.##8.95.191':445
'24.##8.92.115':445
'24.##8.214.92':445
'24.##8.66.13':445
'24.##8.31.74':445
'24.##8.214.209':445
'24.##8.172.146':445
'24.##8.78.172':445
'24.##8.116.28':445
'24.##8.140.4':445
'24.##8.57.108':445
'24.##8.174.205':445
'24.##8.4.178':445
'24.##8.9.128':445
'24.##8.199.243':445
'24.##8.84.138':445
'24.##8.205.9':445
'24.##8.132.217':445
'24.##8.157.77':139
'24.##8.205.9':139
'24.##8.132.217':139
'24.##8.57.108':139
'24.##8.9.128':139
'24.##8.199.243':139
'24.##8.92.115':139
'24.##8.214.92':139
'24.##8.84.138':139
'24.##8.116.28':139
'24.##8.140.4':139
'24.##8.54.113':139
'24.##8.42.55':139
'24.##8.166.128':139
'24.##8.114.26':139
'24.##8.22.141':139
'24.##8.174.205':139
'24.##8.4.178':139
'24.##8.231.77':139
'24.##8.138.134':139
'24.##8.108.82':139
'24.##8.251.48':139
'24.##8.85.246':139
'24.##8.123.26':139
'24.##8.28.168':139
'24.##8.27.143':139
'24.##8.16.180':139
'24.##8.106.44':139
'24.##8.85.140':139
'24.##8.92.219':139
'24.##8.66.13':139
'24.##8.172.146':139
'24.##8.2.103':139
'24.##8.95.191':139
'24.##8.78.172':139
'24.##8.25.221':139
'24.##8.29.10':139
'24.##8.31.74':139
'24.##8.214.209':139
'24.##8.25.221':445
'24.##8.184.46':139
'24.##8.75.189':139
'24.##8.94.149':139
'24.##8.106.32':139
'24.##8.108.17':139
'24.##8.236.184':139
'24.##8.15.156':139
'24.##8.236.6':139
'24.##8.59.176':139
'24.##8.150.15':139
'24.##8.11.202':139
'24.##8.75.14':139
'24.##8.47.120':139
'24.##8.231.4':139
'24.##8.150.66':139
'24.##8.62.92':139
'24.##8.15.60':139
'24.##8.36.36':139
'24.##8.190.61':139
'24.##8.42.12':139
'24.##8.202.165':139
'24.##8.12.80':139
'24.##8.70.160':139
'24.##8.123.202':139
'24.##8.119.56':139
'24.##8.85.119':139
'24.#38.57.1':139
'24.##8.56.173':139
'24.##8.80.86':139
'24.##8.250.79':139
'24.##8.240.250':139
'24.##8.72.229':139
'24.##8.10.24':139
'24.##8.70.241':139
'24.##8.79.74':139
'24.##8.86.238':139
'24.##8.143.109':139
'24.##8.172.105':139
'24.##8.189.71':139
'24.##8.140.15':445
'24.##8.183.165':445
'24.##8.16.180':445
'24.##8.157.77':445
'24.##8.164.234':445
'24.##8.18.148':445
'24.#38.4.49':445
'24.#38.1.35':445
'24.##8.224.0':445
'24.##8.27.143':445
'24.##8.85.246':445
'24.##8.123.26':445
'24.##8.29.10':445
'24.##8.92.219':445
'24.##8.108.82':445
'24.##8.106.44':445
'24.##8.85.140':445
'24.##8.251.48':445
'24.##8.28.168':445
'24.##8.66.13':9988
'24.##8.172.146':9988
'24.##8.2.103':9988
'24.##8.95.191':9988
'24.##8.28.168':9988
'24.##8.69.19':139
'24.##8.223.228':139
'24.##8.164.234':9988
'24.##8.75.55':139
'24.##8.205.9':9988
'24.##8.58.83':445
'24.##8.255.58':445
'24.##8.62.180':445
'24.##8.58.60':445
'24.##8.238.254':445
'24.##8.231.77':9988
'24.##8.138.134':9988
'24.##8.42.55':9988
'24.##8.22.141':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней