Trojan.Starman.5302

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3aac.dir00\svchost.exe.mdmp 16325836412032252

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3aac.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.#29.36.3':445
'64.##9.198.46':139
'64.##9.66.240':445
'64.##9.30.208':445
'64.##9.157.198':139
'64.##9.159.111':139
'64.##9.222.251':139
'64.##9.104.38':139
'64.##9.138.227':139
'64.##9.0.213':445
'64.##9.76.127':445
'64.##9.15.30':445
'64.##9.128.26':445
'64.##9.38.113':445
'64.##9.128.102':445
'64.##9.4.215':445
'64.##9.112.218':445
'64.##9.92.33':445
'64.##9.215.46':445
'64.##9.203.52':139
'64.##9.136.7':139
'64.##9.37.156':139
'64.##9.226.98':139
'64.##9.127.136':139
'64.##9.137.7':139
'64.##9.40.16':139
'64.##9.203.126':139
'64.##9.100.183':139
'64.##9.80.185':139
'64.##9.160.241':139
'64.##9.42.62':139
'64.##9.122.57':139
'64.##9.240.216':139
'64.##9.103.244':139
'64.##9.198.228':139
'64.##9.246.120':139
'64.##9.97.20':139
'64.##9.152.123':139
'64.##9.151.223':445
'64.##9.80.166':445
'64.##9.176.78':445
'64.##9.156.35':445
'64.##9.168.187':445
'64.#29.1.61':445
'64.##9.88.145':445
'64.##9.135.235':445
'64.##9.33.185':445
'64.##9.17.77':445
'64.##9.10.251':445
'64.##9.117.179':445
'64.##9.42.113':445
'64.#29.36.3':139
'64.##9.254.87':445
'64.##9.45.108':445
'64.##9.65.30':445
'64.##9.163.246':445
'64.##9.163.140':445
'64.##9.218.6':445
'64.##9.3.144':445
'64.#29.5.11':445
'64.##9.185.147':445
'64.##9.17.119':445
'64.##9.7.243':445
'64.##9.91.190':445
'64.##9.180.139':445
'64.##9.22.51':445
'64.##9.132.21':445
'64.##9.221.116':445
'64.##9.47.149':445
'64.##9.34.244':445
'64.##9.10.127':445
'64.##9.16.44':445
'64.##9.98.69':445
'64.##9.51.198':445
'64.##9.204.70':445
'64.##9.130.12':445
'64.##9.25.21':445
'64.##9.201.195':445
'64.##9.32.114':445
'64.##9.137.7':445
'64.##9.40.16':445
'64.##9.101.107':445
'64.##9.222.207':445
'64.##9.79.31':445
'64.##9.59.221':445
'64.##9.190.137':445
'64.##9.100.183':445
'64.##9.80.185':445
'64.##9.37.156':445
'64.##9.198.228':445
'64.##9.246.120':445
'64.##9.226.98':445
'64.##9.127.136':445
'64.##9.203.126':445
'64.##9.203.52':445
'64.##9.136.7':445
'64.##9.131.223':445
'64.##9.133.132':445
'64.##9.35.198':445
'64.##9.223.165':445
'64.##9.56.118':445
'64.##9.112.44':445
'64.##9.9.135':445
'64.##9.167.79':445
'64.##9.129.120':445
'64.##9.226.63':445
'64.##9.201.187':445
'64.##9.142.239':445
'64.##9.70.102':445
'64.##9.230.222':445
'64.##9.244.8':445
'64.##9.95.57':445
'64.##9.83.183':445
'64.##9.65.150':445
'64.##9.78.121':445
'64.##9.152.123':445
'64.##9.65.150':139
'64.##9.78.121':139
'64.##9.142.239':139
'64.##9.244.8':139
'64.##9.95.57':139
'64.##9.35.198':139
'64.##9.223.165':139
'64.##9.83.183':139
'64.##9.226.63':139
'64.##9.201.187':139
'64.##9.101.107':139
'64.##9.59.221':139
'64.##9.201.195':139
'64.##9.32.114':139
'64.##9.190.137':139
'64.##9.70.102':139
'64.##9.230.222':139
'64.##9.222.207':139
'64.##9.79.31':139
'64.##9.222.251':445
'64.##9.122.57':445
'64.##9.138.227':445
'64.##9.159.111':445
'64.##9.240.216':445
'64.##9.103.244':445
'64.##9.97.20':445
'64.##9.160.241':445
'64.##9.42.62':445
'64.##9.104.38':445
'64.##9.56.118':139
'64.##9.167.79':139
'64.##9.131.223':139
'64.##9.133.132':139
'64.##9.129.120':139
'64.##9.198.46':445
'64.##9.157.198':445
'64.##9.112.44':139
'64.##9.9.135':139
'64.##9.30.208':139
'64.##9.240.182':445
'64.##9.183.101':445
'64.##9.190.30':139
'64.##9.170.249':139
'64.##9.124.178':445
'64.##9.121.217':445
'64.##9.130.121':445
'64.##9.217.239':445
'64.##9.60.20':445
'64.##9.30.167':139
'64.##9.78.76':139
'64.##9.112.59':139
'64.##9.215.42':139
'64.##9.75.215':139
'64.##9.119.212':139
'64.##9.72.164':139
'64.##9.89.140':139
'64.##9.37.194':139
'64.#29.41.6':139
'64.##9.19.235':445
'64.##9.210.242':445
'64.##9.140.3':445
'64.##9.62.29':445
'64.##9.37.45':445
'64.##9.244.27':445
'64.##9.85.72':445
'64.##9.143.37':445
'64.##9.38.190':445
'64.##9.168.169':445
'64.##9.106.109':445
'64.##9.126.31':445
'64.##9.104.49':445
'64.##9.54.35':445
'64.#29.0.34':445
'64.##9.163.182':445
'64.##9.169.140':445
'64.##9.118.51':445
'64.##9.223.216':445
'64.##9.148.156':139
'64.##9.118.51':139
'64.##9.223.216':139
'64.##9.126.31':139
'64.#29.0.34':139
'64.##9.163.182':139
'64.##9.140.3':139
'64.##9.62.29':139
'64.##9.169.140':139
'64.##9.168.169':139
'64.##9.106.109':139
'64.##9.183.101':139
'64.##9.124.178':139
'64.##9.60.20':139
'64.##9.240.182':139
'64.##9.217.239':139
'64.##9.104.49':139
'64.##9.54.35':139
'64.##9.121.217':139
'64.##9.130.121':139
'64.##9.14.204':139
'64.##9.37.14':139
'64.##9.21.166':139
'64.#29.60.4':139
'64.##9.61.247':139
'64.##9.173.250':139
'64.##9.144.81':139
'64.##9.163.196':139
'64.##9.79.219':139
'64.##9.172.108':139
'64.##9.37.45':139
'64.##9.143.37':139
'64.##9.19.235':139
'64.##9.210.242':139
'64.##9.38.190':139
'64.##9.72.105':139
'64.##9.174.159':139
'64.##9.244.27':139
'64.##9.85.72':139
'64.##9.130.12':139
'64.##9.25.21':139
'64.##9.34.244':139
'64.##9.98.69':139
'64.##9.51.198':139
'64.##9.185.147':139
'64.##9.17.119':139
'64.##9.204.70':139
'64.##9.221.116':139
'64.##9.47.149':139
'64.#29.1.61':139
'64.##9.33.185':139
'64.##9.80.166':139
'64.##9.176.78':139
'64.##9.17.77':139
'64.##9.10.127':139
'64.##9.16.44':139
'64.##9.88.145':139
'64.##9.135.235':139
'64.##9.128.102':139
'64.##9.92.33':139
'64.##9.76.127':139
'64.##9.15.30':139
'64.##9.215.46':139
'64.##9.0.213':139
'64.##9.66.240':139
'64.##9.4.215':139
'64.##9.112.218':139
'64.##9.38.113':139
'64.##9.7.243':139
'64.##9.22.51':139
'64.##9.3.144':139
'64.#29.5.11':139
'64.##9.132.21':139
'64.##9.151.223':139
'64.##9.128.26':139
'64.##9.91.190':139
'64.##9.180.139':139
'64.##9.168.187':139
'64.##9.148.156':445
'64.##9.215.42':445
'64.##9.173.250':445
'64.##9.144.81':445
'64.##9.75.215':445
'64.##9.119.212':445
'64.##9.37.194':445
'64.##9.78.76':445
'64.##9.112.59':445
'64.##9.79.219':445
'64.##9.172.108':445
'64.##9.21.166':445
'64.##9.72.105':445
'64.##9.174.159':445
'64.#29.60.4':445
'64.##9.61.247':445
'64.##9.163.196':445
'64.##9.14.204':445
'64.##9.37.14':445
'64.##9.45.108':139
'64.##9.163.140':139
'64.##9.117.179':139
'64.##9.42.113':139
'64.##9.218.6':139
'64.##9.10.251':139
'64.##9.156.35':139
'64.##9.65.30':139
'64.##9.163.246':139
'64.##9.254.87':139
'64.##9.89.140':445
'64.##9.30.167':445
'64.#29.41.6':445
'64.##9.72.164':445
'64.##9.190.30':445
'64.##9.168.169':9988
'64.##9.62.29':9988
'64.##9.170.249':445
'64.##9.169.140':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней