Trojan.Starman.5936

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1aed.dir00\svchost.exe.mdmp 16325836412028956

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1aed.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'21#.#8.81.96':445
'21#.#8.86.154':445
'21#.78.20.1':445
'21#.#8.177.105':445
'21#.#8.103.251':445
'21#.#8.32.218':445
'21#.#8.99.134':445
'21#.78.64.4':445
'21#.#8.226.30':445
'21#.#8.0.217':445
'21#.#8.167.28':445
'21#.#8.151.162':445
'21#.#8.53.194':445
'21#.#8.204.95':445
'21#.#8.45.136':445
'21#.#8.207.235':445
'21#.#8.95.53':445
'21#.#8.98.95':445
'21#.#8.175.103':445
'21#.#8.136.37':445
'21#.#8.12.137':445
'21#.#8.66.12':445
'21#.#8.33.96':445
'21#.#8.241.26':445
'21#.#8.128.234':445
'21#.#8.140.19':139
'21#.#8.70.246':139
'21#.#8.105.112':139
'21#.#8.201.47':139
'21#.#8.77.49':139
'21#.#8.240.170':139
'21#.#8.245.117':445
'21#.#8.35.254':445
'21#.#8.77.132':445
'21#.#8.146.57':139
'21#.#8.115.218':445
'21#.#8.85.82':445
'21#.78.5.52':139
'21#.#8.35.254':139
'21#.#8.77.132':139
'21#.#8.105.122':139
'21#.#8.115.218':139
'21#.#8.85.82':139
'21#.#8.245.117':139
'21#.#8.174.6':139
'21#.#8.35.174':139
'21#.#8.213.174':139
'21#.#8.8.106':139
'21#.#8.38.46':139
'21#.#8.68.92':139
'21#.#8.19.32':139
'21#.#8.189.72':139
'21#.#8.53.227':139
'21#.#8.227.160':139
'21#.#8.109.180':139
'21#.#8.87.86':139
'21#.#8.204.95':139
'21#.#8.45.136':139
'21#.#8.207.235':139
'21#.#8.95.53':139
'21#.#8.98.95':139
'21#.#8.175.103':139
'21#.#8.25.152':445
'21#.#8.88.136':445
'21#.#8.111.188':445
'21#.#8.48.177':445
'21#.#8.105.188':445
'21#.#8.75.22':445
'21#.#8.63.34':445
'21#.#8.174.171':445
'21#.#8.167.174':445
'21#.#8.217.167':445
'21#.#8.84.203':445
'21#.#8.131.62':445
'21#.#8.27.166':445
'21#.#8.99.134':139
'21#.78.64.4':139
'21#.#8.226.30':139
'21#.#8.0.217':139
'21#.#8.167.28':139
'21#.#8.151.162':139
'21#.#8.19.32':445
'21#.#8.189.72':445
'21#.#8.53.227':445
'21#.#8.227.160':445
'21#.#8.109.180':445
'21#.#8.87.86':445
'21#.78.20.1':139
'21#.#8.136.37':139
'21#.#8.12.137':139
'21#.#8.66.12':139
'21#.#8.33.96':139
'21#.#8.241.26':139
'21#.#8.128.234':139
'21#.#8.32.218':139
'21#.#8.81.96':139
'21#.#8.86.154':139
'21#.#8.53.194':139
'21#.#8.177.105':139
'21#.#8.103.251':139
'21#.#8.155.146':445
'21#.#8.165.155':445
'21#.#8.7.160':445
'21#.#8.130.42':445
'21#.#8.70.183':445
'21#.#8.185.40':445
'21#.#8.132.94':445
'21#.#8.88.230':445
'21#.#8.15.18':445
'21#.#8.6.156':445
'21#.#8.84.46':445
'21#.#8.76.182':445
'21#.#8.4.128':445
'21#.#8.218.158':445
'21#.#8.8.129':445
'21#.#8.204.129':445
'21#.#8.38.146':445
'21#.#8.159.110':445
'21#.#8.111.11':445
'21#.#8.11.41':445
'21#.#8.175.10':445
'21#.#8.23.222':445
'21#.#8.162.77':445
'21#.#8.41.60':445
'21#.#8.83.30':445
'21#.#8.48.221':139
'21#.#8.145.50':139
'21#.#8.120.145':139
'21#.#8.80.247':139
'21#.#8.189.75':139
'21#.#8.12.95':139
'21#.#8.148.73':445
'21#.#8.187.66':445
'21#.#8.50.187':445
'21#.#8.182.120':139
'21#.#8.147.188':139
'21#.78.6.43':139
'21#.#8.129.110':139
'21#.#8.187.66':139
'21#.#8.50.187':139
'21#.#8.178.120':139
'21#.#8.68.232':445
'21#.#8.124.141':445
'21#.#8.148.73':139
'21#.#8.169.33':139
'21#.#8.44.109':139
'21#.#8.142.59':139
'21#.#8.239.20':139
'21#.#8.14.187':139
'21#.#8.33.28':139
'21#.#8.27.91':139
'21#.#8.145.122':139
'21#.#8.38.146':139
'21#.#8.105.112':445
'21#.#8.146.57':445
'21#.#8.56.37':139
'21#.#8.218.158':139
'21#.#8.8.129':139
'21#.#8.204.129':139
'21#.#8.45.132':139
'21#.#8.111.11':139
'21#.#8.159.110':139
'21#.#8.70.246':445
'21#.#8.68.92':445
'21#.#8.174.6':445
'21#.#8.35.174':445
'21#.#8.105.122':445
'21#.#8.8.106':445
'21#.#8.38.46':445
'21#.#8.77.49':445
'21#.#8.240.170':445
'21#.#8.140.19':445
'21#.#8.213.174':445
'21#.78.5.52':445
'21#.#8.201.47':445
'21#.#8.132.94':139
'21#.#8.88.230':139
'21#.#8.15.18':139
'21#.#8.6.156':139
'21#.#8.84.46':139
'21#.#8.76.182':139
'21#.#8.27.91':445
'21#.#8.145.122':445
'21#.#8.45.132':445
'21#.#8.68.232':139
'21#.#8.124.141':139
'21#.#8.56.37':445
'21#.#8.7.160':139
'21#.#8.11.41':139
'21#.#8.175.10':139
'21#.#8.23.222':139
'21#.#8.162.77':139
'21#.#8.83.30':139
'21#.#8.41.60':139
'21#.#8.185.40':139
'21#.#8.155.146':139
'21#.#8.165.155':139
'21#.#8.4.128':139
'21#.#8.130.42':139
'21#.#8.70.183':139
'21#.#8.116.62':445
'21#.#8.70.208':445
'21#.#8.52.60':445
'21#.78.89.5':445
'21#.#8.216.152':445
'21#.#8.149.239':445
'21#.#8.1.123':445
'21#.#8.166.127':445
'21#.#8.28.210':445
'21#.#8.1.179':445
'21#.#8.232.215':445
'21#.#8.120.148':445
'21#.#8.240.49':445
'21#.#8.153.224':445
'21#.#8.217.75':445
'21#.#8.94.140':445
'21#.#8.41.217':445
'21#.#8.10.56':139
'21#.#8.196.41':445
'21#.#8.85.110':445
'21#.#8.185.48':445
'21#.#8.80.204':445
'21#.#8.124.57':445
'21#.#8.127.45':445
'21#.#8.58.196':445
'21#.#8.172.227':445
'21#.#8.65.199':445
'21#.#8.137.95':445
'21#.#8.245.136':445
'21#.#8.89.81':445
'21#.#8.126.177':445
'21#.#8.24.64':445
'21#.#8.104.234':445
'21#.#8.175.178':445
'21#.#8.135.34':445
'21#.#8.237.57':445
'21#.#8.216.34':445
'21#.#8.138.48':445
'21#.#8.35.156':445
'21#.#8.188.14':445
'21#.#8.16.188':445
'21#.#8.71.57':445
'21#.#8.105.51':445
'21#.#8.226.104':445
'21#.#8.14.226':445
'21#.#8.121.149':445
'21#.#8.63.111':445
'21#.#8.216.177':445
'21#.#8.171.120':445
'21#.#8.119.171':445
'21#.#8.142.240':445
'21#.#8.52.60':139
'21#.78.89.5':139
'21#.#8.232.215':139
'21#.#8.149.239':139
'21#.#8.1.123':139
'21#.#8.70.208':139
'21#.#8.28.210':139
'21#.#8.1.179':139
'21#.#8.105.51':139
'21#.#8.120.148':139
'21#.#8.240.49':139
'21#.#8.166.127':139
'21#.#8.216.152':139
'21#.#8.127.45':139
'21#.#8.196.41':139
'21#.#8.85.110':139
'21#.#8.58.196':139
'21#.#8.41.217':139
'21#.#8.217.75':139
'21#.#8.80.204':139
'21#.#8.124.57':139
'21#.#8.153.224':139
'21#.#8.94.140':139
'21#.#8.172.227':139
'21#.#8.185.48':139
'21#.#8.137.95':139
'21#.#8.245.136':139
'21#.#8.237.57':139
'21#.#8.126.177':139
'21#.#8.24.64':139
'21#.#8.65.199':139
'21#.#8.175.178':139
'21#.#8.135.34':139
'21#.#8.9.238':139
'21#.#8.216.34':139
'21#.#8.138.48':139
'21#.#8.104.234':139
'21#.#8.35.156':139
'21#.#8.16.188':139
'21#.#8.71.57':139
'21#.#8.171.120':139
'21#.#8.226.104':139
'21#.#8.14.226':139
'21#.#8.188.14':139
'21#.#8.63.111':139
'21#.#8.216.177':139
'21#.#8.89.81':139
'21#.#8.119.171':139
'21#.#8.142.240':139
'21#.#8.121.149':139
'21#.#8.39.58':445
'21#.#8.137.106':445
'21#.#8.193.240':445
'21#.#8.223.116':445
'21#.#8.84.128':445
'21#.#8.136.231':445
'21#.#8.103.3':445
'21#.#8.53.224':445
'21#.#8.27.132':139
'21#.#8.37.213':445
'21#.#8.39.244':445
'21#.#8.136.218':445
'21#.#8.229.65':445
'21#.#8.44.204':445
'21#.#8.90.105':445
'21#.#8.58.144':445
'21#.#8.193.37':445
'21#.#8.99.21':445
'21#.#8.203.204':445
'21#.#8.158.252':445
'21#.#8.87.53':445
'21#.#8.222.228':445
'21#.#8.92.62':445
'21#.#8.191.119':445
'21#.#8.252.190':445
'21#.#8.167.174':139
'21#.#8.217.167':139
'21#.#8.25.152':139
'21#.#8.131.62':139
'21#.#8.27.166':139
'21#.#8.174.171':139
'21#.#8.82.138':445
'21#.#8.15.63':445
'21#.#8.62.27':445
'21#.#8.27.132':445
'21#.#8.189.138':445
'21#.#8.113.6':445
'21#.#8.84.203':139
'21#.#8.15.63':139
'21#.#8.62.27':139
'21#.#8.116.62':139
'21#.#8.189.138':139
'21#.#8.113.6':139
'21#.#8.82.138':139
'21#.#8.88.136':139
'21#.#8.111.188':139
'21#.#8.48.177':139
'21#.#8.105.188':139
'21#.#8.75.22':139
'21#.#8.63.34':139
'21#.#8.16.113':139
'21#.#8.200.70':139
'21#.#8.193.37':139
'21#.#8.95.148':139
'21#.#8.8.228':139
'21#.#8.167.234':139
'21#.#8.203.204':139
'21#.#8.44.204':139
'21#.#8.58.144':139
'21#.#8.146.159':139
'21#.#8.90.105':139
'21#.#8.99.21':139
'21#.#8.61.219':139
'21#.#8.127.45':9988
'21#.#8.153.224':9988
'21#.#8.1.123':9988
'21#.#8.9.238':445
'21#.#8.10.56':445
'21#.#8.41.217':9988
'21#.#8.14.226':9988
'21#.#8.188.14':9988
'21#.#8.171.120':9988
'21#.#8.70.208':9988
'21#.#8.1.179':9988
'21#.#8.226.104':9988
'21#.#8.103.3':139
'21#.#8.53.224':139
'21#.#8.61.219':445
'21#.#8.37.213':139
'21#.#8.39.244':139
'21#.#8.136.218':139
'21#.#8.16.113':445
'21#.#8.200.70':445
'21#.#8.146.159':445
'21#.#8.95.148':445
'21#.#8.8.228':445
'21#.#8.167.234':445
'21#.#8.193.240':139
'21#.#8.158.252':139
'21#.#8.87.53':139
'21#.#8.222.228':139
'21#.#8.92.62':139
'21#.#8.191.119':139
'21#.#8.252.190':139
'21#.#8.136.231':139
'21#.#8.39.58':139
'21#.#8.137.106':139
'21#.#8.229.65':139
'21#.#8.223.116':139
'21#.#8.84.128':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней