Trojan.Starman.5973

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3571.dir00\svchost.exe.mdmp 16325836412032164

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3571.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14.##.54.157':139
'14.##.130.250':139
'14.##.133.246':139
'14.##.120.49':139
'14.##.241.57':139
'14.#9.182.3':139
'14.##.107.75':139
'14.#9.3.229':139
'14.##.88.136':139
'14.#9.0.9':139
'14.##.83.155':139
'14.##.106.137':139
'14.#9.57.4':139
'14.##.205.241':139
'14.##.20.131':139
'14.##.165.175':139
'14.##.59.175':139
'14.##.91.164':139
'14.##.120.181':139
'14.##.47.157':139
'14.##.241.129':139
'14.##.116.101':139
'14.##.106.137':445
'14.#9.57.4':445
'14.##.205.241':445
'14.##.20.131':445
'14.##.165.175':445
'14.##.59.175':445
'14.##.91.164':445
'14.##.120.181':445
'14.##.47.157':445
'14.##.241.129':445
'14.##.174.186':445
'14.##.19.107':139
'14.##.239.227':139
'14.##.37.169':139
'14.##.203.65':139
'14.##.168.219':139
'14.##.230.38':445
'14.#9.2.151':445
'14.##.38.206':445
'14.##.200.185':139
'14.##.12.164':445
'14.##.174.186':139
'14.#9.81.14':139
'14.##.248.80':139
'14.##.13.166':139
'14.##.185.26':139
'14.##.172.83':139
'14.#9.87.67':139
'14.#9.93.43':139
'14.#9.65.34':139
'14.##.131.135':139
'14.#9.40.13':139
'14.##.130.223':139
'14.##.53.200':139
'14.#9.83.71':139
'14.##.158.138':445
'14.##.162.112':445
'14.##.138.243':445
'14.##.35.152':139
'14.#9.19.35':139
'14.##.195.162':139
'14.##.33.214':139
'14.##.132.33':139
'14.##.53.200':445
'14.#9.65.34':445
'14.#9.87.67':445
'14.#9.40.13':445
'14.##.248.80':445
'14.##.131.135':445
'14.##.230.38':139
'14.#9.2.151':139
'14.##.38.206':139
'14.#9.93.43':445
'14.##.12.164':139
'14.#9.81.14':445
'14.##.195.162':445
'14.##.35.152':445
'14.##.132.33':445
'14.#9.83.71':445
'14.##.33.214':445
'14.##.172.83':445
'14.##.13.166':445
'14.##.185.26':445
'14.#9.19.35':445
'14.##.130.223':445
'14.##.63.127':139
'14.#9.121.1':139
'14.#9.7.213':139
'14.#9.77.7':139
'14.##.146.48':139
'14.##.153.117':139
'14.##.192.196':139
'14.##.229.28':139
'14.##.69.100':139
'14.##.25.187':139
'14.##.196.224':139
'14.##.23.165':445
'14.##.130.83':445
'14.##.93.205':445
'14.##.254.10':445
'14.##.204.207':445
'14.##.169.71':445
'14.#9.99.5':445
'14.##.157.55':445
'14.##.249.184':445
'14.##.54.249':445
'14.##.179.133':139
'14.##.162.114':139
'14.#9.85.4':139
'14.#9.114.2':139
'14.##.115.88':139
'14.##.230.11':139
'14.##.68.106':139
'14.##.14.219':139
'14.##.249.25':139
'14.#9.31.90':139
'14.##.16.158':139
'14.##.219.209':139
'14.#9.49.0':139
'14.#9.55.64':139
'14.##.208.196':139
'14.##.233.181':139
'14.##.147.129':139
'14.##.102.72':139
'14.#9.12.67':139
'14.##.211.146':139
'14.##.16.208':139
'14.##.39.133':139
'14.##.149.109':445
'14.##.37.169':445
'14.##.19.107':445
'14.##.168.219':445
'14.##.116.101':445
'14.##.203.65':445
'14.##.73.108':139
'14.##.222.73':139
'14.##.107.127':139
'14.##.239.227':445
'14.##.200.185':445
'14.##.107.75':445
'14.##.133.246':445
'14.##.54.157':445
'14.##.241.57':445
'14.##.83.155':445
'14.##.120.49':445
'14.#9.3.229':445
'14.#9.182.3':445
'14.#9.0.9':445
'14.##.130.250':445
'14.##.88.136':445
'14.##.212.29':139
'14.##.107.127':445
'14.##.73.108':445
'14.#9.99.5':139
'14.##.157.55':139
'14.##.169.71':139
'14.##.56.235':445
'14.##.215.168':445
'14.##.238.81':445
'14.##.222.73':445
'14.##.212.29':445
'14.##.54.249':139
'14.##.149.109':139
'14.##.254.10':139
'14.##.215.168':139
'14.##.238.81':139
'14.##.56.235':139
'14.##.130.83':139
'14.##.249.184':139
'14.##.23.165':139
'14.##.204.207':139
'14.##.93.205':139
'14.#9.51.0':445
'14.##.120.39':445
'14.#9.60.32':445
'14.##.13.209':445
'14.##.31.224':445
'14.##.56.189':445
'14.##.206.78':445
'14.##.14.162':445
'14.##.185.102':445
'14.##.194.15':445
'14.##.59.112':445
'14.##.96.172':139
'14.##.84.178':139
'14.##.138.110':139
'14.##.215.195':139
'14.##.37.115':139
'14.##.207.40':445
'14.##.223.171':445
'14.##.40.176':445
'14.##.144.37':139
'14.##.67.144':139
'14.#9.43.13':445
'14.#9.8.36':445
'14.##.154.127':445
'14.##.189.78':445
'14.##.33.102':445
'14.##.31.123':445
'14.##.136.148':445
'14.##.158.225':445
'14.##.14.113':445
'14.##.139.206':445
'14.##.43.137':445
'14.##.140.173':445
'14.##.188.127':445
'14.##.162.124':445
'14.#9.7.80':445
'14.#9.4.80':445
'14.##.70.126':445
'14.#9.76.37':445
'14.##.173.76':445
'14.##.191.113':445
'14.##.155.21':445
'14.##.71.205':445
'14.##.89.143':139
'14.#9.43.13':139
'14.#9.4.80':139
'14.##.206.78':139
'14.##.14.162':139
'14.##.56.189':139
'14.##.162.124':139
'14.##.155.21':139
'14.##.188.127':139
'14.##.70.126':139
'14.#9.7.80':139
'14.##.194.15':139
'14.##.59.112':139
'14.##.223.171':139
'14.##.13.209':139
'14.##.40.176':139
'14.##.207.40':139
'14.##.120.39':139
'14.##.185.102':139
'14.#9.51.0':139
'14.##.31.224':139
'14.#9.60.32':139
'14.##.71.205':139
'14.##.216.89':139
'14.##.250.244':139
'14.##.158.225':139
'14.##.14.113':139
'14.##.136.148':139
'14.##.87.161':139
'14.##.198.10':139
'14.#9.18.54':139
'14.##.44.123':139
'14.##.104.127':139
'14.##.43.137':139
'14.##.140.173':139
'14.##.33.102':139
'14.##.173.76':139
'14.##.191.113':139
'14.#9.76.37':139
'14.##.154.127':139
'14.##.139.206':139
'14.#9.8.36':139
'14.##.31.123':139
'14.##.189.78':139
'14.##.105.120':445
'14.##.20.151':445
'14.##.59.220':445
'14.##.138.243':139
'14.##.158.138':139
'14.#9.0.38':445
'14.#9.16.96':445
'14.##.212.60':445
'14.##.72.141':445
'14.##.63.125':445
'14.##.162.112':139
'14.##.154.188':139
'14.##.152.136':139
'14.#9.188.4':139
'14.#9.41.86':139
'14.#9.5.42':139
'14.##.51.157':139
'14.##.181.41':139
'14.#9.62.89':139
'14.##.136.12':139
'14.#9.5.168':139
'14.##.173.108':445
'14.##.154.188':445
'14.##.152.136':445
'14.#9.188.4':445
'14.#9.41.86':445
'14.#9.5.42':445
'14.##.51.157':445
'14.##.181.41':445
'14.#9.62.89':445
'14.##.136.12':445
'14.#9.5.168':445
'14.##.50.182':445
'14.##.10.215':445
'14.##.180.194':445
'14.##.47.248':445
'14.##.146.160':445
'14.##.125.13':445
'14.#9.97.77':445
'14.##.51.214':445
'14.##.53.137':445
'14.#9.116.7':445
'14.##.28.208':445
'14.##.50.182':139
'14.##.144.37':445
'14.##.59.112':9988
'14.##.67.144':445
'14.##.96.172':445
'14.##.84.178':445
'14.##.14.162':9988
'14.##.206.78':9988
'14.##.194.15':9988
'14.##.40.176':9988
'14.#9.51.0':9988
'14.##.138.110':445
'14.##.104.127':445
'14.#9.18.54':445
'14.##.44.123':445
'14.##.216.89':445
'14.##.250.244':445
'14.##.215.195':445
'14.##.37.115':445
'14.##.89.143':445
'14.##.87.161':445
'14.##.198.10':445
'14.#9.43.13':9988
'14.##.10.215':139
'14.##.180.194':139
'14.##.47.248':139
'14.##.146.160':139
'14.##.125.13':139
'14.#9.97.77':139
'14.##.51.214':139
'14.##.53.137':139
'14.#9.116.7':139
'14.##.28.208':139
'14.##.173.108':139
'14.##.105.120':139
'14.##.20.151':139
'14.##.59.220':139
'14.##.162.124':9988
'14.##.191.113':9988
'14.#9.0.38':139
'14.#9.16.96':139
'14.##.212.60':139
'14.##.72.141':139
'14.##.63.125':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней