Trojan.Starman.5406

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERebac.dir00\svchost.exe.mdmp 16325836412032192

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERebac.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'81.##0.99.177':139
'81.##0.38.29':139
'81.##0.17.139':445
'81.##0.165.240':139
'81.#20.4.36':139
'81.##0.38.29':445
'81.#20.4.36':445
'81.##0.165.240':445
'81.##0.99.177':445
'81.#20.36.6':445
'81.##0.106.56':445
'81.##0.192.228':445
'81.##0.32.214':445
'81.##0.13.109':445
'81.##0.100.122':445
'81.##0.122.69':445
'81.##0.160.225':445
'81.##0.222.103':445
'81.##0.186.222':445
'81.##0.81.131':139
'81.##0.209.215':139
'81.##0.0.211':139
'81.##0.249.81':139
'81.##0.134.131':139
'81.##0.155.0':139
'81.##0.66.204':139
'81.##0.44.114':139
'81.##0.206.154':139
'81.##0.154.206':139
'81.##0.109.247':139
'81.##0.90.217':139
'81.#20.6.61':139
'81.##0.18.18':139
'81.##0.50.166':139
'81.##0.86.92':139
'81.##0.40.209':139
'81.##0.248.40':139
'81.##0.171.138':139
'81.##0.209.138':139
'81.#20.0.75':445
'81.##0.93.112':445
'81.##0.72.12':445
'81.##0.28.158':445
'81.##0.145.20':445
'81.##0.139.212':445
'81.##0.136.237':445
'81.##0.175.82':445
'81.##0.72.23':445
'81.##0.231.254':445
'81.##0.17.139':139
'81.##0.220.69':445
'81.##0.160.225':139
'81.#20.36.6':139
'81.##0.133.89':445
'81.##0.73.17':445
'81.##0.164.100':445
'81.##0.143.106':445
'81.##0.48.243':445
'81.##0.161.110':445
'81.##0.6.101':445
'81.##0.188.188':445
'81.##0.182.19':445
'81.##0.35.228':445
'81.##0.171.213':445
'81.##0.39.77':445
'81.##0.141.69':445
'81.##0.98.232':445
'81.##0.118.98':445
'81.#20.7.72':445
'81.##0.185.193':445
'81.##0.166.185':445
'81.##0.163.161':445
'81.##0.228.240':445
'81.##0.251.165':445
'81.##0.35.235':445
'81.##0.9.128':445
'81.##0.199.157':445
'81.##0.144.12':445
'81.##0.104.210':445
'81.##0.82.131':445
'81.##0.28.165':445
'81.##0.36.60':445
'81.##0.86.195':445
'81.##0.157.45':445
'81.##0.149.107':445
'81.##0.191.22':445
'81.##0.221.112':445
'81.##0.243.102':445
'81.##0.0.211':445
'81.##0.155.0':445
'81.##0.134.131':445
'81.##0.209.215':445
'81.##0.206.154':445
'81.##0.44.114':445
'81.##0.91.62':445
'81.##0.154.206':445
'81.##0.66.204':445
'81.##0.42.223':445
'81.##0.29.101':445
'81.##0.121.170':445
'81.##0.212.244':445
'81.##0.245.212':445
'81.##0.102.121':445
'81.##0.160.28':139
'81.##0.98.79':139
'81.##0.23.117':139
'81.##0.71.38':139
'81.##0.109.213':445
'81.##0.221.213':445
'81.##0.157.221':445
'81.##0.154.116':445
'81.##0.165.223':445
'81.##0.235.221':445
'81.##0.46.105':445
'81.##0.243.189':445
'81.##0.35.176':445
'81.##0.94.13':445
'81.##0.154.116':139
'81.##0.165.223':139
'81.##0.149.107':139
'81.##0.42.223':139
'81.##0.221.213':139
'81.##0.35.176':139
'81.##0.94.13':139
'81.##0.157.221':139
'81.##0.235.221':139
'81.##0.157.45':139
'81.##0.28.165':139
'81.##0.36.60':139
'81.##0.91.62':139
'81.##0.243.102':139
'81.##0.104.210':139
'81.##0.191.22':139
'81.##0.221.112':139
'81.##0.82.131':139
'81.##0.86.195':139
'81.##0.46.105':139
'81.##0.86.92':445
'81.##0.171.138':445
'81.##0.90.217':445
'81.#20.6.61':445
'81.##0.209.138':445
'81.##0.109.247':445
'81.##0.249.81':445
'81.##0.40.209':445
'81.##0.248.40':445
'81.##0.50.166':445
'81.##0.212.244':139
'81.##0.245.212':139
'81.##0.243.189':139
'81.##0.109.213':139
'81.##0.29.101':139
'81.##0.81.131':445
'81.##0.18.18':445
'81.##0.121.170':139
'81.##0.102.121':139
'81.##0.122.69':139
'81.##0.145.225':445
'81.##0.223.6':445
'81.##0.97.19':139
'81.##0.2.160':139
'81.##0.154.34':445
'81.##0.149.94':445
'81.##0.203.224':445
'81.##0.225.88':445
'81.##0.63.73':445
'81.##0.249.159':139
'81.##0.103.64':139
'81.##0.18.103':139
'81.##0.73.38':139
'81.##0.64.127':139
'81.##0.121.219':139
'81.##0.22.104':139
'81.##0.159.249':139
'81.##0.184.198':139
'81.##0.149.184':139
'81.##0.224.106':445
'81.##0.212.96':445
'81.##0.152.110':445
'81.##0.26.170':445
'81.##0.123.187':445
'81.##0.75.84':445
'81.##0.179.64':445
'81.##0.131.179':445
'81.##0.81.90':445
'81.##0.64.234':445
'81.##0.190.202':445
'81.##0.16.129':445
'81.##0.185.15':445
'81.##0.84.150':445
'81.##0.170.253':445
'81.##0.134.184':445
'81.##0.20.106':445
'81.##0.54.20':445
'81.##0.70.20':445
'81.##0.247.32':445
'81.##0.134.184':139
'81.##0.70.20':139
'81.##0.16.129':139
'81.##0.185.15':139
'81.##0.247.32':139
'81.##0.190.202':139
'81.##0.26.170':139
'81.##0.20.106':139
'81.##0.54.20':139
'81.##0.170.253':139
'81.##0.154.34':139
'81.##0.224.106':139
'81.##0.145.225':139
'81.##0.223.6':139
'81.##0.225.88':139
'81.##0.149.94':139
'81.##0.84.150':139
'81.##0.203.224':139
'81.##0.63.73':139
'81.##0.123.187':139
'81.##0.118.142':139
'81.##0.125.215':139
'81.##0.222.20':139
'81.##0.141.221':139
'81.##0.94.130':139
'81.##0.109.113':139
'81.##0.85.11':139
'81.#20.8.17':139
'81.##0.99.31':139
'81.##0.207.248':139
'81.##0.75.84':139
'81.##0.81.90':139
'81.##0.212.96':139
'81.##0.152.110':139
'81.##0.64.234':139
'81.##0.39.103':139
'81.##0.129.126':139
'81.##0.179.64':139
'81.##0.131.179':139
'81.##0.161.110':139
'81.##0.163.161':139
'81.##0.139.212':139
'81.##0.136.237':139
'81.##0.228.240':139
'81.##0.251.165':139
'81.##0.199.157':139
'81.##0.185.193':139
'81.##0.166.185':139
'81.##0.72.23':139
'81.##0.231.254':139
'81.##0.72.12':139
'81.##0.73.17':139
'81.##0.164.100':139
'81.##0.28.158':139
'81.##0.145.20':139
'81.##0.175.82':139
'81.#20.0.75':139
'81.##0.93.112':139
'81.##0.144.12':139
'81.##0.32.214':139
'81.##0.13.109':139
'81.##0.39.77':139
'81.##0.141.69':139
'81.##0.106.56':139
'81.##0.222.103':139
'81.##0.186.222':139
'81.##0.192.228':139
'81.##0.100.122':139
'81.##0.118.98':139
'81.#20.7.72':139
'81.##0.182.19':139
'81.##0.35.235':139
'81.##0.9.128':139
'81.##0.35.228':139
'81.##0.171.213':139
'81.##0.98.232':139
'81.##0.6.101':139
'81.##0.188.188':139
'81.##0.73.38':445
'81.##0.64.127':445
'81.##0.109.113':445
'81.##0.85.11':445
'81.##0.103.64':445
'81.##0.184.198':445
'81.##0.149.184':445
'81.##0.18.103':445
'81.##0.121.219':445
'81.##0.99.31':445
'81.##0.207.248':445
'81.##0.222.20':445
'81.##0.39.103':445
'81.##0.129.126':445
'81.##0.141.221':445
'81.##0.94.130':445
'81.#20.8.17':445
'81.##0.118.142':445
'81.##0.125.215':445
'81.##0.22.104':445
'81.##0.131.179':9988
'81.##0.39.103':9988
'81.##0.123.187':9988
'81.##0.64.234':9988
'81.##0.97.19':9988
'81.##0.143.106':139
'81.##0.48.243':139
'81.##0.220.69':139
'81.##0.133.89':139
'81.##0.70.20':9988
'81.##0.97.19':445
'81.##0.2.160':445
'81.##0.159.249':445
'81.##0.249.159':445
'81.##0.145.225':9988
'81.##0.223.6':9988
'81.##0.134.184':9988
'81.##0.154.34':9988
'81.##0.63.73':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней