Trojan.Starman.5983

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER3c79.dir00\svchost.exe.mdmp 16325836412032136

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3c79.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14.##3.207.99':445
'14.##3.178.44':139
'14.##3.173.34':445
'14.##3.34.65':445
'14.##3.91.86':139
'14.##3.178.44':445
'14.##3.91.86':445
'14.##3.93.165':139
'14.##3.95.235':139
'14.##3.83.91':445
'14.##3.246.99':445
'14.#13.8.41':445
'14.##3.1.152':445
'14.##3.121.91':445
'14.##3.29.102':445
'14.##3.11.177':445
'14.##3.67.178':445
'14.##3.94.104':445
'14.##3.44.21':445
'14.##3.93.165':445
'14.##3.234.131':139
'14.##3.16.102':139
'14.##3.12.72':139
'14.#13.65.1':139
'14.##3.44.80':139
'14.##3.50.125':139
'14.##3.42.179':139
'14.##3.89.120':139
'14.##3.124.124':139
'14.##3.148.178':139
'14.##3.10.11':139
'14.##3.20.220':139
'14.##3.95.235':445
'14.##3.241.95':139
'14.##3.115.198':139
'14.##3.74.233':139
'14.##3.75.115':139
'14.##3.82.215':139
'14.##3.169.109':139
'14.##3.184.181':445
'14.##3.191.173':445
'14.##3.33.192':445
'14.##3.126.148':445
'14.##3.73.32':445
'14.##3.120.180':445
'14.##3.73.122':445
'14.##3.220.73':445
'14.##3.123.183':445
'14.##3.221.64':445
'14.##3.37.17':445
'14.##3.83.91':139
'14.##3.173.34':139
'14.##3.11.177':139
'14.##3.67.178':139
'14.##3.34.65':139
'14.##3.199.245':445
'14.##3.32.157':445
'14.##3.207.99':139
'14.##3.38.35':445
'14.##3.36.185':445
'14.##3.24.75':445
'14.##3.234.79':445
'14.##3.252.184':445
'14.##3.161.219':445
'14.##3.25.160':445
'14.##3.13.236':445
'14.##3.38.143':445
'14.##3.163.173':445
'14.#13.52.3':445
'14.##3.126.156':445
'14.##3.80.53':445
'14.##3.212.208':445
'14.##3.10.160':445
'14.##3.101.146':445
'14.##3.151.212':445
'14.##3.201.232':445
'14.##3.156.201':445
'14.##3.38.198':445
'14.##3.93.245':445
'14.##3.75.68':139
'14.##3.238.128':445
'14.##3.2.239':445
'14.##3.115.92':445
'14.##3.56.146':445
'14.##3.60.24':445
'14.##3.176.199':445
'14.##3.230.176':445
'14.##3.142.155':445
'14.##3.28.241':445
'14.##3.138.60':445
'14.##3.89.120':445
'14.##3.124.124':445
'14.##3.16.102':445
'14.##3.44.80':445
'14.##3.50.125':445
'14.##3.240.112':445
'14.##3.39.45':445
'14.##3.42.179':445
'14.##3.75.68':445
'14.##3.73.233':445
'14.##3.231.213':445
'14.##3.60.155':445
'14.##3.164.212':445
'14.##3.43.13':445
'14.##3.63.100':445
'14.##3.7.146':139
'14.##3.91.66':139
'14.##3.123.42':139
'14.##3.53.206':139
'14.##3.184.73':445
'14.##3.136.169':445
'14.##3.139.165':445
'14.##3.126.141':445
'14.##3.159.254':445
'14.##3.139.248':445
'14.##3.76.228':445
'14.##3.73.158':445
'14.##3.161.177':445
'14.##3.147.91':445
'14.##3.234.131':445
'14.##3.73.233':139
'14.##3.126.141':139
'14.##3.176.199':139
'14.##3.230.176':139
'14.##3.159.254':139
'14.##3.139.248':139
'14.##3.161.177':139
'14.##3.136.169':139
'14.##3.139.165':139
'14.##3.28.241':139
'14.##3.138.60':139
'14.##3.115.92':139
'14.##3.240.112':139
'14.##3.39.45':139
'14.##3.56.146':139
'14.##3.60.24':139
'14.##3.142.155':139
'14.##3.238.128':139
'14.##3.2.239':139
'14.##3.147.91':139
'14.##3.82.215':445
'14.##3.169.109':445
'14.##3.20.220':445
'14.##3.115.198':445
'14.##3.74.233':445
'14.##3.12.72':445
'14.#13.65.1':445
'14.##3.75.115':445
'14.##3.148.178':445
'14.##3.10.11':445
'14.##3.184.73':139
'14.##3.164.212':139
'14.##3.76.228':139
'14.##3.73.158':139
'14.##3.43.13':139
'14.##3.63.100':139
'14.##3.241.95':445
'14.##3.231.213':139
'14.##3.60.155':139
'14.##3.44.21':139
'14.##3.204.4':445
'14.##3.65.13':445
'14.##3.229.202':139
'14.##3.160.9':445
'14.##3.59.85':445
'14.##3.215.45':445
'14.##3.7.185':445
'14.##3.44.250':445
'14.##3.64.48':445
'14.##3.202.152':139
'14.##3.244.1':139
'14.##3.105.96':139
'14.##3.43.231':139
'14.##3.33.197':139
'14.##3.186.220':139
'14.##3.190.91':139
'14.##3.152.181':139
'14.##3.221.37':139
'14.##3.225.92':139
'14.##3.31.109':445
'14.##3.141.37':445
'14.##3.243.83':445
'14.##3.46.225':445
'14.##3.108.73':445
'14.##3.211.209':445
'14.##3.57.246':445
'14.##3.246.57':445
'14.##3.27.189':445
'14.##3.245.231':445
'14.##3.140.226':445
'14.##3.201.24':445
'14.##3.235.194':445
'14.##3.23.80':445
'14.##3.88.129':445
'14.##3.94.238':445
'14.##3.46.54':445
'14.##3.109.139':445
'14.##3.212.94':445
'14.##3.199.34':445
'14.##3.231.63':139
'14.##3.235.194':139
'14.##3.94.238':139
'14.##3.88.129':139
'14.##3.201.24':139
'14.##3.212.94':139
'14.##3.109.139':139
'14.##3.140.226':139
'14.##3.199.34':139
'14.##3.46.54':139
'14.##3.23.80':139
'14.##3.65.13':139
'14.##3.59.85':139
'14.##3.160.9':139
'14.##3.204.4':139
'14.##3.44.250':139
'14.##3.7.185':139
'14.##3.31.109':139
'14.##3.64.48':139
'14.##3.215.45':139
'14.##3.46.225':139
'14.##3.227.50':139
'14.##3.16.222':139
'14.#13.6.4':139
'14.##3.153.46':139
'14.##3.106.186':139
'14.##3.34.55':139
'14.##3.63.254':139
'14.##3.205.24':139
'14.##3.43.10':139
'14.##3.4.101':139
'14.##3.243.83':139
'14.##3.211.209':139
'14.##3.108.73':139
'14.##3.141.37':139
'14.##3.27.189':139
'14.##3.246.57':139
'14.##3.100.246':139
'14.##3.245.231':139
'14.##3.57.246':139
'14.##3.100.246':445
'14.##3.36.185':139
'14.##3.10.160':139
'14.##3.73.122':139
'14.##3.220.73':139
'14.##3.101.146':139
'14.##3.151.212':139
'14.##3.38.198':139
'14.##3.80.53':139
'14.##3.212.208':139
'14.##3.221.64':139
'14.##3.37.17':139
'14.##3.126.148':139
'14.##3.199.245':139
'14.##3.32.157':139
'14.##3.73.32':139
'14.##3.120.180':139
'14.##3.123.183':139
'14.##3.191.173':139
'14.##3.33.192':139
'14.##3.93.245':139
'14.##3.184.181':139
'14.##3.1.152':139
'14.##3.13.236':139
'14.##3.38.143':139
'14.##3.121.91':139
'14.##3.29.102':139
'14.##3.94.104':139
'14.##3.246.99':139
'14.#13.8.41':139
'14.#13.52.3':139
'14.##3.126.156':139
'14.##3.252.184':139
'14.##3.201.232':139
'14.##3.156.201':139
'14.##3.161.219':139
'14.##3.25.160':139
'14.##3.163.173':139
'14.##3.24.75':139
'14.##3.234.79':139
'14.##3.38.35':139
'14.##3.33.197':445
'14.##3.244.1':445
'14.##3.231.63':445
'14.##3.43.231':445
'14.##3.105.96':445
'14.##3.225.92':445
'14.##3.190.91':445
'14.##3.186.220':445
'14.##3.221.37':445
'14.##3.63.254':445
'14.##3.153.46':445
'14.##3.227.50':445
'14.##3.4.101':445
'14.#13.6.4':445
'14.##3.16.222':445
'14.##3.43.10':445
'14.##3.34.55':445
'14.##3.106.186':445
'14.##3.205.24':445
'14.##3.152.181':445
'14.##3.141.37':9988
'14.##3.211.209':9988
'14.##3.94.238':9988
'14.##3.109.139':9988
'14.##3.243.83':9988
'14.##3.246.57':9988
'14.##3.4.101':9988
'14.##3.27.189':9988
'14.##3.245.231':9988
'14.##3.235.194':9988
'14.##3.160.9':9988
'14.##3.65.13':9988
'14.##3.202.152':445
'14.##3.229.202':445
'14.##3.204.4':9988
'14.##3.23.80':9988
'14.##3.201.24':9988
'14.##3.44.250':9988
'14.##3.64.48':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней