Trojan.Starman.5985

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERc2c9.dir00\svchost.exe.mdmp 16325836412032156

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc2c9.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'21#.#32.110.63':139
'21#.#32.50.139':139
'21#.#32.67.230':139
'21#.#32.129.96':139
'21#.#32.67.230':445
'21#.#32.50.139':445
'21#.#32.96.224':139
'21#.#32.129.96':445
'21#.#32.110.63':445
'21#.#32.253.223':445
'21#.#32.151.148':445
'21#.#32.143.230':445
'21#.#32.13.77':445
'21#.#32.123.212':445
'21#.#32.57.160':445
'21#.#32.220.31':445
'21#.#32.18.81':445
'21#.#32.65.139':445
'21#.#32.251.47':445
'21#.#32.218.66':139
'21#.#32.85.34':139
'21#.#32.233.166':139
'21#.#32.29.209':139
'21#.#32.24.228':139
'21#.#32.130.129':139
'21#.#32.62.163':139
'21#.#32.185.242':139
'21#.#32.172.153':139
'21#.#32.0.159':139
'21#.#32.94.233':139
'21#.#32.166.127':139
'21#.#32.4.58':139
'21#.#32.74.108':139
'21#.#32.38.136':139
'21#.#32.43.114':139
'21#.#32.26.227':139
'21#.#32.89.234':139
'21#.#32.165.89':139
'21#.#32.177.187':445
'21#.#32.128.243':445
'21#.#32.243.243':445
'21#.#32.35.31':445
'21#.#32.179.141':445
'21#.#32.127.135':445
'21#.#32.74.29':445
'21#.#32.32.162':445
'21#.#32.68.247':445
'21#.#32.60.238':445
'21#.#32.176.209':445
'21#.#32.57.101':445
'21#.#32.65.112':445
'21#.#32.18.81':139
'21#.#32.253.223':139
'21#.#32.43.85':445
'21#.#32.152.121':445
'21#.#32.210.64':445
'21#.#32.212.127':445
'21#.#32.168.41':445
'21#.#32.86.52':445
'21#.#32.5.86':445
'21#.#32.213.151':445
'21#.#32.249.204':445
'21#.#32.50.5':445
'21#.#32.144.245':445
'21#.#32.244.65':445
'21#.#32.25.131':445
'21#.#32.73.30':445
'21#.#32.132.201':445
'21#.#32.212.24':445
'21#.#32.167.211':445
'21#.#32.76.20':445
'21#.#32.104.246':445
'21#.#32.243.8':445
'21#.#32.98.164':445
'21#.#32.10.88':445
'21#.#32.186.164':445
'21#.#32.16.187':445
'21#.#32.93.228':139
'21#.#32.29.84':445
'21#.#32.171.48':445
'21#.#32.207.253':445
'21#.#32.117.254':445
'21#.#32.79.77':445
'21#.#32.140.23':445
'21#.#32.154.74':445
'21#.#32.6.176':445
'21#.#32.55.7':445
'21#.#32.2.202':445
'21#.#32.24.228':445
'21#.#32.185.242':445
'21#.#32.218.66':445
'21#.#32.85.34':445
'21#.#32.172.153':445
'21#.#32.93.228':445
'21#.#32.61.94':445
'21#.#32.130.129':445
'21#.#32.62.163':445
'21#.#32.7.246':445
'21#.#32.185.7':445
'21#.#32.202.181':445
'21#.#32.152.62':445
'21#.#32.121.17':445
'21#.#32.136.213':139
'21#.#32.164.137':139
'21#.#32.113.172':139
'21#.#32.191.198':139
'21#.#32.13.157':445
'21#.#32.40.248':445
'21#.#32.93.114':445
'21#.#32.59.209':445
'21#.#32.78.18':445
'21#.#32.65.154':445
'21#.#32.133.101':445
'21#.#32.157.133':445
'21#.#32.210.44':445
'21#.#32.101.209':445
'21#.#32.29.209':445
'21#.#32.78.18':139
'21#.#32.40.248':139
'21#.#32.154.74':139
'21#.#32.59.209':139
'21#.#32.93.114':139
'21#.#32.101.209':139
'21#.#32.133.101':139
'21#.#32.65.154':139
'21#.#32.210.44':139
'21#.#32.140.23':139
'21#.#32.207.253':139
'21#.#32.117.254':139
'21#.#32.61.94':139
'21#.#32.2.202':139
'21#.#32.29.84':139
'21#.#32.6.176':139
'21#.#32.55.7':139
'21#.#32.171.48':139
'21#.#32.79.77':139
'21#.#32.38.136':445
'21#.#32.89.234':445
'21#.#32.94.233':445
'21#.#32.166.127':445
'21#.#32.165.89':445
'21#.#32.0.159':445
'21#.#32.233.166':445
'21#.#32.43.114':445
'21#.#32.26.227':445
'21#.#32.74.108':445
'21#.#32.202.181':139
'21#.#32.152.62':139
'21#.#32.157.133':139
'21#.#32.13.157':139
'21#.#32.7.246':139
'21#.#32.96.224':445
'21#.#32.4.58':445
'21#.#32.185.7':139
'21#.#32.121.17':139
'21#.#32.220.31':139
'21#.#32.181.161':445
'21#.#32.169.214':445
'21#.#32.245.122':139
'21#.#32.137.253':139
'21#.#32.186.170':445
'21#.#32.136.218':445
'21#.#32.168.231':445
'21#.#32.69.228':445
'21#.#32.182.73':445
'21#.#32.128.54':139
'21#.#32.45.146':139
'21#.#32.208.134':139
'21#.#32.15.190':139
'21#.#32.112.248':139
'21#.#32.68.214':139
'21#.#32.93.151':139
'21#.#32.55.106':139
'21#.#32.245.190':139
'21#.#32.180.111':139
'21#.#32.3.230':445
'21#.#32.184.128':445
'21#.#32.95.168':445
'21#.#32.70.83':445
'21#.#32.142.67':445
'21#.#32.9.170':445
'21#.#32.118.32':445
'21#.#32.86.9':445
'21#.#32.82.86':445
'21#.#32.58.111':445
'21#.#32.175.202':445
'21#.#32.110.30':445
'21#.#32.102.201':445
'21#.#32.142.102':445
'21#.#32.80.242':445
'21#.#32.119.112':445
'21#.#32.56.135':445
'21#.#32.164.175':445
'21#.#32.128.2':445
'21#.#32.150.117':139
'21#.#32.164.175':139
'21#.#32.128.2':139
'21#.#32.110.30':139
'21#.#32.80.242':139
'21#.#32.119.112':139
'21#.#32.95.168':139
'21#.#32.70.83':139
'21#.#32.56.135':139
'21#.#32.58.111':139
'21#.#32.175.202':139
'21#.#32.186.170':139
'21#.#32.69.228':139
'21#.#32.169.214':139
'21#.#32.181.161':139
'21#.#32.182.73':139
'21#.#32.102.201':139
'21#.#32.142.102':139
'21#.#32.136.218':139
'21#.#32.168.231':139
'21#.#32.166.232':139
'21#.#32.129.132':139
'21#.#32.79.43':139
'21#.#32.232.78':139
'21#.#32.157.81':139
'21#.#32.195.243':139
'21#.#32.56.224':139
'21#.#32.115.34':139
'21#.#32.244.114':139
'21#.#32.236.40':139
'21#.#32.142.67':139
'21#.#32.86.9':139
'21#.#32.3.230':139
'21#.#32.184.128':139
'21#.#32.82.86':139
'21#.#32.169.60':139
'21#.#32.54.204':139
'21#.#32.9.170':139
'21#.#32.118.32':139
'21#.#32.169.60':445
'21#.#32.104.246':139
'21#.#32.212.24':139
'21#.#32.32.162':139
'21#.#32.76.20':139
'21#.#32.167.211':139
'21#.#32.16.187':139
'21#.#32.98.164':139
'21#.#32.243.8':139
'21#.#32.186.164':139
'21#.#32.74.29':139
'21#.#32.35.31':139
'21#.#32.179.141':139
'21#.#32.210.64':139
'21#.#32.176.209':139
'21#.#32.128.243':139
'21#.#32.68.247':139
'21#.#32.60.238':139
'21#.#32.243.243':139
'21#.#32.127.135':139
'21#.#32.13.77':139
'21#.#32.123.212':139
'21#.#32.244.65':139
'21#.#32.177.187':139
'21#.#32.151.148':139
'21#.#32.65.139':139
'21#.#32.251.47':139
'21#.#32.143.230':139
'21#.#32.57.160':139
'21#.#32.144.245':139
'21#.#32.213.151':139
'21#.#32.249.204':139
'21#.#32.10.88':139
'21#.#32.132.201':139
'21#.#32.86.52':139
'21#.#32.25.131':139
'21#.#32.73.30':139
'21#.#32.5.86':139
'21#.#32.50.5':139
'21#.#32.152.121':139
'21#.#32.15.190':445
'21#.#32.112.248':445
'21#.#32.56.224':445
'21#.#32.150.117':445
'21#.#32.45.146':445
'21#.#32.245.190':445
'21#.#32.180.111':445
'21#.#32.208.134':445
'21#.#32.68.214':445
'21#.#32.195.243':445
'21#.#32.79.43':445
'21#.#32.232.78':445
'21#.#32.54.204':445
'21#.#32.236.40':445
'21#.#32.166.232':445
'21#.#32.115.34':445
'21#.#32.244.114':445
'21#.#32.129.132':445
'21#.#32.157.81':445
'21#.#32.115.34':9988
'21#.#32.55.106':9988
'21#.#32.70.83':9988
'21#.#32.142.67':9988
'21#.#32.57.101':139
'21#.#32.212.127':139
'21#.#32.168.41':139
'21#.#32.65.112':139
'21#.#32.43.85':139
'21#.#32.128.2':9988
'21#.#32.128.54':445
'21#.#32.245.122':445
'21#.#32.93.151':445
'21#.#32.55.106':445
'21#.#32.137.253':445
'21#.#32.182.73':9988
'21#.#32.175.202':9988
'21#.#32.136.218':9988
'21#.#32.69.228':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней