Trojan.Starman.5989

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER1aeb.dir00\svchost.exe.mdmp 16325836412032212

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1aeb.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'58.#6.45.66':139
'58.##.122.64':139
'58.#6.3.161':139
'58.##.131.167':139
'58.##.152.93':139
'58.##.147.219':139
'58.##.103.47':139
'58.##.63.162':139
'58.##.215.176':139
'58.##.162.39':139
'58.#6.60.77':139
'58.##.75.164':139
'58.#6.150.4':139
'58.##.240.28':139
'58.#6.1.182':139
'58.##.228.108':139
'58.##.51.139':139
'58.#6.28.84':139
'58.##.127.27':139
'58.#6.28.66':139
'58.##.244.92':139
'58.##.51.139':445
'58.#6.28.84':445
'58.##.127.27':445
'58.#6.28.66':445
'58.##.244.92':445
'58.#6.3.161':445
'58.#6.45.66':445
'58.##.152.93':445
'58.#6.60.77':445
'58.##.131.167':445
'58.#6.150.4':445
'58.##.142.125':139
'58.##.181.129':139
'58.#6.0.174':139
'58.##.108.40':139
'58.#6.215.3':139
'58.##.240.28':445
'58.##.75.164':445
'58.##.228.108':445
'58.##.153.237':445
'58.#6.1.182':445
'58.##.153.237':139
'58.##.218.209':139
'58.##.85.107':139
'58.##.173.207':139
'58.##.194.74':139
'58.#6.3.96':139
'58.##.215.207':445
'58.##.168.216':445
'58.#6.72.99':445
'58.##.100.228':139
'58.##.67.218':139
'58.##.22.229':139
'58.##.26.158':139
'58.##.44.235':139
'58.##.103.12':139
'58.#6.75.9':139
'58.##.187.92':139
'58.##.11.149':139
'58.##.224.136':139
'58.##.181.171':139
'58.##.91.221':139
'58.##.27.160':139
'58.##.194.74':445
'58.#6.3.96':445
'58.##.22.229':445
'58.##.11.149':445
'58.##.224.136':445
'58.##.100.228':445
'58.##.67.218':445
'58.##.85.107':445
'58.##.173.207':445
'58.##.218.209':445
'58.##.181.171':445
'58.#6.75.9':445
'58.##.187.92':445
'58.##.58.140':445
'58.##.147.169':445
'58.##.233.147':445
'58.##.91.221':445
'58.##.27.160':445
'58.##.44.235':445
'58.##.103.12':445
'58.##.26.158':445
'58.##.122.64':445
'58.##.119.246':445
'58.##.248.249':139
'58.##.39.145':445
'58.#6.29.89':445
'58.#6.19.29':445
'58.##.56.210':139
'58.##.110.110':139
'58.##.209.218':139
'58.#6.68.9':139
'58.##.31.145':139
'58.##.129.199':445
'58.#6.6.58':445
'58.#6.62.94':445
'58.##.209.96':445
'58.##.101.220':445
'58.##.17.198':445
'58.##.231.97':445
'58.#6.75.46':445
'58.##.203.94':445
'58.##.126.170':445
'58.#6.94.69':445
'58.##.35.119':139
'58.##.39.136':139
'58.##.10.243':139
'58.#6.73.24':139
'58.##.82.144':139
'58.#6.75.12':139
'58.#6.90.75':139
'58.##.11.162':139
'58.##.140.176':139
'58.##.58.231':139
'58.##.24.171':139
'58.#6.45.16':139
'58.##.179.197':139
'58.##.196.124':139
'58.##.231.178':139
'58.##.10.232':139
'58.##.219.153':139
'58.##.171.218':139
'58.##.154.204':139
'58.##.113.45':139
'58.##.132.214':139
'58.##.143.198':445
'58.##.115.15':139
'58.##.128.164':139
'58.#6.79.95':139
'58.##.225.146':139
'58.##.116.92':139
'58.##.101.220':139
'58.##.17.198':139
'58.##.143.198':139
'58.##.150.123':139
'58.##.131.71':139
'58.##.81.170':139
'58.##.147.219':445
'58.##.103.47':445
'58.##.63.162':445
'58.##.215.176':445
'58.##.162.39':445
'58.##.142.125':445
'58.##.181.129':445
'58.#6.0.174':445
'58.##.108.40':445
'58.#6.215.3':445
'58.##.225.146':445
'58.##.116.92':445
'58.##.81.170':445
'58.##.39.145':139
'58.##.119.246':139
'58.##.150.123':445
'58.##.131.71':445
'58.##.128.164':445
'58.#6.79.95':445
'58.##.115.15':445
'58.#6.19.29':139
'58.##.126.170':139
'58.#6.94.69':139
'58.#6.62.94':139
'58.##.209.96':139
'58.#6.6.58':139
'58.##.129.199':139
'58.#6.29.89':139
'58.#6.75.46':139
'58.##.203.94':139
'58.##.231.97':139
'58.##.117.75':445
'58.#6.41.79':445
'58.##.43.230':445
'58.#6.61.38':445
'58.##.36.134':445
'58.##.12.136':445
'58.##.156.247':445
'58.##.161.185':445
'58.##.26.142':445
'58.##.192.228':445
'58.##.148.99':445
'58.##.182.105':139
'58.##.53.160':139
'58.##.106.124':139
'58.##.200.203':139
'58.#6.139.3':139
'58.##.199.239':445
'58.##.33.127':445
'58.#6.34.97':139
'58.##.229.110':139
'58.##.106.229':139
'58.##.238.12':445
'58.#6.50.38':445
'58.##.12.158':445
'58.##.169.62':445
'58.##.157.224':445
'58.#6.38.80':445
'58.##.137.54':445
'58.#6.66.8':445
'58.##.241.151':445
'58.##.14.142':445
'58.##.143.65':445
'58.#6.5.235':445
'58.##.138.32':445
'58.##.41.140':445
'58.##.255.195':445
'58.##.140.73':445
'58.##.53.248':445
'58.#6.2.25':445
'58.##.21.114':445
'58.#6.195.5':445
'58.##.224.11':445
'58.##.125.235':139
'58.##.140.73':139
'58.##.41.140':139
'58.##.255.195':139
'58.##.12.136':139
'58.##.156.247':139
'58.##.224.11':139
'58.##.21.114':139
'58.#6.195.5':139
'58.#6.5.235':139
'58.##.138.32':139
'58.##.161.185':139
'58.#6.61.38':139
'58.##.36.134':139
'58.##.148.99':139
'58.##.199.239':139
'58.##.33.127':139
'58.##.26.142':139
'58.##.192.228':139
'58.#6.41.79':139
'58.##.43.230':139
'58.##.117.75':139
'58.#6.43.61':139
'58.##.150.38':139
'58.##.196.54':139
'58.#6.38.80':139
'58.##.137.54':139
'58.##.102.197':139
'58.##.100.102':139
'58.##.197.35':139
'58.##.115.63':139
'58.#6.36.6':139
'58.#6.66.8':139
'58.##.169.62':139
'58.##.157.224':139
'58.##.143.65':139
'58.##.53.248':139
'58.#6.2.25':139
'58.##.241.151':139
'58.##.14.142':139
'58.#6.50.38':139
'58.##.12.158':139
'58.##.238.12':139
'58.##.196.54':445
'58.#6.5.208':445
'58.##.151.37':445
'58.##.160.72':445
'58.##.121.199':445
'58.##.142.190':445
'58.#6.1.227':445
'58.#6.33.10':445
'58.#6.6.109':445
'58.##.165.79':445
'58.#6.31.1':445
'58.##.101.148':139
'58.##.52.180':139
'58.##.175.101':139
'58.#6.45.19':139
'58.##.15.204':139
'58.##.167.247':139
'58.#6.7.172':139
'58.#6.11.82':139
'58.##.59.157':139
'58.##.45.185':139
'58.#6.30.31':139
'58.##.101.148':445
'58.#6.72.99':139
'58.#6.11.82':445
'58.##.59.157':445
'58.#6.7.172':445
'58.##.233.147':139
'58.##.58.140':139
'58.##.147.169':139
'58.##.215.207':139
'58.##.168.216':139
'58.#6.30.31':445
'58.##.30.225':445
'58.##.15.204':445
'58.##.198.111':445
'58.##.153.14':445
'58.#6.60.24':445
'58.##.175.101':445
'58.##.45.185':445
'58.##.52.180':445
'58.##.167.247':445
'58.#6.45.19':445
'58.##.30.225':139
'58.##.106.229':445
'58.#6.34.97':445
'58.##.229.110':445
'58.##.182.105':445
'58.##.53.160':445
'58.##.192.228':9988
'58.##.161.185':9988
'58.##.148.99':9988
'58.##.199.239':9988
'58.##.33.127':9988
'58.##.106.124':445
'58.#6.36.6':445
'58.##.197.35':445
'58.##.115.63':445
'58.#6.43.61':445
'58.##.150.38':445
'58.##.200.203':445
'58.#6.139.3':445
'58.##.125.235':445
'58.##.102.197':445
'58.##.100.102':445
'58.#6.31.1':139
'58.#6.6.109':139
'58.##.165.79':139
'58.#6.5.208':139
'58.##.151.37':139
'58.#6.60.24':139
'58.##.198.111':139
'58.##.153.14':139
'58.#6.1.227':139
'58.#6.33.10':139
'58.##.160.72':139
'58.##.224.11':9988
'58.##.21.114':9988
'58.##.138.32':9988
'58.##.12.136':9988
'58.##.255.195':9988
'58.##.121.199':139
'58.##.142.190':139
'58.#6.36.6':9988
'58.##.53.248':9988
'58.##.169.62':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней