Trojan.Starman.5365

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER3865.dir00\svchost.exe.mdmp 16325836412032444

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3865.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'82.##6.38.162':139
'82.##6.152.48':139
'82.##6.28.165':139
'82.##6.44.174':139
'82.##6.202.21':445
'82.##6.108.132':445
'82.##6.206.108':445
'82.##6.198.202':445
'82.##6.105.51':445
'82.##6.164.222':139
'82.##6.202.21':139
'82.##6.198.202':139
'82.##6.240.94':445
'82.##6.15.166':445
'82.##6.105.51':139
'82.##6.121.40':139
'82.##6.90.171':139
'82.##6.108.132':139
'82.##6.206.108':139
'82.#46.4.78':139
'82.##6.182.32':139
'82.##6.70.225':139
'82.##6.127.243':139
'82.##6.96.241':139
'82.##6.161.17':139
'82.##6.189.235':139
'82.##6.219.197':139
'82.##6.47.247':139
'82.##6.79.13':139
'82.##6.164.222':445
'82.##6.28.165':445
'82.##6.121.40':445
'82.##6.90.171':445
'82.##6.44.174':445
'82.##6.84.48':139
'82.##6.224.18':139
'82.##6.38.162':445
'82.##6.152.48':445
'82.#46.95.5':445
'82.##6.3.219':445
'82.##6.188.41':445
'82.##6.116.193':445
'82.##6.116.116':445
'82.##6.238.49':445
'82.##6.9.236':445
'82.##6.254.63':445
'82.##6.100.238':445
'82.##6.236.100':445
'82.##6.141.62':445
'82.##6.26.29':445
'82.##6.68.250':445
'82.##6.240.94':139
'82.##6.15.166':139
'82.##6.212.142':445
'82.##6.53.250':445
'82.##6.99.61':445
'82.##6.101.178':445
'82.##6.173.125':445
'82.##6.23.104':445
'82.##6.172.160':445
'82.#46.6.79':445
'82.##6.75.170':445
'82.##6.177.229':445
'82.##6.158.48':445
'82.##6.77.216':445
'82.##6.113.43':445
'82.##6.118.118':445
'82.##6.222.158':445
'82.##6.94.138':445
'82.#46.11.6':445
'82.##6.81.133':445
'82.##6.22.97':445
'82.##6.50.210':445
'82.##6.155.218':445
'82.##6.99.114':445
'82.##6.104.152':445
'82.##6.26.104':445
'82.##6.123.16':139
'82.##6.225.75':445
'82.##6.12.106':445
'82.##6.172.93':445
'82.##6.145.172':445
'82.##6.48.13':445
'82.##6.14.133':445
'82.##6.207.78':445
'82.##6.74.137':445
'82.##6.24.30':445
'82.##6.93.54':445
'82.##6.222.208':445
'82.##6.245.113':445
'82.##6.237.180':445
'82.##6.208.237':445
'82.##6.196.154':445
'82.##6.141.5':445
'82.##6.227.36':445
'82.##6.222.195':445
'82.##6.13.69':445
'82.##6.114.234':139
'82.##6.65.197':139
'82.##6.80.104':139
'82.##6.144.244':139
'82.##6.54.140':139
'82.##6.110.200':139
'82.##6.140.80':139
'82.##6.112.62':139
'82.##6.139.86':139
'82.##6.153.57':139
'82.##6.18.135':445
'82.##6.39.23':445
'82.##6.162.219':445
'82.##6.70.139':445
'82.##6.69.91':445
'82.##6.102.6':139
'82.##6.56.211':139
'82.##6.42.134':445
'82.##6.114.93':445
'82.##6.123.16':445
'82.##6.225.75':139
'82.##6.12.106':139
'82.##6.172.93':139
'82.##6.145.172':139
'82.##6.48.13':139
'82.##6.14.133':139
'82.##6.207.78':139
'82.##6.74.137':139
'82.##6.24.30':139
'82.##6.93.54':139
'82.##6.222.208':139
'82.##6.245.113':139
'82.##6.237.180':139
'82.##6.208.237':139
'82.##6.196.154':139
'82.##6.141.5':139
'82.##6.227.36':139
'82.##6.222.195':139
'82.##6.13.69':139
'82.#46.4.78':445
'82.##6.182.32':445
'82.##6.70.225':445
'82.##6.127.243':445
'82.##6.96.241':445
'82.##6.161.17':445
'82.##6.189.235':445
'82.##6.219.197':445
'82.##6.47.247':445
'82.##6.79.13':445
'82.##6.18.135':139
'82.##6.39.23':139
'82.##6.162.219':139
'82.##6.70.139':139
'82.##6.69.91':139
'82.##6.84.48':445
'82.##6.224.18':445
'82.##6.42.134':139
'82.##6.114.93':139
'82.##6.119.14':445
'82.##6.58.32':445
'82.##6.136.42':139
'82.##6.28.128':139
'82.##6.58.252':445
'82.##6.113.173':445
'82.##6.195.44':445
'82.##6.107.65':445
'82.##6.195.2':445
'82.##6.173.251':139
'82.##6.129.8':139
'82.##6.217.118':139
'82.##6.135.183':139
'82.##6.92.169':139
'82.##6.106.45':139
'82.##6.74.197':139
'82.##6.30.206':139
'82.##6.113.58':139
'82.##6.98.140':139
'82.##6.223.214':445
'82.##6.68.224':445
'82.##6.147.78':445
'82.##6.43.83':445
'82.##6.48.122':445
'82.##6.193.155':445
'82.##6.99.197':445
'82.##6.99.170':445
'82.##6.3.147':445
'82.##6.31.132':445
'82.#46.53.0':445
'82.##6.216.36':445
'82.##6.233.117':445
'82.##6.187.121':445
'82.##6.137.228':445
'82.##6.1.214':445
'82.#46.14.5':445
'82.##6.223.52':445
'82.##6.173.110':445
'82.##6.12.53':139
'82.##6.223.52':139
'82.##6.173.110':139
'82.##6.216.36':139
'82.##6.137.228':139
'82.##6.1.214':139
'82.##6.147.78':139
'82.##6.43.83':139
'82.#46.14.5':139
'82.##6.31.132':139
'82.#46.53.0':139
'82.##6.119.14':139
'82.##6.58.252':139
'82.##6.107.65':139
'82.##6.58.32':139
'82.##6.195.2':139
'82.##6.233.117':139
'82.##6.187.121':139
'82.##6.113.173':139
'82.##6.195.44':139
'82.##6.104.191':139
'82.##6.208.44':139
'82.##6.5.174':139
'82.##6.180.150':139
'82.##6.110.208':139
'82.##6.46.224':139
'82.##6.156.104':139
'82.##6.213.110':139
'82.##6.17.86':139
'82.##6.174.121':139
'82.##6.48.122':139
'82.##6.99.170':139
'82.##6.223.214':139
'82.##6.68.224':139
'82.##6.3.147':139
'82.##6.187.99':139
'82.##6.121.187':139
'82.##6.193.155':139
'82.##6.99.197':139
'82.##6.187.99':445
'82.##6.188.41':139
'82.##6.238.49':139
'82.##6.116.116':139
'82.##6.3.219':139
'82.##6.100.238':139
'82.##6.254.63':139
'82.##6.81.133':139
'82.##6.236.100':139
'82.##6.9.236':139
'82.##6.116.193':139
'82.##6.68.250':139
'82.##6.212.142':139
'82.##6.28.128':9988
'82.##6.26.29':139
'82.##6.101.178':139
'82.##6.99.61':139
'82.##6.141.62':139
'82.##6.173.125':139
'82.##6.53.250':139
'82.##6.172.160':139
'82.##6.177.229':139
'82.##6.75.170':139
'82.##6.23.104':139
'82.##6.113.43':139
'82.##6.77.216':139
'82.#46.95.5':139
'82.##6.118.118':139
'82.##6.158.48':139
'82.#46.6.79':139
'82.#46.11.6':139
'82.##6.50.210':139
'82.##6.22.97':139
'82.##6.94.138':139
'82.##6.104.152':139
'82.##6.99.114':139
'82.##6.222.158':139
'82.##6.26.104':139
'82.##6.155.218':139
'82.##6.136.42':9988
'82.##6.135.183':445
'82.##6.92.169':445
'82.##6.156.104':445
'82.##6.12.53':445
'82.##6.129.8':445
'82.##6.113.58':445
'82.##6.98.140':445
'82.##6.217.118':445
'82.##6.106.45':445
'82.##6.46.224':445
'82.##6.5.174':445
'82.##6.180.150':445
'82.##6.121.187':445
'82.##6.174.121':445
'82.##6.104.191':445
'82.##6.213.110':445
'82.##6.17.86':445
'82.##6.208.44':445
'82.##6.110.208':445
'82.##6.223.214':9988
'82.##6.68.224':9988
'82.##6.223.52':9988
'82.##6.173.110':9988
'82.##6.48.122':9988
'82.##6.174.121':9988
'82.##6.46.224':9988
'82.##6.99.170':9988
'82.##6.121.187':9988
'82.##6.137.228':9988
'82.##6.173.251':445
'82.##6.136.42':445
'82.##6.74.197':445
'82.##6.30.206':445
'82.##6.28.128':445
'82.#46.53.0':9988
'82.##6.216.36':9988
'82.##6.58.252':9988
'82.##6.58.32':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней