Trojan.Starman.5996

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2674.dir00\svchost.exe.mdmp 16325836412032176

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2674.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.##0.141.72':139
'64.##0.29.142':139
'64.##0.140.216':139
'64.##0.53.106':139
'64.##0.77.28':139
'64.##0.76.217':139
'64.##0.158.18':139
'64.##0.106.2':139
'64.##0.26.194':139
'64.##0.44.85':139
'64.##0.1.116':139
'64.##0.34.11':139
'64.##0.2.174':139
'64.##0.213.188':139
'64.##0.47.225':139
'64.##0.155.19':139
'64.##0.49.155':139
'64.##0.113.198':139
'64.##0.46.27':139
'64.##0.120.46':139
'64.##0.239.31':139
'64.##0.1.116':445
'64.##0.34.11':445
'64.##0.2.174':445
'64.##0.213.188':445
'64.##0.47.225':445
'64.##0.155.19':445
'64.##0.49.155':445
'64.##0.113.198':445
'64.##0.46.27':445
'64.##0.120.46':445
'64.##0.78.108':445
'64.##0.64.207':445
'64.#20.7.31':445
'64.##0.225.190':445
'64.##0.84.206':445
'64.#20.7.22':445
'64.##0.164.77':445
'64.##0.63.211':445
'64.##0.143.177':445
'64.##0.55.112':445
'64.##0.21.206':445
'64.##0.20.102':445
'64.##0.42.231':445
'64.##0.93.129':139
'64.##0.120.98':445
'64.##0.160.104':445
'64.##0.131.3':445
'64.##0.220.163':445
'64.##0.124.71':445
'64.##0.115.139':445
'64.##0.139.215':139
'64.##0.84.115':139
'64.##0.2.224':139
'64.##0.105.85':139
'64.##0.49.75':139
'64.##0.141.240':139
'64.##0.12.239':139
'64.##0.74.84':139
'64.##0.31.189':139
'64.##0.115.95':139
'64.##0.105.85':445
'64.##0.78.108':139
'64.##0.64.207':139
'64.#20.7.31':139
'64.##0.225.190':139
'64.##0.84.206':139
'64.#20.7.22':139
'64.##0.164.77':139
'64.##0.63.211':139
'64.##0.143.177':139
'64.##0.55.112':139
'64.##0.84.115':445
'64.##0.31.189':445
'64.##0.139.215':445
'64.##0.49.75':445
'64.##0.2.224':445
'64.##0.12.239':445
'64.##0.93.129':445
'64.##0.141.240':445
'64.##0.115.95':445
'64.##0.74.84':445
'64.##0.217.66':139
'64.##0.206.217':139
'64.##0.249.76':139
'64.##0.22.182':139
'64.##0.34.41':139
'64.##0.58.236':139
'64.##0.56.247':139
'64.##0.68.150':139
'64.##0.165.59':139
'64.##0.22.166':139
'64.##0.210.25':445
'64.##0.163.209':445
'64.##0.139.43':445
'64.##0.126.121':445
'64.##0.84.129':445
'64.##0.226.68':445
'64.##0.73.218':445
'64.##0.68.57':445
'64.##0.31.127':445
'64.##0.41.117':445
'64.##0.217.124':139
'64.##0.252.89':139
'64.##0.113.191':139
'64.##0.144.71':139
'64.##0.82.76':139
'64.##0.108.129':139
'64.##0.92.144':139
'64.##0.10.12':139
'64.##0.144.55':139
'64.##0.18.114':139
'64.##0.56.18':139
'64.##0.50.172':139
'64.##0.29.131':139
'64.##0.209.27':139
'64.##0.25.214':139
'64.##0.5.167':139
'64.##0.81.56':139
'64.#20.3.6':139
'64.##0.71.42':139
'64.##0.120.35':139
'64.##0.54.60':139
'64.##0.101.217':139
'64.##0.166.187':139
'64.##0.145.251':139
'64.##0.239.31':445
'64.##0.5.208':139
'64.##0.116.10':139
'64.##0.39.53':139
'64.##0.243.211':139
'64.##0.159.43':139
'64.##0.120.211':139
'64.##0.141.72':445
'64.##0.29.142':445
'64.##0.140.216':445
'64.##0.53.106':445
'64.##0.77.28':445
'64.##0.76.217':445
'64.##0.158.18':445
'64.##0.106.2':445
'64.##0.26.194':445
'64.##0.44.85':445
'64.##0.151.29':139
'64.##0.166.187':445
'64.##0.159.43':445
'64.##0.101.217':445
'64.##0.5.208':445
'64.##0.145.251':445
'64.##0.39.53':445
'64.##0.151.29':445
'64.##0.116.10':445
'64.##0.120.211':445
'64.##0.243.211':445
'64.##0.210.25':139
'64.##0.163.209':139
'64.##0.139.43':139
'64.##0.126.121':139
'64.##0.84.129':139
'64.##0.226.68':139
'64.##0.73.218':139
'64.##0.68.57':139
'64.##0.31.127':139
'64.##0.41.117':139
'64.##0.131.3':139
'64.##0.67.32':445
'64.##0.34.245':445
'64.##0.118.189':445
'64.##0.230.212':445
'64.##0.123.54':445
'64.##0.216.48':445
'64.##0.96.246':445
'64.##0.228.50':445
'64.##0.142.34':445
'64.##0.26.72':445
'64.##0.54.183':139
'64.##0.166.184':139
'64.##0.253.203':139
'64.##0.234.90':139
'64.##0.203.234':139
'64.##0.137.53':139
'64.##0.21.32':139
'64.##0.215.42':139
'64.##0.0.166':139
'64.#20.43.0':139
'64.##0.104.139':445
'64.##0.85.10':445
'64.##0.185.39':445
'64.##0.82.119':445
'64.##0.135.7':445
'64.##0.192.96':445
'64.##0.99.232':445
'64.##0.209.223':445
'64.##0.254.58':445
'64.##0.126.91':445
'64.##0.190.250':445
'64.##0.111.105':445
'64.##0.231.19':445
'64.##0.5.139':445
'64.##0.116.169':445
'64.##0.37.136':445
'64.##0.119.197':445
'64.##0.58.53':445
'64.##0.241.175':445
'64.##0.7.108':445
'64.##0.69.208':445
'64.##0.5.139':139
'64.##0.111.105':139
'64.##0.37.136':139
'64.##0.96.246':139
'64.##0.116.169':139
'64.##0.241.175':139
'64.##0.119.197':139
'64.##0.69.208':139
'64.##0.231.19':139
'64.##0.7.108':139
'64.##0.67.32':139
'64.##0.34.245':139
'64.##0.118.189':139
'64.##0.123.54':139
'64.##0.230.212':139
'64.##0.104.139':139
'64.##0.216.48':139
'64.##0.228.50':139
'64.##0.142.34':139
'64.##0.26.72':139
'64.##0.58.53':139
'64.##0.216.92':139
'64.##0.141.29':139
'64.##0.163.228':139
'64.##0.160.177':139
'64.##0.223.226':139
'64.#20.1.38':139
'64.##0.91.51':139
'64.##0.148.213':139
'64.##0.91.140':139
'64.##0.81.91':139
'64.##0.85.10':139
'64.##0.185.39':139
'64.##0.82.119':139
'64.##0.135.7':139
'64.##0.192.96':139
'64.##0.99.232':139
'64.##0.209.223':139
'64.##0.254.58':139
'64.##0.126.91':139
'64.##0.190.250':139
'64.##0.212.9':139
'64.#20.81.3':445
'64.##0.247.119':139
'64.##0.19.226':139
'64.#20.19.8':139
'64.##0.102.52':445
'64.##0.135.18':445
'64.##0.252.212':445
'64.##0.30.81':445
'64.##0.82.139':445
'64.##0.100.47':139
'64.##0.206.221':139
'64.##0.184.92':139
'64.##0.135.18':139
'64.##0.92.124':139
'64.##0.164.251':139
'64.##0.225.169':139
'64.##0.166.9':139
'64.##0.236.175':139
'64.##0.24.152':139
'64.##0.92.124':445
'64.##0.42.231':139
'64.##0.21.206':139
'64.##0.120.98':139
'64.##0.247.119':445
'64.##0.212.9':445
'64.##0.220.163':139
'64.##0.160.104':139
'64.##0.115.139':139
'64.##0.20.102':139
'64.##0.124.71':139
'64.##0.236.175':445
'64.##0.24.152':445
'64.##0.206.221':445
'64.##0.184.92':445
'64.##0.100.47':445
'64.##0.19.226':445
'64.#20.19.8':445
'64.##0.225.169':445
'64.##0.166.9':445
'64.##0.164.251':445
'64.##0.54.183':445
'64.##0.166.184':445
'64.##0.253.203':445
'64.##0.234.90':445
'64.##0.203.234':445
'64.##0.137.53':445
'64.##0.21.32':445
'64.##0.215.42':445
'64.##0.0.166':445
'64.#20.43.0':445
'64.##0.216.92':445
'64.##0.141.29':445
'64.##0.163.228':445
'64.##0.160.177':445
'64.##0.223.226':445
'64.#20.1.38':445
'64.##0.91.51':445
'64.##0.148.213':445
'64.##0.91.140':445
'64.##0.81.91':445
'64.##0.230.212':9988
'64.#20.1.38':9988
'64.##0.234.90':9988
'64.##0.141.29':9988
'64.##0.160.177':9988
'64.##0.223.226':9988
'64.##0.252.212':139
'64.##0.102.52':139
'64.##0.82.139':139
'64.#20.81.3':139
'64.##0.30.81':139
'64.##0.104.139':9988
'64.##0.231.19':9988
'64.##0.228.50':9988
'64.##0.123.54':9988
'64.##0.118.189':9988
'64.##0.192.96':9988
'64.##0.209.223':9988
'64.##0.135.7':9988
'64.##0.7.108':9988
'64.##0.69.208':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней