Trojan.Starman.6012

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc522.dir00\svchost.exe.mdmp 16325836412032104

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc522.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'20#.23.26.6':139
'20#.#3.68.60':139
'20#.#3.5.174':139
'20#.#3.77.42':139
'20#.#3.189.94':139
'20#.#3.135.48':139
'20#.#3.95.252':139
'20#.#3.254.254':139
'20#.#3.103.190':139
'20#.#3.229.232':139
'20#.#3.161.93':139
'20#.#3.28.174':139
'20#.#3.97.173':139
'20#.#3.29.124':445
'20#.#3.122.2':139
'20#.#3.170.201':139
'20#.#3.97.73':139
'20#.#3.45.112':139
'20#.23.83.9':139
'20#.#3.37.214':139
'20#.#3.83.149':139
'20#.23.26.6':445
'20#.#3.68.60':445
'20#.#3.5.174':445
'20#.#3.77.42':445
'20#.#3.189.94':445
'20#.#3.135.48':445
'20#.#3.95.252':445
'20#.#3.254.254':445
'20#.#3.103.190':445
'20#.#3.229.232':445
'20#.#3.161.93':445
'20#.#3.28.174':445
'20#.#3.97.173':445
'20#.#3.44.173':139
'20#.#3.122.2':445
'20#.#3.170.201':445
'20#.#3.97.73':445
'20#.#3.45.112':445
'20#.23.83.9':445
'20#.#3.37.214':445
'20#.#3.71.243':445
'20#.#3.134.72':445
'20#.#3.149.27':445
'20#.#3.21.65':139
'20#.#3.29.124':139
'20#.#3.51.162':445
'20#.#3.48.37':445
'20#.#3.162.170':445
'20#.#3.14.76':445
'20#.#3.247.244':445
'20#.#3.202.68':139
'20#.#3.202.196':139
'20#.#3.62.98':139
'20#.#3.56.57':139
'20#.#3.85.167':139
'20#.#3.215.214':139
'20#.#3.65.161':139
'20#.#3.254.75':139
'20#.#3.182.227':139
'20#.#3.82.173':139
'20#.#3.210.220':445
'20#.#3.202.196':445
'20#.#3.182.227':445
'20#.#3.202.68':445
'20#.#3.85.167':445
'20#.#3.62.98':445
'20#.#3.65.161':445
'20#.#3.21.65':445
'20#.#3.215.214':445
'20#.#3.82.173':445
'20#.#3.254.75':445
'20#.#3.255.250':445
'20#.#3.64.223':445
'20#.#3.45.190':445
'20#.#3.115.210':445
'20#.#3.16.179':445
'20#.#3.102.200':445
'20#.#3.56.57':445
'20#.#3.200.113':445
'20#.#3.23.190':445
'20#.#3.206.107':445
'20#.#3.83.149':445
'20#.#3.0.141':445
'20#.#3.56.35':445
'20#.#3.103.235':445
'20#.#3.219.79':445
'20#.#3.229.194':445
'20#.#3.17.215':445
'20#.#3.16.235':445
'20#.#3.161.103':445
'20#.#3.233.216':445
'20#.#3.206.233':445
'20#.#3.131.16':445
'20#.#3.129.35':445
'20#.#3.48.166':445
'20#.23.0.10':445
'20#.#3.165.222':445
'20#.#3.36.130':445
'20#.#3.16.47':445
'20#.#3.123.239':445
'20#.#3.51.195':445
'20#.#3.54.83':445
'20#.#3.108.16':139
'20#.#3.213.33':139
'20#.#3.160.212':139
'20#.#3.99.21':139
'20#.#3.89.178':139
'20#.#3.180.216':139
'20#.#3.169.159':139
'20#.#3.200.23':139
'20#.#3.126.249':139
'20#.#3.93.157':139
'20#.#3.204.119':139
'20#.#3.93.192':139
'20#.#3.45.32':139
'20#.#3.2.197':139
'20#.23.4.64':139
'20#.#3.175.5':139
'20#.#3.216.86':139
'20#.#3.31.249':139
'20#.#3.205.10':139
'20#.#3.224.126':139
'20#.#3.41.31':139
'20#.#3.48.166':139
'20#.#3.131.16':139
'20#.#3.165.222':139
'20#.#3.174.204':139
'20#.23.0.10':139
'20#.#3.123.239':139
'20#.#3.36.130':139
'20#.#3.54.83':139
'20#.#3.129.35':139
'20#.#3.51.195':139
'20#.#3.136.57':139
'20#.23.9.97':139
'20#.#3.247.61':139
'20#.#3.44.173':445
'20#.23.6.97':139
'20#.#3.78.76':139
'20#.#3.204.108':139
'20#.#3.36.200':139
'20#.#3.107.169':139
'20#.23.2.8':139
'20#.#3.16.47':139
'20#.23.9.97':445
'20#.#3.107.169':445
'20#.#3.136.57':445
'20#.23.6.97':445
'20#.#3.247.61':445
'20#.#3.204.108':445
'20#.#3.174.204':445
'20#.#3.78.76':445
'20#.23.2.8':445
'20#.#3.36.200':445
'20#.#3.0.141':139
'20#.#3.56.35':139
'20#.#3.103.235':139
'20#.#3.219.79':139
'20#.#3.229.194':139
'20#.#3.17.215':139
'20#.#3.16.235':139
'20#.#3.161.103':139
'20#.#3.233.216':139
'20#.#3.206.233':139
'20#.#3.102.200':139
'20#.23.4.11':445
'20#.#3.9.231':445
'20#.#3.206.42':445
'20#.#3.57.205':445
'20#.#3.10.135':445
'20#.#3.71.16':445
'20#.#3.208.46':445
'20#.#3.16.109':445
'20#.#3.109.41':445
'20#.#3.190.14':445
'20#.#3.174.166':139
'20#.#3.202.166':139
'20#.#3.56.237':139
'20#.#3.16.206':139
'20#.#3.205.62':139
'20#.#3.15.173':139
'20#.#3.20.87':139
'20#.23.27.7':139
'20#.#3.48.216':139
'20#.#3.252.104':139
'20#.#3.103.62':445
'20#.#3.220.90':445
'20#.#3.28.24':445
'20#.#3.17.187':445
'20#.#3.120.139':445
'20#.#3.28.102':445
'20#.#3.131.92':445
'20#.#3.87.38':445
'20#.#3.130.132':445
'20#.#3.26.79':445
'20#.#3.13.229':445
'20#.#3.172.154':445
'20#.#3.238.46':445
'20#.#3.248.114':445
'20#.#3.48.93':445
'20#.#3.194.67':445
'20#.#3.53.107':445
'20#.#3.181.145':445
'20#.#3.12.87':445
'20#.#3.227.21':445
'20#.#3.114.172':445
'20#.#3.238.46':139
'20#.#3.227.21':139
'20#.#3.103.62':139
'20#.#3.194.67':139
'20#.#3.48.93':139
'20#.#3.12.87':139
'20#.#3.53.107':139
'20#.#3.248.114':139
'20#.#3.172.154':139
'20#.#3.114.172':139
'20#.23.4.11':139
'20#.#3.9.231':139
'20#.#3.57.205':139
'20#.#3.10.135':139
'20#.#3.206.42':139
'20#.#3.71.16':139
'20#.#3.208.46':139
'20#.#3.16.109':139
'20#.#3.190.14':139
'20#.#3.109.41':139
'20#.#3.181.145':139
'20#.#3.25.198':139
'20#.#3.139.73':139
'20#.#3.137.162':139
'20#.#3.38.30':139
'20#.#3.87.38':139
'20#.#3.166.62':139
'20#.#3.254.109':139
'20#.#3.62.58':139
'20#.#3.29.139':139
'20#.#3.58.30':139
'20#.#3.220.90':139
'20#.#3.28.24':139
'20#.#3.17.187':139
'20#.#3.120.139':139
'20#.#3.28.102':139
'20#.#3.131.92':139
'20#.#3.34.92':139
'20#.#3.130.132':139
'20#.#3.26.79':139
'20#.#3.13.229':139
'20#.#3.38.30':445
'20#.#3.73.123':445
'20#.#3.62.64':445
'20#.#3.115.224':445
'20#.#3.245.38':445
'20#.#3.110.198':445
'20#.#3.80.47':445
'20#.#3.73.67':445
'20#.#3.34.33':445
'20#.#3.14.71':445
'20#.#3.255.92':445
'20#.#3.98.46':139
'20#.#3.130.234':139
'20#.#3.73.67':139
'20#.#3.34.33':139
'20#.#3.80.47':139
'20#.23.8.97':445
'20#.#3.23.94':445
'20#.#3.250.62':445
'20#.#3.207.218':139
'20#.#3.165.249':139
'20#.#3.98.46':445
'20#.#3.16.179':139
'20#.#3.45.190':139
'20#.#3.115.210':139
'20#.#3.48.37':139
'20#.#3.210.220':139
'20#.#3.206.107':139
'20#.#3.200.113':139
'20#.#3.23.190':139
'20#.#3.255.250':139
'20#.#3.64.223':139
'20#.#3.149.27':139
'20#.#3.71.243':139
'20#.#3.165.249':445
'20#.#3.130.234':445
'20#.#3.207.218':445
'20#.#3.162.170':139
'20#.#3.51.162':139
'20#.#3.247.244':139
'20#.#3.134.72':139
'20#.#3.14.76':139
'20#.#3.252.104':445
'20#.#3.48.216':445
'20#.#3.174.166':445
'20#.#3.166.62':445
'20#.#3.56.237':445
'20#.23.27.7':445
'20#.#3.57.205':9988
'20#.#3.20.87':445
'20#.#3.202.166':445
'20#.#3.15.173':445
'20#.#3.25.198':445
'20#.#3.254.109':445
'20#.#3.139.73':445
'20#.#3.137.162':445
'20#.#3.34.92':445
'20#.#3.62.58':445
'20#.#3.29.139':445
'20#.#3.58.30':445
'20#.#3.16.206':445
'20#.#3.205.62':445
'20#.#3.10.135':9988
'20#.#3.245.38':139
'20#.#3.110.198':139
'20#.#3.23.94':139
'20#.#3.250.62':139
'20#.23.8.97':139
'20#.#3.14.71':139
'20#.#3.255.92':139
'20#.#3.62.64':139
'20#.#3.115.224':139
'20#.#3.73.123':139
'20#.#3.172.154':9988
'20#.#3.227.21':9988
'20#.#3.103.62':9988
'20#.#3.206.42':9988
'20#.#3.190.14':9988
'20#.#3.139.73':9988
'20#.#3.254.109':9988
'20#.#3.28.24':9988
'20#.#3.28.102':9988
'20#.#3.220.90':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней