Trojan.Starman.6502

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER34d3.dir00\svchost.exe.mdmp 16325836412032232

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER34d3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'63.##.83.139':139
'63.##.37.170':139
'63.##.79.250':139
'63.##.140.119':139
'63.#3.3.168':139
'63.##.84.236':139
'63.##.25.153':139
'63.##.61.246':139
'63.##.151.249':139
'63.#3.35.49':139
'63.#3.22.29':139
'63.##.179.107':139
'63.#3.9.166':139
'63.#3.10.24':139
'63.##.57.125':139
'63.##.213.136':139
'63.#3.5.231':139
'63.#3.133.5':139
'63.##.161.197':139
'63.#3.54.47':139
'63.##.214.79':139
'63.##.48.160':139
'63.#3.54.47':445
'63.##.214.79':445
'63.#3.9.166':445
'63.#3.10.24':445
'63.##.179.107':445
'63.#3.22.29':445
'63.##.140.119':445
'63.#3.133.5':445
'63.##.161.197':445
'63.#3.5.231':445
'63.##.213.136':445
'63.##.29.227':139
'63.#3.28.46':139
'63.##.168.92':139
'63.##.148.165':139
'63.##.106.186':139
'63.##.168.181':445
'63.##.57.125':445
'63.#3.0.244':445
'63.##.90.115':139
'63.##.231.135':445
'63.#3.89.19':139
'63.##.149.27':139
'63.##.130.95':139
'63.##.133.213':139
'63.##.64.113':139
'63.##.67.212':139
'63.##.101.101':445
'63.##.194.124':139
'63.##.144.66':139
'63.##.38.251':139
'63.##.209.154':139
'63.##.218.72':139
'63.#3.7.35':139
'63.#3.78.85':139
'63.##.101.101':139
'63.#3.8.43':139
'63.##.88.135':139
'63.##.197.15':139
'63.#3.14.95':139
'63.##.62.109':139
'63.##.254.236':139
'63.#3.8.43':445
'63.##.144.66':445
'63.##.38.251':445
'63.##.149.27':445
'63.##.130.95':445
'63.#3.89.19':445
'63.#3.0.244':139
'63.##.168.181':139
'63.##.231.135':139
'63.##.194.124':445
'63.##.67.212':445
'63.##.64.113':445
'63.##.62.109':445
'63.##.254.236':445
'63.#3.7.35':445
'63.#3.78.85':445
'63.##.218.72':445
'63.##.209.154':445
'63.##.133.213':445
'63.##.197.15':445
'63.#3.14.95':445
'63.##.88.135':445
'63.#3.3.168':445
'63.##.156.87':139
'63.#3.9.236':139
'63.#3.9.252':139
'63.##.71.254':445
'63.##.251.231':139
'63.#3.78.32':139
'63.##.211.209':139
'63.##.244.96':139
'63.##.125.210':139
'63.##.128.199':139
'63.#3.1.241':445
'63.##.85.125':445
'63.#3.49.75':445
'63.#3.7.14':445
'63.##.236.170':445
'63.#3.53.83':445
'63.##.46.169':445
'63.##.170.158':445
'63.##.188.217':445
'63.##.117.225':445
'63.##.218.117':445
'63.#3.17.14':139
'63.##.149.246':139
'63.##.164.149':139
'63.##.17.149':139
'63.##.82.112':139
'63.##.117.82':139
'63.#3.54.71':139
'63.##.136.46':139
'63.##.181.57':139
'63.##.129.73':139
'63.##.41.187':139
'63.#3.30.13':139
'63.##.150.189':139
'63.#3.33.81':139
'63.##.69.228':139
'63.##.27.169':139
'63.#3.23.58':139
'63.##.64.151':139
'63.##.152.109':139
'63.#3.9.153':139
'63.##.114.120':139
'63.##.102.119':139
'63.##.90.115':445
'63.#3.6.90':139
'63.#3.28.46':445
'63.##.168.92':445
'63.##.29.227':445
'63.##.141.66':139
'63.##.206.144':139
'63.##.167.215':139
'63.##.73.251':139
'63.##.28.235':139
'63.##.106.186':445
'63.##.151.249':445
'63.#3.35.49':445
'63.##.37.170':445
'63.##.79.250':445
'63.##.83.139':445
'63.##.48.160':445
'63.##.148.165':445
'63.##.25.153':445
'63.##.61.246':445
'63.##.84.236':445
'63.##.17.212':139
'63.##.73.251':445
'63.##.28.235':445
'63.#3.6.90':445
'63.#3.1.241':139
'63.##.71.254':139
'63.##.17.212':445
'63.##.110.201':445
'63.##.206.144':445
'63.##.167.215':445
'63.##.141.66':445
'63.##.170.158':139
'63.#3.7.14':139
'63.##.85.125':139
'63.#3.53.83':139
'63.##.110.201':139
'63.##.236.170':139
'63.##.188.217':139
'63.##.46.169':139
'63.##.218.117':139
'63.#3.49.75':139
'63.##.117.225':139
'63.##.221.235':445
'63.##.135.253':445
'63.##.45.135':445
'63.#3.254.5':445
'63.##.250.167':445
'63.##.25.172':445
'63.##.190.77':445
'63.##.109.25':445
'63.##.77.128':445
'63.##.177.45':445
'63.##.22.144':445
'63.##.194.140':445
'63.##.169.249':139
'63.##.51.131':139
'63.##.30.235':139
'63.##.110.190':139
'63.##.52.129':139
'63.##.67.226':445
'63.##.179.194':445
'63.##.89.118':139
'63.#3.66.81':139
'63.##.51.225':139
'63.##.143.171':445
'63.##.139.173':445
'63.##.92.214':445
'63.##.62.178':445
'63.##.58.121':445
'63.##.249.49':445
'63.#3.5.171':445
'63.#3.9.223':445
'63.##.31.206':445
'63.##.110.83':445
'63.#3.72.55':445
'63.##.130.235':445
'63.##.137.127':445
'63.#3.0.235':445
'63.#3.22.72':445
'63.#3.41.28':445
'63.#3.6.41':445
'63.##.74.246':445
'63.##.219.246':445
'63.#3.6.87':445
'63.##.81.166':445
'63.##.140.168':445
'63.#3.41.28':139
'63.#3.6.41':139
'63.##.143.171':139
'63.##.190.77':139
'63.##.109.25':139
'63.##.81.166':139
'63.##.140.168':139
'63.#3.0.235':139
'63.#3.22.72':139
'63.##.137.127':139
'63.##.77.128':139
'63.##.179.194':139
'63.##.25.172':139
'63.##.67.226':139
'63.##.194.140':139
'63.##.250.167':139
'63.##.177.45':139
'63.##.22.144':139
'63.##.45.135':139
'63.#3.254.5':139
'63.##.135.253':139
'63.#3.6.87':139
'63.##.218.216':139
'63.##.125.36':139
'63.##.113.31':139
'63.#3.5.171':139
'63.#3.9.223':139
'63.##.108.47':139
'63.#3.37.89':139
'63.##.225.240':139
'63.##.248.108':139
'63.##.10.173':139
'63.##.31.206':139
'63.##.58.121':139
'63.##.249.49':139
'63.##.130.235':139
'63.##.74.246':139
'63.##.219.246':139
'63.##.110.83':139
'63.#3.72.55':139
'63.##.92.214':139
'63.##.62.178':139
'63.##.139.173':139
'63.##.113.31':445
'63.##.75.134':445
'63.##.141.254':445
'63.##.145.211':445
'63.#3.19.7':139
'63.##.221.235':139
'63.##.38.228':445
'63.##.213.201':445
'63.##.228.214':445
'63.#3.87.74':445
'63.##.214.140':445
'63.##.46.146':139
'63.##.189.178':139
'63.##.219.157':139
'63.##.67.225':139
'63.##.56.121':139
'63.##.217.56':139
'63.#3.11.61':139
'63.##.229.18':139
'63.##.194.151':139
'63.#3.8.154':139
'63.##.152.244':139
'63.#3.52.84':445
'63.#3.8.154':445
'63.##.152.244':445
'63.##.219.157':445
'63.##.67.225':445
'63.##.189.178':445
'63.##.46.146':445
'63.#3.19.7':445
'63.##.229.18':445
'63.##.194.151':445
'63.#3.11.61':445
'63.##.217.56':445
'63.##.255.152':445
'63.##.21.194':445
'63.#3.54.64':445
'63.#3.89.31':445
'63.##.153.79':445
'63.##.121.63':445
'63.##.56.121':445
'63.#3.63.83':445
'63.##.206.111':445
'63.##.167.124':445
'63.##.89.118':445
'63.##.179.194':9988
'63.##.51.225':445
'63.##.51.131':445
'63.#3.66.81':445
'63.##.140.168':9988
'63.##.74.246':9988
'63.#3.41.28':9988
'63.##.67.226':9988
'63.##.22.144':9988
'63.##.169.249':445
'63.##.10.173':445
'63.##.225.240':445
'63.##.248.108':445
'63.##.218.216':445
'63.##.125.36':445
'63.##.52.129':445
'63.##.30.235':445
'63.##.110.190':445
'63.##.108.47':445
'63.#3.37.89':445
'63.##.219.246':9988
'63.#3.54.64':139
'63.##.255.152':139
'63.##.153.79':139
'63.#3.52.84':139
'63.#3.89.31':139
'63.#3.63.83':139
'63.##.121.63':139
'63.##.167.124':139
'63.##.21.194':139
'63.##.206.111':139
'63.##.213.201':139
'63.##.145.211':139
'63.##.75.134':139
'63.#3.72.55':9988
'63.##.139.173':9988
'63.##.110.83':9988
'63.##.228.214':139
'63.##.38.228':139
'63.##.214.140':139
'63.##.141.254':139
'63.#3.87.74':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней