Trojan.Starman.6488

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERcb45.dir00\svchost.exe.mdmp 16325836412032144

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERcb45.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'81.##3.15.70':445
'81.##3.77.253':445
'81.##3.65.62':445
'81.##3.249.144':445
'81.##3.51.69':445
'81.##3.93.127':445
'81.##3.135.155':445
'81.##3.99.136':445
'81.##3.143.212':445
'81.##3.80.189':445
'81.##3.149.231':445
'81.##3.16.219':445
'81.##3.130.164':139
'81.##3.50.120':139
'81.##3.49.250':139
'81.##3.204.179':139
'81.##3.32.101':139
'81.##3.165.32':139
'81.##3.230.243':139
'81.##3.77.180':445
'81.##3.23.40':445
'81.##3.72.27':139
'81.##3.201.85':139
'81.##3.243.200':139
'81.##3.41.98':445
'81.##3.123.6':445
'81.##3.204.179':445
'81.##3.32.101':445
'81.##3.207.163':445
'81.##3.247.213':445
'81.##3.177.116':445
'81.##3.49.250':445
'81.##3.72.27':445
'81.##3.201.85':445
'81.##3.165.32':445
'81.##3.130.164':445
'81.##3.50.120':445
'81.##3.100.148':445
'81.##3.108.89':445
'81.##3.10.77':445
'81.##3.88.247':445
'81.##3.18.96':445
'81.##3.171.79':445
'81.##3.222.167':445
'81.##3.235.225':445
'81.##3.207.235':445
'81.##3.18.95':445
'81.##3.197.132':445
'81.##3.101.188':445
'81.##3.217.52':445
'81.##3.38.136':445
'81.##3.64.238':445
'81.##3.109.160':445
'81.##3.207.253':445
'81.##3.217.90':445
'81.##3.51.69':139
'81.##3.93.127':139
'81.##3.15.70':139
'81.##3.77.180':139
'81.##3.23.40':139
'81.##3.249.144':139
'81.##3.207.253':139
'81.##3.217.90':139
'81.##3.217.52':139
'81.##3.209.28':139
'81.##3.213.9':139
'81.##3.109.160':139
'81.##3.146.57':445
'81.##3.209.28':445
'81.##3.213.9':445
'81.##3.38.136':139
'81.##3.64.238':139
'81.##3.57.87':445
'81.##3.77.253':139
'81.##3.197.132':139
'81.##3.101.188':139
'81.##3.222.167':139
'81.##3.108.89':139
'81.##3.10.77':139
'81.##3.18.95':139
'81.##3.247.213':139
'81.##3.177.116':139
'81.##3.123.6':139
'81.##3.235.225':139
'81.##3.207.235':139
'81.##3.207.163':139
'81.##3.16.219':139
'81.##3.135.155':139
'81.##3.99.136':139
'81.##3.65.62':139
'81.##3.80.189':139
'81.##3.149.231':139
'81.##3.18.96':139
'81.##3.171.79':139
'81.##3.100.148':139
'81.##3.143.212':139
'81.##3.41.98':139
'81.##3.88.247':139
'81.##3.243.200':445
'81.##3.89.183':445
'81.##3.220.177':445
'81.##3.70.95':445
'81.##3.71.222':139
'81.##3.169.195':445
'81.##3.190.151':445
'81.##3.69.106':445
'81.##3.129.244':445
'81.##3.219.184':445
'81.##3.117.70':445
'81.##3.100.205':445
'81.##3.38.241':445
'81.##3.72.145':139
'81.##3.122.72':139
'81.##3.66.122':139
'81.##3.201.7':139
'81.##3.47.150':139
'81.##3.145.98':139
'81.##3.45.108':139
'81.##3.28.204':139
'81.##3.119.123':139
'81.##3.31.198':139
'81.##3.103.46':139
'81.##3.35.32':139
'81.##3.14.18':445
'81.##3.222.40':445
'81.##3.201.7':445
'81.##3.47.150':445
'81.##3.201.83':445
'81.##3.45.69':445
'81.##3.86.75':445
'81.##3.66.122':445
'81.##3.31.198':445
'81.##3.103.46':445
'81.##3.145.98':445
'81.##3.72.145':445
'81.##3.122.72':445
'81.##3.41.234':445
'81.##3.120.54':445
'81.##3.81.160':445
'81.##3.231.191':445
'81.##3.59.192':445
'81.##3.19.55':445
'81.##3.113.219':445
'81.##3.126.108':445
'81.##3.69.46':445
'81.##3.22.139':445
'81.##3.92.102':445
'81.##3.247.221':445
'81.##3.194.170':445
'81.##3.177.194':445
'81.##3.25.162':445
'81.##3.171.61':445
'81.##3.96.171':445
'81.##3.111.106':445
'81.##3.169.195':139
'81.##3.190.151':139
'81.##3.89.183':139
'81.##3.173.56':445
'81.##3.81.11':445
'81.##3.181.195':445
'81.##3.96.171':139
'81.##3.111.106':139
'81.##3.194.170':139
'81.##3.230.243':445
'81.##3.61.230':139
'81.##3.171.61':139
'81.##3.81.11':139
'81.##3.181.195':139
'81.##3.61.230':445
'81.##3.177.194':139
'81.##3.25.162':139
'81.##3.173.56':139
'81.##3.220.177':139
'81.##3.92.102':139
'81.##3.247.221':139
'81.##3.113.219':139
'81.##3.120.54':139
'81.##3.81.160':139
'81.##3.22.139':139
'81.##3.45.69':139
'81.##3.86.75':139
'81.##3.222.40':139
'81.##3.126.108':139
'81.##3.69.46':139
'81.##3.201.83':139
'81.##3.38.241':139
'81.##3.69.106':139
'81.##3.129.244':139
'81.##3.70.95':139
'81.##3.117.70':139
'81.##3.100.205':139
'81.##3.59.192':139
'81.##3.19.55':139
'81.##3.41.234':139
'81.##3.219.184':139
'81.##3.14.18':139
'81.##3.231.191':139
'81.##3.146.57':139
'81.##3.2.133':445
'81.##3.133.188':445
'81.##3.10.107':445
'81.##3.203.32':445
'81.##3.96.203':445
'81.##3.76.96':445
'81.##3.99.32':445
'81.##3.253.94':445
'81.##3.74.222':445
'81.##3.41.250':445
'81.##3.174.254':445
'81.##3.30.74':445
'81.##3.220.103':445
'81.##3.104.59':445
'81.##3.138.99':445
'81.##3.114.229':139
'81.##3.60.151':139
'81.##3.233.153':445
'81.##3.33.89':445
'81.##3.88.212':445
'81.##3.57.35':445
'81.##3.74.186':445
'81.##3.240.198':445
'81.##3.170.63':445
'81.##3.235.190':445
'81.##3.73.114':445
'81.##3.150.72':445
'81.##3.128.150':445
'81.##3.42.59':445
'81.##3.23.133':445
'81.##3.25.212':445
'81.##3.214.224':445
'81.##3.201.68':445
'81.##3.98.215':445
'81.##3.203.128':445
'81.##3.29.133':445
'81.##3.22.16':445
'81.##3.3.226':445
'81.##3.165.71':445
'81.##3.31.235':445
'81.##3.122.206':445
'81.##3.19.251':445
'81.##3.224.19':445
'81.##3.63.128':445
'81.##3.191.240':445
'81.##3.173.160':445
'81.##3.172.168':445
'81.##3.126.142':445
'81.##3.230.254':445
'81.##3.10.107':139
'81.##3.41.250':139
'81.##3.174.254':139
'81.##3.76.96':139
'81.##3.2.133':139
'81.##3.133.188':139
'81.##3.74.222':139
'81.##3.235.190':139
'81.##3.122.206':139
'81.##3.30.74':139
'81.##3.99.32':139
'81.##3.253.94':139
'81.##3.220.103':139
'81.##3.138.99':139
'81.##3.74.186':139
'81.##3.233.153':139
'81.##3.57.35':139
'81.##3.104.59':139
'81.##3.33.89':139
'81.##3.203.32':139
'81.##3.96.203':139
'81.##3.240.198':139
'81.##3.170.63':139
'81.##3.88.212':139
'81.##3.19.251':139
'81.##3.128.150':139
'81.##3.203.128':139
'81.##3.29.133':139
'81.##3.25.212':139
'81.##3.73.114':139
'81.##3.150.72':139
'81.##3.98.215':139
'81.##3.33.95':139
'81.##3.41.118':139
'81.##3.22.16':139
'81.##3.201.68':139
'81.##3.214.224':139
'81.##3.31.235':139
'81.##3.172.168':139
'81.##3.126.142':139
'81.##3.224.19':139
'81.##3.3.226':139
'81.##3.165.71':139
'81.##3.173.160':139
'81.##3.42.59':139
'81.##3.23.133':139
'81.##3.230.254':139
'81.##3.63.128':139
'81.##3.191.240':139
'81.##3.41.118':445
'81.##3.245.136':445
'81.##3.223.157':445
'81.##3.171.10':445
'81.##3.186.42':445
'81.##3.44.151':445
'81.##3.36.109':445
'81.##3.71.248':445
'81.##3.147.8':445
'81.##3.138.20':445
'81.##3.119.179':445
'81.##3.58.80':445
'81.##3.104.119':445
'81.##3.252.190':139
'81.##3.229.228':139
'81.##3.248.48':139
'81.##3.90.58':139
'81.##3.116.10':139
'81.##3.51.191':139
'81.##3.185.119':445
'81.##3.251.239':445
'81.##3.59.33':445
'81.##3.13.114':139
'81.##3.98.211':445
'81.##3.23.32':445
'81.##3.80.39':445
'81.##3.118.15':445
'81.##3.90.58':445
'81.##3.116.10':445
'81.##3.46.114':445
'81.##3.210.237':445
'81.##3.191.74':445
'81.##3.248.48':445
'81.##3.13.114':445
'81.##3.57.87':139
'81.##3.51.191':445
'81.##3.252.190':445
'81.##3.229.228':445
'81.##3.66.176':445
'81.##3.232.26':445
'81.##3.124.45':445
'81.##3.187.66':445
'81.##3.196.132':445
'81.##3.168.156':445
'81.##3.93.47':445
'81.##3.116.5':445
'81.##3.13.232':445
'81.##3.138.243':445
'81.##3.191.195':445
'81.##3.79.91':445
'81.##3.98.211':139
'81.##3.23.32':139
'81.##3.185.119':139
'81.##3.230.254':9988
'81.##3.73.114':9988
'81.##3.150.72':9988
'81.##3.44.151':139
'81.##3.36.109':139
'81.##3.245.136':139
'81.##3.251.239':139
'81.##3.59.33':139
'81.##3.186.42':139
'81.##3.33.89':9988
'81.##3.76.96':9988
'81.##3.2.133':9988
'81.##3.33.95':445
'81.##3.114.229':445
'81.##3.60.151':445
'81.##3.74.222':9988
'81.##3.165.71':9988
'81.##3.25.212':9988
'81.##3.10.107':9988
'81.##3.41.250':9988
'81.##3.30.74':9988
'81.##3.223.157':139
'81.##3.191.195':139
'81.##3.79.91':139
'81.##3.93.47':139
'81.##3.232.26':139
'81.##3.124.45':139
'81.##3.138.243':139
'81.##3.210.237':139
'81.##3.191.74':139
'81.##3.118.15':139
'81.##3.116.5':139
'81.##3.13.232':139
'81.##3.46.114':139
'81.##3.104.119':139
'81.##3.71.248':139
'81.##3.147.8':139
'81.##3.171.10':139
'81.##3.119.179':139
'81.##3.58.80':139
'81.##3.196.132':139
'81.##3.168.156':139
'81.##3.66.176':139
'81.##3.138.20':139
'81.##3.80.39':139
'81.##3.187.66':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней