Trojan.Starman.6386

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER08a3.dir00\svchost.exe.mdmp 16325836412032180

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER08a3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'21#.#5.94.14':445
'21#.#5.176.197':445
'21#.#5.222.155':445
'21#.#5.208.33':445
'21#.#5.65.113':445
'21#.#5.57.70':139
'21#.#5.179.117':139
'21#.#5.241.64':445
'21#.#5.217.223':139
'21#.#5.34.86':445
'21#.#5.71.56':445
'21#.#5.216.243':445
'21#.#5.12.67':445
'21#.#5.56.12':445
'21#.#5.54.167':445
'21#.#5.72.246':445
'21#.#5.156.72':445
'21#.#5.114.80':445
'21#.#5.246.128':445
'21#.#5.171.86':139
'21#.#5.242.211':139
'21#.#5.59.129':139
'21#.#5.238.173':139
'21#.#5.255.42':139
'21#.#5.92.112':139
'21#.#5.214.17':139
'21#.#5.111.212':139
'21#.85.4.93':139
'21#.#5.15.140':139
'21#.#5.174.177':139
'21#.#5.53.52':139
'21#.#5.53.15':139
'21#.#5.50.73':139
'21#.#5.154.217':139
'21#.#5.78.52':139
'21#.#5.124.101':139
'21#.#5.177.198':139
'21#.#5.80.78':139
'21#.#5.133.158':139
'21#.#5.80.83':445
'21#.#5.160.154':445
'21#.#5.132.70':445
'21#.#5.42.73':445
'21#.#5.67.26':445
'21#.#5.77.128':445
'21#.#5.174.87':445
'21#.#5.156.47':445
'21#.#5.86.176':445
'21#.#5.108.15':445
'21#.#5.65.113':139
'21#.#5.241.64':139
'21#.#5.94.14':139
'21#.#5.176.197':139
'21#.#5.158.55':445
'21#.#5.123.41':445
'21#.#5.53.159':445
'21#.#5.1.122':445
'21#.85.41.2':445
'21#.#5.120.237':445
'21#.#5.119.86':445
'21#.#5.196.119':445
'21#.#5.241.9':445
'21#.85.7.61':445
'21#.#5.57.150':445
'21#.#5.37.141':445
'21#.#5.102.42':445
'21#.#5.46.58':445
'21#.#5.70.46':445
'21#.85.9.66':445
'21#.#5.10.238':445
'21#.#5.246.15':445
'21#.#5.163.26':445
'21#.#5.198.0':445
'21#.#5.105.34':445
'21#.#5.175.137':445
'21#.#5.111.175':445
'21#.#5.71.120':445
'21#.#5.90.29':445
'21#.#5.78.251':139
'21#.#5.213.8':445
'21#.#5.28.60':445
'21#.#5.111.212':445
'21#.#5.78.251':445
'21#.#5.203.50':445
'21#.#5.159.224':445
'21#.#5.25.60':445
'21#.#5.123.188':445
'21#.#5.225.109':445
'21#.#5.214.17':445
'21#.#5.238.173':445
'21#.#5.255.42':445
'21#.#5.177.198':445
'21#.#5.174.177':445
'21#.#5.242.211':445
'21#.85.4.93':445
'21#.#5.15.140':445
'21#.#5.59.129':445
'21#.#5.92.112':445
'21#.#5.65.79':445
'21#.#5.168.30':445
'21#.#5.124.109':445
'21#.#5.198.36':445
'21#.#5.165.135':445
'21#.#5.108.166':445
'21#.#5.12.220':445
'21#.#5.134.73':445
'21#.#5.234.67':445
'21#.#5.63.234':445
'21#.#5.86.146':445
'21#.#5.45.16':445
'21#.#5.27.141':445
'21#.#5.54.239':445
'21#.#5.160.87':445
'21#.#5.126.53':445
'21#.#5.64.42':445
'21#.#5.124.192':445
'21#.#5.76.71':445
'21#.#5.148.127':445
'21#.#5.126.53':139
'21#.#5.76.71':139
'21#.#5.45.16':139
'21#.#5.27.141':139
'21#.#5.148.127':139
'21#.#5.86.146':139
'21#.#5.198.36':139
'21#.#5.64.42':139
'21#.#5.124.192':139
'21#.#5.160.87':139
'21#.#5.203.50':139
'21#.#5.123.188':139
'21#.#5.213.8':139
'21#.#5.28.60':139
'21#.#5.225.109':139
'21#.#5.65.79':139
'21#.#5.54.239':139
'21#.#5.159.224':139
'21#.#5.25.60':139
'21#.#5.165.135':139
'21#.#5.154.217':445
'21#.#5.53.52':445
'21#.#5.171.86':445
'21#.#5.50.73':445
'21#.#5.53.15':445
'21#.#5.133.158':445
'21#.#5.124.101':445
'21#.#5.78.52':445
'21#.#5.80.78':445
'21#.#5.179.117':445
'21#.#5.108.166':139
'21#.#5.234.67':139
'21#.#5.168.30':139
'21#.#5.124.109':139
'21#.#5.63.234':139
'21#.#5.217.223':445
'21#.#5.57.70':445
'21#.#5.12.220':139
'21#.#5.134.73':139
'21#.#5.208.33':139
'21#.#5.1.214':445
'21#.#5.157.1':445
'21#.#5.11.17':139
'21#.#5.78.143':139
'21#.#5.50.189':445
'21#.#5.218.73':445
'21#.#5.73.87':445
'21#.#5.75.248':445
'21#.#5.144.133':445
'21#.#5.45.248':139
'21#.#5.50.224':139
'21#.#5.144.63':139
'21#.#5.122.25':139
'21#.#5.106.189':139
'21#.#5.185.197':139
'21#.#5.44.249':139
'21#.85.35.6':139
'21#.#5.130.1':139
'21#.#5.30.142':139
'21#.#5.13.50':445
'21#.#5.99.251':445
'21#.#5.166.100':445
'21#.#5.184.40':445
'21#.#5.43.102':445
'21#.#5.239.197':445
'21#.#5.252.18':445
'21#.#5.199.56':445
'21#.#5.22.113':445
'21#.#5.228.76':445
'21#.#5.186.53':445
'21#.#5.57.239':445
'21#.#5.25.201':445
'21#.#5.122.104':445
'21#.#5.147.63':445
'21#.#5.40.24':445
'21#.#5.245.157':445
'21#.#5.25.76':445
'21#.#5.91.133':445
'21#.#5.196.14':445
'21#.#5.25.201':139
'21#.#5.91.133':139
'21#.#5.57.239':139
'21#.#5.40.24':139
'21#.#5.196.14':139
'21#.#5.186.53':139
'21#.#5.184.40':139
'21#.#5.245.157':139
'21#.#5.25.76':139
'21#.#5.122.104':139
'21#.#5.75.248':139
'21#.#5.144.133':139
'21#.#5.157.1':139
'21#.#5.73.87':139
'21#.#5.218.73':139
'21#.#5.13.50':139
'21#.#5.147.63':139
'21#.#5.1.214':139
'21#.#5.50.189':139
'21#.#5.43.102':139
'21#.#5.12.113':139
'21#.#5.200.129':139
'21#.#5.246.201':139
'21#.#5.163.149':139
'21#.#5.51.183':139
'21#.#5.148.52':139
'21#.#5.207.153':139
'21#.#5.80.51':139
'21#.#5.52.80':139
'21#.#5.93.149':139
'21#.#5.198.18':139
'21#.#5.239.197':139
'21#.#5.99.251':139
'21#.#5.252.18':139
'21#.#5.166.100':139
'21#.#5.22.113':139
'21#.#5.228.76':139
'21#.85.5.56':139
'21#.#5.199.56':139
'21#.#5.198.18':445
'21#.#5.246.15':139
'21#.#5.105.34':139
'21#.#5.198.0':139
'21#.#5.10.238':139
'21#.#5.71.120':139
'21#.#5.111.175':139
'21#.85.9.66':139
'21#.#5.90.29':139
'21#.#5.175.137':139
'21#.#5.163.26':139
'21#.#5.160.154':139
'21#.#5.67.26':139
'21#.#5.42.73':139
'21#.#5.80.83':139
'21#.#5.156.47':139
'21#.#5.174.87':139
'21#.#5.120.237':139
'21#.#5.86.176':139
'21#.#5.77.128':139
'21#.#5.241.9':139
'21#.#5.54.167':139
'21#.#5.114.80':139
'21#.#5.71.56':139
'21#.#5.216.243':139
'21#.#5.246.128':139
'21#.#5.222.155':139
'21#.#5.34.86':139
'21#.#5.72.246':139
'21#.#5.156.72':139
'21#.#5.56.12':139
'21#.#5.196.119':139
'21#.#5.57.150':139
'21#.85.7.61':139
'21#.#5.119.86':139
'21#.#5.46.58':139
'21#.#5.102.42':139
'21#.#5.12.67':139
'21#.#5.70.46':139
'21#.#5.37.141':139
'21#.#5.12.113':445
'21#.#5.246.201':445
'21#.#5.163.149':445
'21#.#5.200.129':445
'21#.#5.144.63':445
'21#.#5.30.142':445
'21#.85.35.6':445
'21#.#5.185.197':445
'21#.#5.130.1':445
'21#.#5.51.183':445
'21#.#5.50.224':445
'21#.#5.106.189':445
'21#.85.5.56':445
'21#.#5.93.149':445
'21#.#5.80.51':445
'21#.#5.122.25':445
'21#.#5.148.52':445
'21#.#5.52.80':445
'21#.#5.207.153':445
'21#.#5.44.249':445
'21#.#5.158.55':139
'21#.#5.1.122':139
'21#.#5.199.56':9988
'21#.#5.78.143':9988
'21#.85.41.2':139
'21#.#5.108.15':139
'21#.#5.132.70':139
'21#.#5.123.41':139
'21#.#5.53.159':139
'21#.#5.239.197':9988
'21#.#5.78.143':445
'21#.#5.13.50':9988
'21#.#5.45.248':445
'21#.#5.11.17':445
'21#.#5.196.14':9988
'21#.#5.245.157':9988
'21#.#5.144.63':9988
'21#.#5.147.63':9988
'21#.#5.91.133':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней