Trojan.Starman.6387

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER18ee.dir00\svchost.exe.mdmp 16325836412032208

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER18ee.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'80.##.153.35':139
'80.##.78.172':139
'80.##.93.146':139
'80.##.126.224':139
'80.##.171.214':139
'80.##.72.159':139
'80.##.103.120':139
'80.##.20.166':139
'80.##.23.116':139
'80.##.100.161':139
'80.##.51.194':139
'80.##.148.157':139
'80.##.160.208':139
'80.##.79.110':139
'80.##.184.33':445
'80.##.110.150':445
'80.##.96.234':139
'80.##.193.230':139
'80.##.211.231':139
'80.#8.46.11':139
'80.#8.125.8':139
'80.##.171.214':445
'80.##.93.146':445
'80.##.126.224':445
'80.##.193.230':445
'80.##.51.194':445
'80.##.100.161':445
'80.##.20.166':445
'80.##.23.116':445
'80.##.153.35':445
'80.##.78.172':445
'80.##.96.234':445
'80.#8.210.4':139
'80.##.79.110':445
'80.##.239.41':139
'80.##.243.187':139
'80.##.41.199':139
'80.#8.125.8':445
'80.##.211.231':445
'80.#8.46.11':445
'80.##.148.157':445
'80.##.160.208':445
'80.##.43.103':445
'80.##.43.103':139
'80.##.184.33':139
'80.##.208.93':139
'80.##.217.120':139
'80.##.93.217':139
'80.#8.15.0':445
'80.##.212.207':445
'80.#8.31.10':445
'80.##.110.150':139
'80.#8.221.1':445
'80.##.117.72':139
'80.##.123.111':139
'80.#8.239.7':139
'80.#8.5.205':139
'80.##.224.57':139
'80.#8.8.232':139
'80.##.201.130':139
'80.##.48.248':139
'80.##.136.100':139
'80.#8.55.35':139
'80.##.212.251':139
'80.##.136.100':445
'80.##.201.130':445
'80.##.212.251':445
'80.#8.239.7':445
'80.#8.55.35':445
'80.##.93.217':445
'80.##.208.93':445
'80.##.217.120':445
'80.##.48.248':445
'80.##.117.72':445
'80.##.123.111':445
'80.##.199.60':445
'80.#8.1.156':445
'80.##.185.121':445
'80.##.156.130':445
'80.##.120.113':445
'80.#8.8.232':445
'80.#8.5.205':445
'80.##.224.57':445
'80.##.175.154':445
'80.##.34.216':445
'80.##.18.115':445
'80.##.151.21':445
'80.##.115.63':445
'80.##.247.26':445
'80.#8.63.34':445
'80.#8.17.26':139
'80.##.24.104':139
'80.##.243.50':445
'80.##.23.205':445
'80.##.164.150':445
'80.##.140.199':445
'80.##.243.250':445
'80.##.176.243':445
'80.##.251.91':445
'80.##.176.159':445
'80.#8.98.97':445
'80.#8.59.40':445
'80.##.162.59':445
'80.##.39.149':445
'80.##.96.176':445
'80.##.149.96':445
'80.##.109.120':139
'80.##.106.148':139
'80.##.204.40':139
'80.##.97.138':139
'80.##.211.11':139
'80.##.144.213':139
'80.##.110.148':139
'80.##.25.185':139
'80.##.239.123':139
'80.##.189.148':139
'80.##.49.151':139
'80.##.72.251':139
'80.##.144.72':139
'80.##.60.138':139
'80.#8.9.56':139
'80.##.165.251':139
'80.##.116.149':139
'80.##.240.123':139
'80.##.156.155':139
'80.##.89.144':139
'80.##.155.89':139
'80.#8.7.112':445
'80.#8.7.112':139
'80.##.176.159':139
'80.#8.4.247':139
'80.##.77.193':139
'80.##.14.123':139
'80.##.176.243':139
'80.##.96.176':139
'80.##.243.250':139
'80.#8.98.97':139
'80.##.251.91':139
'80.#8.23.91':139
'80.##.41.199':445
'80.##.239.41':445
'80.##.243.187':445
'80.##.72.159':445
'80.##.103.120':445
'80.##.103.250':139
'80.#8.58.78':139
'80.#8.56.29':139
'80.#8.210.4':445
'80.#8.1.59':139
'80.#8.56.29':445
'80.##.103.250':445
'80.#8.1.59':445
'80.##.164.150':139
'80.##.243.50':139
'80.##.14.123':445
'80.#8.4.247':445
'80.##.77.193':445
'80.#8.58.78':445
'80.#8.23.91':445
'80.##.23.205':139
'80.##.162.59':139
'80.##.140.199':139
'80.#8.59.40':139
'80.##.149.96':139
'80.##.39.149':139
'80.##.18.115':139
'80.##.151.21':139
'80.##.115.63':139
'80.##.247.26':139
'80.#8.63.34':139
'80.##.25.165':445
'80.##.206.109':445
'80.#8.71.1':445
'80.#8.44.61':445
'80.##.101.228':445
'80.#8.2.188':445
'80.##.254.168':445
'80.##.153.218':445
'80.#8.75.14':445
'80.##.226.221':445
'80.##.151.186':445
'80.##.214.226':139
'80.##.51.250':139
'80.##.226.230':139
'80.##.153.81':139
'80.##.239.207':139
'80.##.40.159':445
'80.##.111.53':445
'80.##.113.63':139
'80.##.196.128':139
'80.##.199.33':139
'80.##.112.33':445
'80.##.126.73':445
'80.#8.76.53':445
'80.#8.2.168':445
'80.##.167.155':445
'80.##.28.131':445
'80.##.12.204':445
'80.##.223.251':445
'80.##.187.192':445
'80.##.124.226':445
'80.##.255.20':445
'80.##.51.110':445
'80.##.246.67':445
'80.#8.52.59':445
'80.##.149.153':445
'80.##.58.223':445
'80.##.231.80':445
'80.#8.62.99':445
'80.##.80.251':445
'80.#8.6.219':445
'80.#8.251.5':445
'80.##.102.45':139
'80.##.58.223':139
'80.#8.52.59':139
'80.##.149.153':139
'80.#8.2.188':139
'80.##.254.168':139
'80.#8.251.5':139
'80.##.80.251':139
'80.#8.6.219':139
'80.##.51.110':139
'80.##.246.67':139
'80.##.153.218':139
'80.#8.44.61':139
'80.##.101.228':139
'80.##.151.186':139
'80.##.111.53':139
'80.##.40.159':139
'80.#8.75.14':139
'80.##.226.221':139
'80.##.206.109':139
'80.#8.71.1':139
'80.##.25.165':139
'80.##.142.115':139
'80.##.100.144':139
'80.##.115.12':139
'80.##.28.131':139
'80.##.12.204':139
'80.##.131.62':139
'80.##.98.186':139
'80.##.239.182':139
'80.##.146.11':139
'80.##.131.135':139
'80.##.223.251':139
'80.#8.2.168':139
'80.##.167.155':139
'80.##.255.20':139
'80.##.231.80':139
'80.#8.62.99':139
'80.##.187.192':139
'80.##.124.226':139
'80.##.126.73':139
'80.#8.76.53':139
'80.##.112.33':139
'80.##.179.57':445
'80.##.253.10':445
'80.##.23.110':445
'80.##.185.135':445
'80.##.83.118':445
'80.#8.92.26':445
'80.##.134.219':445
'80.##.157.160':445
'80.##.19.219':445
'80.#8.41.71':445
'80.##.135.139':445
'80.##.40.175':139
'80.#8.72.1':139
'80.##.178.46':139
'80.##.251.243':139
'80.##.113.67':139
'80.##.52.149':139
'80.##.32.122':139
'80.##.142.97':139
'80.##.19.197':139
'80.##.90.102':139
'80.##.156.130':139
'80.##.120.113':139
'80.##.212.207':139
'80.#8.31.10':139
'80.#8.15.0':139
'80.##.175.154':139
'80.##.34.216':139
'80.#8.1.156':139
'80.##.185.121':139
'80.##.199.60':139
'80.#8.221.1':139
'80.##.40.175':445
'80.#8.72.1':445
'80.##.178.46':445
'80.##.251.243':445
'80.##.113.67':445
'80.##.52.149':445
'80.##.32.122':445
'80.##.142.97':445
'80.##.19.197':445
'80.##.90.102':445
'80.##.134.219':139
'80.##.196.128':445
'80.##.199.33':445
'80.##.51.250':445
'80.##.226.230':445
'80.##.214.226':445
'80.##.40.159':9988
'80.##.101.228':9988
'80.#8.44.61':9988
'80.##.113.63':445
'80.##.151.186':9988
'80.##.239.207':445
'80.##.146.11':445
'80.##.131.135':445
'80.##.100.144':445
'80.##.115.12':445
'80.##.142.115':445
'80.##.102.45':445
'80.##.153.81':445
'80.##.98.186':445
'80.##.239.182':445
'80.##.131.62':445
'80.##.23.110':139
'80.##.179.57':139
'80.##.83.118':139
'80.##.135.139':139
'80.##.185.135':139
'80.##.157.160':139
'80.#8.92.26':139
'80.#8.41.71':139
'80.##.253.10':139
'80.##.19.219':139
'80.##.115.12':9988
'80.##.254.168':9988
'80.##.58.223':9988
'80.#8.2.188':9988
'80.##.25.165':9988
'80.##.206.109':9988
'80.#8.76.53':9988
'80.##.187.192':9988
'80.##.231.80':9988
'80.##.51.110':9988
'80.#8.251.5':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней