Trojan.Starman.6410

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER575f.dir00\svchost.exe.mdmp 16325836412032148

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER575f.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'22#.#29.18.79':445
'22#.#29.172.26':445
'22#.#29.116.160':139
'22#.#29.7.19':139
'22#.#29.13.9':445
'22#.#29.176.74':445
'22#.#29.116.160':445
'22#.#29.19.215':445
'22#.#29.113.18':445
'22#.#29.78.196':445
'22#.#29.18.79':139
'22#.#29.41.22':445
'22#.#29.69.200':445
'22#.#29.172.26':139
'22#.#29.113.18':139
'22#.#29.176.74':139
'22#.#29.13.9':139
'22#.#29.19.215':139
'22#.#29.7.19':445
'22#.#29.245.251':139
'22#.#29.150.31':139
'22#.#29.11.59':139
'22#.#29.237.150':139
'22#.#29.144.55':139
'22#.#29.241.195':139
'22#.#29.40.135':139
'22#.#29.140.144':139
'22#.#29.195.139':139
'22#.#29.229.6':139
'22#.#29.132.202':139
'22#.#29.52.17':139
'22#.#29.60.160':139
'22#.#29.79.132':139
'22#.#29.13.127':139
'22#.#29.38.118':139
'22#.#29.2.215':139
'22#.#29.236.191':139
'22#.#29.19.158':445
'22#.#29.153.27':445
'22#.#29.138.216':445
'22#.#29.91.212':445
'22#.#29.180.134':445
'22#.#29.194.155':445
'22#.#29.250.253':445
'22#.#29.125.50':445
'22#.#29.58.27':445
'22#.#29.25.244':445
'22#.#29.46.183':445
'22#.#29.224.47':445
'22#.#29.139.66':445
'22#.#29.10.139':445
'22#.#29.238.225':445
'22#.#29.129.59':445
'22#.#29.212.113':445
'22#.#29.163.4':445
'22#.#29.156.34':445
'22#.#29.215.124':445
'22#.#29.16.74':445
'22#.#29.48.30':445
'22#.#29.214.62':445
'22#.#29.202.97':445
'22#.#29.114.153':445
'22#.#29.166.153':445
'22#.#29.216.142':445
'22#.#29.144.75':445
'22#.#29.5.151':445
'22#.#29.21.199':445
'22#.#29.170.6':445
'22#.#29.92.199':445
'22#.#29.216.222':445
'22#.#29.251.108':445
'22#.#29.179.226':445
'22#.#29.15.196':445
'22#.#29.75.145':445
'22#.#29.217.113':445
'22#.#29.214.51':139
'22#.#29.49.162':445
'22#.#29.50.175':445
'22#.#29.2.30':445
'22#.#29.161.157':445
'22#.#29.50.4':445
'22#.#29.178.149':445
'22#.#29.46.178':445
'22#.#29.166.53':445
'22#.#29.37.41':445
'22#.#29.241.195':445
'22#.#29.40.135':445
'22#.#29.140.144':445
'22#.#29.195.139':445
'22#.#29.214.51':445
'22#.#29.139.54':445
'22#.#29.124.139':445
'22#.#29.214.6':445
'22#.#29.54.79':445
'22#.#29.157.106':445
'22#.#29.66.66':139
'22#.#29.42.59':139
'22#.#29.164.21':445
'22#.#29.224.163':139
'22#.#29.5.35':139
'22#.#29.175.147':139
'22#.#29.234.174':139
'22#.#29.245.83':139
'22#.#29.148.77':139
'22#.#29.114.16':445
'22#.#29.121.207':445
'22#.#29.123.82':445
'22#.#29.16.123':445
'22#.#29.12.187':445
'22#.#29.74.62':445
'22#.#29.35.96':445
'22#.#29.123.90':445
'22#.#29.132.212':445
'22#.#29.144.55':445
'22#.#29.178.149':139
'22#.#29.46.178':139
'22#.#29.166.53':139
'22#.#29.37.41':139
'22#.#29.157.106':139
'22#.#29.114.16':139
'22#.#29.121.207':139
'22#.#29.123.82':139
'22#.#29.16.123':139
'22#.#29.139.54':139
'22#.#29.124.139':139
'22#.#29.214.6':139
'22#.#29.54.79':139
'22#.#29.2.30':139
'22#.#29.50.175':139
'22#.#29.50.4':139
'22#.#29.161.157':139
'22#.#29.49.162':139
'22#.#29.12.187':139
'22#.#29.236.191':445
'22#.#29.13.127':445
'22#.#29.79.132':445
'22#.#29.2.215':445
'22#.#29.38.118':445
'22#.#29.245.251':445
'22#.#29.150.31':445
'22#.#29.11.59':445
'22#.#29.237.150':445
'22#.#29.74.62':139
'22#.#29.35.96':139
'22#.#29.123.90':139
'22#.#29.132.212':139
'22#.#29.164.21':139
'22#.#29.229.6':445
'22#.#29.132.202':445
'22#.#29.52.17':445
'22#.#29.60.160':445
'22#.#29.10.114':445
'22#.#29.1.80':139
'22#.#29.18.178':139
'22#.#29.81.96':139
'22#.#29.22.206':139
'22#.#29.163.59':445
'22#.#29.43.229':445
'22#.#29.247.250':445
'22#.#29.111.19':445
'22#.#29.122.221':445
'22#.#29.192.232':139
'22#.#29.12.218':139
'22#.#29.184.195':139
'22#.#29.169.134':139
'22#.#29.105.19':139
'22#.#29.39.37':139
'22#.#29.96.19':139
'22#.#29.251.170':139
'22#.#29.198.201':139
'22#.#29.69.73':445
'22#.#29.188.47':445
'22#.#29.42.188':445
'22#.#29.128.240':445
'22#.#29.20.254':445
'22#.#29.157.21':445
'22#.#29.160.121':445
'22#.#29.183.32':445
'22#.#29.9.65':445
'22#.#29.147.66':445
'22#.#29.138.66':445
'22#.#29.71.138':445
'22#.#29.195.226':445
'22#.#29.48.215':445
'22#.#29.32.89':445
'22#.#29.68.8':445
'22#.#29.240.67':445
'22#.#29.131.49':445
'22#.#29.50.184':445
'22#.#29.53.230':139
'22#.#29.131.49':139
'22#.#29.50.184':139
'22#.#29.71.138':139
'22#.#29.32.89':139
'22#.#29.68.8':139
'22#.#29.20.254':139
'22#.#29.188.47':139
'22#.#29.240.67':139
'22#.#29.128.240':139
'22#.#29.163.59':139
'22#.#29.247.250':139
'22#.#29.122.221':139
'22#.#29.43.229':139
'22#.#29.111.19':139
'22#.#29.48.215':139
'22#.#29.138.66':139
'22#.#29.69.73':139
'22#.#29.195.226':139
'22#.#29.42.188':139
'22#.#29.123.51':139
'22#.#29.59.41':139
'22#.#29.15.145':139
'22#.#29.151.56':139
'22#.#29.140.58':139
'22#.#29.145.38':139
'22#.#29.209.187':139
'22#.#29.135.251':139
'22#.#29.51.7':139
'22#.#29.147.66':139
'22#.#29.160.121':139
'22#.#29.157.21':139
'22#.#29.9.65':139
'22#.#29.183.32':139
'22#.#29.25.186':139
'22#.#29.145.28':139
'22#.#29.24.67':139
'22#.#29.39.192':139
'22#.#29.24.67':445
'22#.#29.250.253':139
'22#.#29.125.50':139
'22#.#29.58.27':139
'22#.#29.25.244':139
'22#.#29.215.124':139
'22#.#29.21.199':139
'22#.#29.170.6':139
'22#.#29.92.199':139
'22#.#29.216.222':139
'22#.#29.129.59':139
'22#.#29.212.113':139
'22#.#29.163.4':139
'22#.#29.156.34':139
'22#.#29.91.212':139
'22#.#29.138.216':139
'22#.#29.194.155':139
'22#.#29.180.134':139
'22#.#29.153.27':139
'22#.#29.251.108':139
'22#.#29.166.153':139
'22#.#29.216.142':139
'22#.#29.144.75':139
'22#.#29.5.151':139
'22#.#29.19.158':139
'22#.#29.78.196':139
'22#.#29.227.134':445
'22#.#29.41.22':139
'22#.#29.69.200':139
'22#.#29.179.226':139
'22#.#29.15.196':139
'22#.#29.75.145':139
'22#.#29.217.113':139
'22#.#29.214.62':139
'22#.#29.48.30':139
'22#.#29.114.153':139
'22#.#29.202.97':139
'22#.#29.16.74':139
'22#.#29.238.225':139
'22#.#29.209.187':445
'22#.#29.53.230':445
'22#.#29.51.7':445
'22#.#29.145.38':445
'22#.#29.184.195':445
'22#.#29.12.218':445
'22#.#29.105.19':445
'22#.#29.169.134':445
'22#.#29.192.232':445
'22#.#29.145.28':445
'22#.#29.15.145':445
'22#.#29.39.192':445
'22#.#29.25.186':445
'22#.#29.151.56':445
'22#.#29.140.58':445
'22#.#29.135.251':445
'22#.#29.123.51':445
'22#.#29.59.41':445
'22#.#29.251.170':445
'22#.#29.18.178':9988
'22#.#29.227.134':139
'22#.#29.12.218':9988
'22#.#29.105.19':9988
'22#.#29.10.114':139
'22#.#29.46.183':139
'22#.#29.224.47':139
'22#.#29.139.66':139
'22#.#29.10.139':139
'22#.#29.96.19':445
'22#.#29.81.96':445
'22#.#29.198.201':445
'22#.#29.39.37':445
'22#.#29.22.206':445
'22#.#29.68.8':9988
'22#.#29.123.51':9988
'22#.#29.1.80':445
'22#.#29.18.178':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней