Trojan.Starman.6431

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER38e6.dir00\svchost.exe.mdmp 16325836412032280

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER38e6.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'21#.#61.34.71':139
'21#.#61.31.30':139
'21#.#61.169.191':139
'21#.#61.112.239':139
'21#.#61.106.113':139
'21#.#61.226.7':139
'21#.#61.248.138':139
'21#.#61.139.164':139
'21#.#61.62.111':139
'21#.#61.125.16':139
'21#.#61.239.195':139
'21#.#61.183.175':139
'21#.#61.85.129':139
'21#.#61.177.12':139
'21#.#61.180.81':139
'21#.#61.38.26':139
'21#.#61.78.107':139
'21#.#61.196.87':139
'21#.#61.122.36':139
'21#.#61.28.86':139
'21#.#61.14.60':139
'21#.#61.85.129':445
'21#.#61.28.86':445
'21#.#61.183.175':445
'21#.#61.38.26':445
'21#.#61.177.12':445
'21#.#61.196.87':445
'21#.#61.239.195':445
'21#.#61.78.107':445
'21#.#61.14.60':445
'21#.#61.122.36':445
'21#.#61.180.81':445
'21#.#61.64.114':139
'21#.#61.97.16':139
'21#.#61.191.173':139
'21#.#61.225.119':139
'21#.#61.17.130':139
'21#.#61.136.3':445
'21#.#61.82.49':445
'21#.#61.199.96':139
'21#.#61.31.247':139
'21#.#61.192.176':139
'21#.#61.32.68':139
'21#.#61.91.208':139
'21#.#61.226.116':139
'21#.#61.15.223':139
'21#.#61.117.15':139
'21#.#61.221.197':139
'21#.#61.121.221':139
'21#.#61.198.31':139
'21#.#61.120.194':139
'21#.#61.31.241':139
'21#.#61.238.219':139
'21#.#61.158.248':445
'21#.#61.236.224':139
'21#.#61.21.132':445
'21#.#61.159.47':445
'21#.#61.0.168':445
'21#.#61.14.78':139
'21#.#61.227.35':139
'21#.#61.79.218':139
'21#.#61.23.238':139
'21#.#61.21.166':139
'21#.#61.31.241':445
'21#.#61.198.31':445
'21#.#61.120.194':445
'21#.#61.32.68':445
'21#.#61.91.208':445
'21#.#61.136.3':139
'21#.#61.82.49':139
'21#.#61.15.233':445
'21#.#61.221.197':445
'21#.#61.121.221':445
'21#.#61.226.116':445
'21#.#61.21.166':445
'21#.#61.79.218':445
'21#.#61.23.238':445
'21#.#61.15.233':139
'21#.#61.236.224':445
'21#.#61.15.223':445
'21#.#61.117.15':445
'21#.#61.238.219':445
'21#.#61.14.78':445
'21#.#61.227.35':445
'21#.#61.112.239':445
'21#.#61.21.84':139
'21#.#61.9.51':139
'21#.#61.122.184':139
'21#.#61.93.161':139
'21#.#61.44.65':139
'21#.#61.224.3':139
'21#.#61.43.167':139
'21#.#61.3.22':139
'21#.#61.163.171':139
'21#.#61.21.163':139
'21#.#61.127.20':445
'21#.#61.52.142':445
'21#.#61.169.213':445
'21#.#61.142.154':445
'21#.#61.115.80':445
'21#.#61.58.75':445
'21#.#61.67.176':445
'21#.#61.189.34':445
'21#.#61.176.28':445
'21#.#61.218.13':445
'21#.#61.28.218':445
'21#.#61.46.90':139
'21#.#61.41.99':139
'21#.#61.49.163':139
'21#.#61.176.62':139
'21#.#61.224.199':139
'21#.#61.48.64':139
'21#.#61.49.194':139
'21#.#61.64.25':139
'21#.#61.255.74':139
'21#.#61.167.78':139
'21#.#61.231.131':139
'21#.#61.249.117':139
'21#.#61.42.101':139
'21#.#61.185.3':139
'21#.#61.129.124':139
'21#.#61.5.111':139
'21#.#61.89.77':139
'21#.#61.130.253':139
'21#.#61.228.131':139
'21#.#61.9.34':139
'21#.#61.132.43':139
'21#.#61.31.247':445
'21#.#61.192.176':445
'21#.#61.97.16':445
'21#.#61.191.173':445
'21#.#61.64.114':445
'21#.#61.242.91':139
'21#.#61.63.242':139
'21#.#61.92.132':139
'21#.#61.199.96':445
'21#.#61.51.254':139
'21#.#61.17.130':445
'21#.#61.31.30':445
'21#.#61.62.111':445
'21#.#61.34.71':445
'21#.#61.106.113':445
'21#.#61.169.191':445
'21#.#61.248.138':445
'21#.#61.225.119':445
'21#.#61.226.7':445
'21#.#61.125.16':445
'21#.#61.139.164':445
'21#.#61.51.254':445
'21#.#61.92.132':445
'21#.#61.127.20':139
'21#.#61.67.176':139
'21#.#61.189.34':139
'21#.#61.108.241':445
'21#.#61.144.27':445
'21#.#61.30.226':445
'21#.#61.242.91':445
'21#.#61.63.242':445
'21#.#61.176.28':139
'21#.#61.115.80':139
'21#.#61.58.75':139
'21#.#61.144.27':139
'21#.#61.30.226':139
'21#.#61.108.241':139
'21#.#61.218.13':139
'21#.#61.28.218':139
'21#.#61.169.213':139
'21#.#61.142.154':139
'21#.#61.52.142':139
'21#.#61.48.141':445
'21#.#61.180.10':445
'21#.#61.252.212':445
'21#.#61.222.135':445
'21#.#61.107.59':445
'21#.#61.14.13':445
'21#.#61.34.17':445
'21#.#61.171.122':445
'21#.#61.215.179':445
'21#.#61.25.61':445
'21#.#61.109.199':445
'21#.#61.114.175':139
'21#.#61.34.146':139
'21#.161.8.0':139
'21#.#61.65.100':139
'21#.#61.255.199':139
'21#.#61.161.130':139
'21#.#61.207.116':445
'21#.#61.192.63':139
'21#.#61.102.34':139
'21#.#61.63.102':139
'21#.#61.10.101':445
'21#.#61.156.113':445
'21#.#61.77.207':445
'21#.#61.86.194':445
'21#.#61.137.180':445
'21#.#61.21.148':445
'21#.#61.37.205':445
'21#.#61.103.220':445
'21#.#61.119.156':445
'21#.#61.9.120':445
'21#.#61.56.185':445
'21#.#61.177.198':445
'21#.#61.215.177':445
'21#.#61.182.34':445
'21#.#61.124.181':445
'21#.#61.118.109':445
'21#.#61.118.220':445
'21#.#61.108.118':445
'21#.#61.220.177':445
'21#.#61.150.183':445
'21#.#61.161.148':445
'21#.#61.182.34':139
'21#.#61.177.198':139
'21#.#61.118.109':139
'21#.#61.34.17':139
'21#.#61.124.181':139
'21#.#61.220.177':139
'21#.#61.118.220':139
'21#.#61.161.148':139
'21#.#61.215.177':139
'21#.#61.150.183':139
'21#.#61.14.13':139
'21#.#61.109.199':139
'21#.#61.207.116':139
'21#.#61.222.135':139
'21#.#61.107.59':139
'21#.#61.252.212':139
'21#.#61.25.61':139
'21#.#61.171.122':139
'21#.#61.215.179':139
'21#.#61.48.141':139
'21#.#61.180.10':139
'21#.#61.44.108':139
'21#.#61.152.5':139
'21#.#61.70.239':139
'21#.#61.37.205':139
'21#.#61.114.89':139
'21#.#61.166.145':139
'21#.#61.214.48':139
'21#.#61.180.239':139
'21#.#61.65.152':139
'21#.#61.240.65':139
'21#.#61.21.148':139
'21#.#61.137.180':139
'21#.#61.77.207':139
'21#.#61.86.194':139
'21#.#61.108.118':139
'21#.#61.56.185':139
'21#.#61.9.120':139
'21#.#61.103.220':139
'21#.#61.119.156':139
'21#.#61.10.101':139
'21#.#61.156.113':139
'21#.#61.114.89':445
'21#.#61.158.248':139
'21#.#61.167.36':445
'21#.#61.21.132':139
'21#.#61.159.47':139
'21#.#61.0.168':139
'21#.#61.150.139':445
'21#.#61.25.114':445
'21#.#61.210.76':445
'21#.#61.49.155':445
'21#.#61.129.147':445
'21#.#61.19.14':139
'21#.#61.232.102':139
'21#.#61.217.173':139
'21#.#61.173.0':139
'21#.#61.202.156':139
'21#.#61.14.125':139
'21#.#61.72.63':139
'21#.#61.172.75':139
'21#.#61.82.194':139
'21#.#61.84.234':139
'21#.#61.140.214':139
'21#.#61.217.173':445
'21#.#61.84.234':445
'21#.#61.232.102':445
'21#.#61.14.125':445
'21#.#61.173.0':445
'21#.#61.172.75':445
'21#.#61.19.14':445
'21#.#61.72.63':445
'21#.#61.140.214':445
'21#.#61.82.194':445
'21#.#61.202.156':445
'21#.#61.84.165':445
'21#.#61.14.182':445
'21#.#61.26.49':445
'21#.#61.145.214':445
'21#.#61.154.174':445
'21#.#61.180.109':445
'21#.#61.224.47':445
'21#.#61.60.156':445
'21#.#61.22.165':445
'21#.#61.156.226':445
'21#.#61.63.102':445
'21#.#61.192.63':445
'21#.#61.102.34':445
'21#.#61.114.175':445
'21#.#61.34.146':445
'21#.#61.25.61':9988
'21#.#61.171.122':9988
'21#.#61.215.179':9988
'21#.#61.161.130':445
'21#.#61.180.10':9988
'21#.161.8.0':445
'21#.#61.65.152':445
'21#.#61.240.65':445
'21#.#61.152.5':445
'21#.#61.70.239':445
'21#.#61.44.108':445
'21#.#61.65.100':445
'21#.#61.255.199':445
'21#.#61.214.48':445
'21#.#61.180.239':445
'21#.#61.166.145':445
'21#.#61.84.165':139
'21#.#61.14.182':139
'21#.#61.26.49':139
'21#.#61.145.214':139
'21#.#61.154.174':139
'21#.#61.180.109':139
'21#.#61.224.47':139
'21#.#61.60.156':139
'21#.#61.22.165':139
'21#.#61.156.226':139
'21#.#61.25.114':139
'21#.#61.150.183':9988
'21#.#61.161.148':9988
'21#.#61.215.177':9988
'21#.#61.182.34':9988
'21#.#61.177.198':9988
'21#.#61.210.76':139
'21#.#61.150.139':139
'21#.#61.129.147':139
'21#.#61.167.36':139
'21#.#61.49.155':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней