Trojan.Starman.6548

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER71b2.dir00\svchost.exe.mdmp 16325836412032164

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER71b2.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'81.##3.53.144':139
'81.##3.175.80':139
'81.##3.155.167':139
'81.##3.82.199':139
'81.##3.79.102':139
'81.##3.147.222':445
'81.##3.132.147':445
'81.##3.255.91':139
'81.##3.151.151':139
'81.##3.170.210':139
'81.##3.127.15':139
'81.##3.185.50':139
'81.##3.180.84':139
'81.##3.235.133':139
'81.##3.56.152':139
'81.##3.220.218':139
'81.##3.122.108':139
'81.##3.227.207':139
'81.##3.170.185':139
'81.##3.53.214':139
'81.##3.40.147':445
'81.##3.133.95':445
'81.##3.151.181':445
'81.##3.0.185':445
'81.##3.102.178':445
'81.##3.24.202':445
'81.##3.47.77':445
'81.#73.68.0':445
'81.##3.167.133':445
'81.##3.237.91':445
'81.##3.23.244':445
'81.##3.208.199':445
'81.##3.227.246':445
'81.##3.147.24':445
'81.#73.20.3':445
'81.##3.3.161':445
'81.#73.39.2':445
'81.##3.31.197':445
'81.##3.32.157':445
'81.##3.50.33':445
'81.##3.147.222':139
'81.##3.132.147':139
'81.##3.32.125':445
'81.##3.170.71':445
'81.##3.39.235':445
'81.##3.23.244':139
'81.##3.208.199':139
'81.##3.227.246':139
'81.##3.147.24':139
'81.#73.20.3':139
'81.##3.140.224':139
'81.##3.170.71':139
'81.##3.143.209':139
'81.##3.201.173':445
'81.##3.174.201':139
'81.##3.143.209':445
'81.##3.140.224':445
'81.##3.174.201':445
'81.##3.39.235':139
'81.##3.32.125':139
'81.##3.24.202':139
'81.##3.47.77':139
'81.#73.68.0':139
'81.##3.167.133':139
'81.##3.237.91':139
'81.##3.15.92':139
'81.##3.88.139':139
'81.##3.178.67':139
'81.##3.18.18':139
'81.##3.190.157':139
'81.##3.3.161':139
'81.#73.39.2':139
'81.##3.31.197':139
'81.##3.32.157':139
'81.##3.50.33':139
'81.##3.40.147':139
'81.##3.133.95':139
'81.##3.151.181':139
'81.##3.0.185':139
'81.##3.102.178':139
'81.##3.219.11':139
'81.##3.232.129':139
'81.##3.22.76':139
'81.##3.167.135':139
'81.##3.43.215':139
'81.##3.93.211':139
'81.##3.198.176':139
'81.##3.165.153':139
'81.##3.212.232':139
'81.##3.93.99':139
'81.##3.127.226':139
'81.##3.15.127':139
'81.##3.226.172':139
'81.##3.14.218':139
'81.##3.157.62':139
'81.##3.50.206':139
'81.##3.145.52':139
'81.##3.6.128':139
'81.##3.210.23':139
'81.##3.99.26':139
'81.#73.4.31':139
'81.##3.152.4':139
'81.##3.30.104':139
'81.##3.173.83':139
'81.##3.240.68':139
'81.##3.106.93':139
'81.##3.118.184':139
'81.##3.254.184':139
'81.##3.127.253':139
'81.##3.185.56':139
'81.##3.68.230':139
'81.##3.37.189':139
'81.##3.93.116':139
'81.##3.236.232':139
'81.##3.24.188':139
'81.##3.121.168':139
'81.##3.14.164':139
'81.#73.15.5':139
'81.##3.133.240':139
'81.##3.124.78':139
'81.##3.220.218':445
'81.##3.122.108':445
'81.##3.227.207':445
'81.##3.170.185':445
'81.##3.53.214':445
'81.##3.53.144':445
'81.##3.175.80':445
'81.##3.155.167':445
'81.##3.82.199':445
'81.##3.79.102':445
'81.##3.15.92':445
'81.##3.88.139':445
'81.##3.178.67':445
'81.##3.18.18':445
'81.##3.190.157':445
'81.##3.127.15':445
'81.##3.185.50':445
'81.##3.180.84':445
'81.##3.235.133':445
'81.##3.56.152':445
'81.##3.100.3':445
'81.##3.187.108':445
'81.##3.243.160':445
'81.##3.128.138':445
'81.##3.70.91':445
'81.##3.122.10':139
'81.##3.107.132':139
'81.##3.10.70':139
'81.##3.67.221':139
'81.##3.70.68':139
'81.##3.53.244':139
'81.##3.128.138':139
'81.##3.255.91':445
'81.##3.151.151':445
'81.##3.170.210':445
'81.##3.187.108':139
'81.##3.53.244':445
'81.##3.100.3':139
'81.##3.70.91':139
'81.##3.243.160':139
'81.##3.158.40':445
'81.##3.102.221':445
'81.##3.221.0':445
'81.##3.64.30':445
'81.##3.112.79':139
'81.##3.128.23':445
'81.##3.68.46':445
'81.##3.186.23':445
'81.##3.250.94':445
'81.##3.16.102':445
'81.#73.6.5':445
'81.##3.215.158':139
'81.##3.156.219':139
'81.##3.189.243':139
'81.##3.108.244':139
'81.##3.41.211':139
'81.##3.206.105':139
'81.##3.79.230':139
'81.##3.224.78':139
'81.##3.20.119':139
'81.##3.163.20':139
'81.##3.50.48':445
'81.##3.74.233':445
'81.#73.3.17':445
'81.##3.141.208':445
'81.##3.64.142':445
'81.##3.177.143':445
'81.##3.101.176':445
'81.##3.200.230':445
'81.##3.90.238':445
'81.##3.7.161':445
'81.##3.142.253':445
'81.##3.50.185':445
'81.##3.253.135':445
'81.##3.239.111':445
'81.##3.35.200':445
'81.##3.193.74':445
'81.##3.7.180':445
'81.##3.140.119':445
'81.##3.110.5':445
'81.##3.210.158':445
'81.##3.50.185':139
'81.##3.110.5':139
'81.##3.142.253':139
'81.##3.35.200':139
'81.##3.253.135':139
'81.##3.7.180':139
'81.##3.141.208':139
'81.##3.193.74':139
'81.##3.210.158':139
'81.##3.140.119':139
'81.##3.102.221':139
'81.##3.64.30':139
'81.##3.16.102':139
'81.##3.221.0':139
'81.##3.128.23':139
'81.##3.186.23':139
'81.##3.239.111':139
'81.##3.68.46':139
'81.#73.6.5':139
'81.##3.250.94':139
'81.##3.233.169':139
'81.##3.66.245':139
'81.##3.113.212':139
'81.##3.229.209':139
'81.##3.226.98':139
'81.##3.56.211':139
'81.#73.9.57':139
'81.##3.81.109':139
'81.##3.248.171':139
'81.##3.21.105':139
'81.##3.74.233':139
'81.##3.90.238':139
'81.##3.50.48':139
'81.##3.64.142':139
'81.#73.3.17':139
'81.##3.101.176':139
'81.##3.1.151':139
'81.##3.177.143':139
'81.##3.7.161':139
'81.##3.200.230':139
'81.##3.16.218':139
'81.##3.55.16':139
'81.##3.217.237':139
'81.##3.82.160':139
'81.##3.90.228':139
'81.##3.201.173':139
'81.##3.255.83':445
'81.##3.158.40':139
'81.##3.243.54':139
'81.##3.203.253':139
'81.##3.43.56':139
'81.##3.235.122':139
'81.##3.69.37':139
'81.##3.69.159':139
'81.##3.157.83':139
'81.##3.195.58':139
'81.##3.187.20':139
'81.##3.14.241':139
'81.##3.148.137':139
'81.##3.207.227':139
'81.##3.82.160':445
'81.##3.90.228':445
'81.##3.187.20':445
'81.##3.14.241':445
'81.##3.195.58':445
'81.##3.243.54':445
'81.##3.203.253':445
'81.##3.55.16':445
'81.##3.217.237':445
'81.##3.16.218':445
'81.##3.69.159':445
'81.##3.157.83':445
'81.##3.126.4':445
'81.##3.139.49':445
'81.##3.4.139':445
'81.##3.148.137':445
'81.##3.207.227':445
'81.##3.235.122':445
'81.##3.69.37':445
'81.##3.43.56':445
'81.##3.189.243':445
'81.##3.215.158':445
'81.##3.41.211':445
'81.#73.9.57':445
'81.##3.108.244':445
'81.##3.224.78':445
'81.##3.206.105':445
'81.##3.163.20':445
'81.##3.156.219':445
'81.##3.20.119':445
'81.##3.113.212':445
'81.##3.233.169':445
'81.##3.226.98':445
'81.##3.1.151':445
'81.##3.229.209':445
'81.##3.81.109':445
'81.##3.56.211':445
'81.##3.21.105':445
'81.##3.66.245':445
'81.##3.248.171':445
'81.##3.81.109':9988
'81.##3.56.211':9988
'81.##3.21.105':9988
'81.##3.226.98':9988
'81.##3.66.245':9988
'81.##3.4.139':139
'81.##3.126.4':139
'81.##3.139.49':139
'81.##3.108.244':9988
'81.##3.255.83':139
'81.##3.16.102':9988
'81.##3.221.0':9988
'81.##3.128.23':9988
'81.##3.79.230':445
'81.##3.112.79':445
'81.##3.7.161':9988
'81.##3.101.176':9988
'81.##3.50.48':9988
'81.##3.35.200':9988
'81.##3.210.158':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней