Trojan.Starman.6303

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2ebe.dir00\svchost.exe.mdmp 16325836412030764

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2ebe.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'84.##6.219.32':445
'84.##6.145.219':445
'84.#26.3.77':139
'84.##6.153.156':139
'84.##6.132.145':445
'84.##6.52.86':445
'84.#26.3.77':445
'84.##6.44.198':445
'84.##6.208.59':445
'84.##6.75.53':445
'84.##6.219.32':139
'84.##6.108.74':445
'84.##6.110.26':445
'84.##6.145.219':139
'84.##6.208.59':139
'84.##6.52.86':139
'84.##6.132.145':139
'84.##6.44.198':139
'84.##6.153.156':445
'84.##6.119.198':139
'84.##6.128.220':139
'84.##6.56.233':139
'84.##6.155.205':139
'84.##6.33.129':139
'84.##6.60.55':139
'84.##6.223.59':139
'84.##6.156.33':139
'84.##6.54.156':139
'84.##6.12.68':139
'84.##6.109.11':139
'84.##6.27.36':139
'84.##6.68.27':139
'84.##6.153.4':139
'84.##6.161.151':139
'84.##6.243.216':139
'84.##6.55.110':139
'84.##6.36.133':139
'84.##6.194.150':445
'84.##6.89.53':445
'84.##6.63.89':445
'84.##6.26.26':445
'84.##6.61.56':445
'84.##6.51.85':445
'84.##6.152.79':445
'84.##6.70.143':445
'84.##6.253.42':445
'84.##6.135.84':445
'84.##6.171.81':445
'84.##6.80.171':445
'84.##6.63.32':445
'84.##6.81.63':445
'84.##6.150.42':445
'84.##6.52.84':445
'84.##6.154.20':445
'84.##6.64.207':445
'84.##6.98.75':445
'84.##6.103.60':445
'84.##6.31.212':445
'84.##6.28.184':445
'84.##6.213.150':445
'84.##6.212.198':445
'84.##6.142.218':445
'84.##6.243.48':445
'84.##6.29.134':445
'84.##6.194.247':445
'84.##6.172.248':445
'84.##6.240.176':445
'84.#26.21.4':445
'84.##6.203.74':445
'84.##6.94.100':445
'84.##6.135.43':445
'84.##6.50.118':445
'84.##6.216.98':445
'84.##6.197.103':445
'84.##6.165.124':445
'84.##6.122.171':139
'84.#26.1.21':445
'84.##6.156.178':445
'84.##6.157.95':445
'84.##6.94.86':445
'84.##6.82.173':445
'84.##6.153.222':445
'84.##6.61.145':445
'84.##6.239.81':445
'84.##6.83.194':445
'84.##6.60.55':445
'84.##6.223.59':445
'84.##6.156.33':445
'84.##6.54.156':445
'84.##6.122.171':445
'84.##6.58.67':445
'84.##6.160.58':445
'84.##6.18.73':445
'84.##6.180.127':445
'84.##6.57.73':445
'84.##6.123.106':139
'84.##6.14.46':139
'84.##6.82.234':445
'84.##6.106.82':139
'84.##6.29.114':139
'84.##6.163.22':139
'84.##6.253.33':139
'84.##6.114.29':139
'84.##6.93.114':139
'84.##6.143.96':445
'84.##6.30.73':445
'84.#26.3.58':445
'84.##6.182.150':445
'84.##6.205.225':445
'84.##6.193.247':445
'84.##6.233.189':445
'84.##6.168.40':445
'84.##6.116.201':445
'84.##6.33.129':445
'84.##6.153.222':139
'84.##6.61.145':139
'84.##6.239.81':139
'84.##6.83.194':139
'84.##6.57.73':139
'84.##6.143.96':139
'84.##6.30.73':139
'84.#26.3.58':139
'84.##6.182.150':139
'84.##6.58.67':139
'84.##6.160.58':139
'84.##6.18.73':139
'84.##6.180.127':139
'84.##6.157.95':139
'84.##6.156.178':139
'84.##6.82.173':139
'84.##6.94.86':139
'84.#26.1.21':139
'84.##6.205.225':139
'84.##6.36.133':445
'84.##6.161.151':445
'84.##6.153.4':445
'84.##6.55.110':445
'84.##6.243.216':445
'84.##6.119.198':445
'84.##6.128.220':445
'84.##6.56.233':445
'84.##6.155.205':445
'84.##6.193.247':139
'84.##6.233.189':139
'84.##6.168.40':139
'84.##6.116.201':139
'84.##6.82.234':139
'84.##6.12.68':445
'84.##6.109.11':445
'84.##6.27.36':445
'84.##6.68.27':445
'84.##6.25.153':139
'84.##6.47.181':139
'84.##6.119.134':139
'84.##6.162.119':139
'84.##6.114.116':445
'84.##6.11.131':445
'84.##6.5.114':445
'84.##6.28.163':445
'84.##6.116.124':445
'84.##6.181.63':139
'84.##6.196.77':139
'84.#26.4.51':139
'84.##6.31.92':139
'84.##6.41.112':139
'84.##6.54.91':139
'84.##6.133.172':139
'84.##6.10.102':139
'84.##6.95.160':139
'84.##6.159.245':445
'84.##6.243.175':445
'84.##6.156.211':445
'84.##6.97.67':445
'84.##6.93.50':445
'84.##6.162.188':445
'84.##6.71.227':445
'84.##6.123.116':445
'84.##6.80.88':445
'84.##6.52.124':445
'84.##6.171.103':445
'84.##6.44.175':445
'84.##6.125.201':445
'84.#26.98.5':445
'84.##6.58.71':445
'84.##6.126.86':445
'84.##6.94.208':445
'84.##6.159.165':445
'84.##6.104.136':445
'84.##6.209.4':139
'84.##6.159.165':139
'84.##6.104.136':139
'84.#26.98.5':139
'84.##6.28.163':139
'84.##6.126.86':139
'84.##6.93.50':139
'84.##6.243.175':139
'84.##6.94.208':139
'84.##6.97.67':139
'84.##6.11.131':139
'84.##6.44.175':139
'84.##6.5.114':139
'84.##6.116.124':139
'84.##6.171.103':139
'84.##6.58.71':139
'84.##6.125.201':139
'84.##6.159.245':139
'84.##6.114.116':139
'84.##6.162.188':139
'84.##6.59.66':139
'84.##6.78.233':139
'84.##6.23.18':139
'84.##6.51.56':139
'84.##6.73.203':139
'84.##6.249.189':139
'84.##6.210.249':139
'84.#26.1.8':139
'84.##6.190.69':139
'84.##6.52.124':139
'84.##6.80.88':139
'84.##6.156.211':139
'84.##6.71.227':139
'84.##6.123.116':139
'84.##6.190.109':139
'84.##6.37.28':139
'84.##6.4.176':139
'84.##6.246.121':139
'84.##6.4.176':445
'84.##6.70.143':139
'84.##6.103.60':139
'84.##6.135.84':139
'84.##6.152.79':139
'84.##6.203.74':139
'84.#26.21.4':139
'84.##6.135.43':139
'84.##6.94.100':139
'84.##6.240.176':139
'84.##6.154.20':139
'84.##6.26.26':139
'84.##6.98.75':139
'84.##6.52.84':139
'84.##6.61.56':139
'84.##6.51.85':139
'84.##6.253.42':139
'84.##6.89.53':139
'84.##6.63.89':139
'84.##6.197.103':139
'84.##6.29.134':139
'84.##6.194.150':139
'84.##6.172.248':139
'84.##6.243.48':139
'84.##6.108.74':139
'84.##6.129.129':445
'84.##6.31.249':445
'84.##6.110.26':139
'84.##6.75.53':139
'84.##6.216.98':139
'84.##6.213.150':139
'84.##6.165.124':139
'84.##6.50.118':139
'84.##6.212.198':139
'84.##6.142.218':139
'84.##6.194.247':139
'84.##6.31.212':139
'84.##6.28.184':139
'84.##6.64.207':139
'84.##6.249.189':445
'84.##6.209.4':445
'84.##6.190.69':445
'84.##6.210.249':445
'84.#26.4.51':445
'84.##6.196.77':445
'84.##6.41.112':445
'84.##6.31.92':445
'84.##6.181.63':445
'84.##6.246.121':445
'84.##6.23.18':445
'84.##6.37.28':445
'84.##6.190.109':445
'84.##6.51.56':445
'84.##6.73.203':445
'84.#26.1.8':445
'84.##6.59.66':445
'84.##6.78.233':445
'84.##6.10.102':445
'84.##6.129.129':139
'84.##6.31.249':139
'84.##6.125.201':9988
'84.##6.126.86':9988
'84.##6.63.32':139
'84.##6.80.171':139
'84.##6.150.42':139
'84.##6.81.63':139
'84.##6.171.81':139
'84.##6.119.134':445
'84.##6.133.172':445
'84.##6.95.160':445
'84.##6.54.91':445
'84.##6.162.119':445
'84.##6.114.116':9988
'84.#26.98.5':9988
'84.##6.25.153':445
'84.##6.47.181':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней