Trojan.Starman.6562

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER5fe4.dir00\svchost.exe.mdmp 16325836412032428

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5fe4.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'20#.#40.178.120':445
'20#.#40.230.85':445
'20#.#40.58.145':139
'20#.#40.183.246':445
'20#.#40.191.28':445
'20#.#40.83.12':445
'20#.#40.196.215':445
'20#.#40.116.58':445
'20#.#40.104.246':445
'20#.#40.83.12':139
'20#.#40.196.215':139
'20#.#40.116.58':139
'20#.#40.104.246':139
'20#.#40.244.36':139
'20#.#40.74.193':139
'20#.#40.100.228':139
'20#.#40.58.172':139
'20#.#40.203.243':139
'20#.#40.244.36':445
'20#.#40.156.5':139
'20#.#40.27.79':139
'20#.#40.89.190':139
'20#.#40.94.118':139
'20#.#40.127.141':139
'20#.#40.99.171':139
'20#.#40.44.130':139
'20#.#40.218.127':139
'20#.#40.13.8':139
'20#.#40.74.193':445
'20#.#40.100.228':445
'20#.#40.203.243':445
'20#.#40.58.172':445
'20#.#40.58.145':445
'20#.#40.64.46':139
'20#.#40.182.64':139
'20#.#40.47.59':139
'20#.#40.80.148':139
'20#.#40.191.28':139
'20#.#40.3.35':445
'20#.#40.97.106':445
'20#.#40.89.169':445
'20#.#40.31.182':445
'20#.#40.216.157':445
'20#.#40.222.98':445
'20#.#40.43.202':445
'20#.#40.132.216':445
'20#.#40.221.69':445
'20#.#40.243.82':445
'20#.#40.188.19':445
'20#.#40.112.252':445
'20#.#40.83.112':445
'20#.#40.126.67':445
'20#.#40.44.232':445
'20#.#40.130.116':445
'20#.#40.9.228':445
'20#.#40.87.112':445
'20#.#40.52.228':445
'20#.#40.47.176':445
'20#.#40.18.248':445
'20#.#40.108.127':445
'20#.#40.175.183':445
'20#.#40.23.193':445
'20#.#40.178.120':139
'20#.#40.230.85':139
'20#.#40.20.204':445
'20#.#40.183.246':139
'20#.#40.248.130':445
'20#.#40.137.190':445
'20#.#40.163.174':445
'20#.#40.198.162':445
'20#.#40.15.51':445
'20#.#40.68.37':445
'20#.#40.105.34':445
'20#.#40.200.178':445
'20#.#40.54.227':445
'20#.#40.77.14':445
'20#.#40.233.31':445
'20#.#40.135.195':445
'20#.#40.71.243':445
'20#.#40.166.13':445
'20#.#40.20.49':445
'20#.#40.94.20':445
'20#.#40.47.162':445
'20#.#40.105.93':445
'20#.#40.124.18':445
'20#.#40.199.123':445
'20#.#40.187.243':445
'20#.#40.73.232':445
'20#.#40.127.93':445
'20#.#40.95.44':445
'20#.#40.107.95':445
'20#.#40.55.12':445
'20#.#40.82.150':445
'20#.#40.49.166':445
'20#.#40.56.48':139
'20#.#40.37.29':139
'20#.#40.71.77':139
'20#.#40.94.8':139
'20#.#40.194.92':139
'20#.#40.207.17':139
'20#.#40.248.12':139
'20#.#40.137.15':139
'20#.#40.92.187':139
'20#.#40.214.221':445
'20#.#40.50.29':445
'20#.#40.137.3':445
'20#.#40.102.107':445
'20#.#40.24.112':139
'20#.#40.82.218':139
'20#.#40.69.236':139
'20#.#40.32.169':139
'20#.#40.148.32':139
'20#.#40.243.248':445
'20#.#40.71.243':139
'20#.#40.77.14':139
'20#.#40.107.95':139
'20#.#40.135.195':139
'20#.#40.233.31':139
'20#.#40.105.93':139
'20#.#40.20.49':139
'20#.#40.166.13':139
'20#.#40.47.162':139
'20#.#40.73.232':139
'20#.#40.124.18':139
'20#.#40.243.248':139
'20#.#40.187.243':139
'20#.#40.199.123':139
'20#.#40.82.150':139
'20#.#40.95.44':139
'20#.#40.127.93':139
'20#.#40.55.12':139
'20#.#40.94.20':139
'20#.#40.156.5':445
'20#.#40.27.79':445
'20#.#40.89.190':445
'20#.#40.94.118':445
'20#.#40.127.141':445
'20#.#40.99.171':445
'20#.#40.44.130':445
'20#.#40.218.127':445
'20#.#40.13.8':445
'20#.#40.102.107':139
'20#.#40.214.221':139
'20#.#40.49.166':139
'20#.#40.137.3':139
'20#.#40.50.29':139
'20#.#40.64.46':445
'20#.#40.182.64':445
'20#.#40.47.59':445
'20#.#40.80.148':445
'20#.#40.39.107':139
'20#.#40.190.84':139
'20#.#40.109.138':139
'20#.#40.156.253':139
'20#.#40.206.180':445
'20#.#40.30.29':445
'20#.#40.23.75':445
'20#.#40.85.30':445
'20#.#40.231.172':445
'20#.#40.98.216':139
'20#.#40.194.156':139
'20#.#40.57.207':139
'20#.#40.142.222':139
'20#.#40.156.73':139
'20#.#40.195.33':139
'20#.#40.138.240':139
'20#.#40.164.227':139
'20#.#40.66.125':139
'20#.#40.30.85':445
'20#.#40.93.80':445
'20#.#40.146.218':445
'20#.#40.77.47':445
'20#.#40.118.111':445
'20#.#40.209.86':445
'20#.#40.242.90':445
'20#.#40.244.82':445
'20#.#40.102.157':445
'20#.#40.246.128':445
'20#.#40.182.24':445
'20#.#40.54.57':445
'20#.#40.187.254':445
'20#.#40.248.18':445
'20#.#40.110.90':445
'20#.#40.206.179':445
'20#.#40.81.0':445
'20#.#40.137.224':445
'20#.#40.196.246':445
'20#.#40.78.20':139
'20#.#40.137.224':139
'20#.#40.196.246':139
'20#.#40.182.24':139
'20#.#40.110.90':139
'20#.#40.206.179':139
'20#.#40.118.111':139
'20#.#40.93.80':139
'20#.#40.81.0':139
'20#.#40.77.47':139
'20#.#40.231.172':139
'20#.#40.23.75':139
'20#.#40.206.180':139
'20#.#40.30.29':139
'20#.#40.54.57':139
'20#.#40.187.254':139
'20#.#40.248.18':139
'20#.#40.85.30':139
'20#.#40.30.85':139
'20#.#40.146.218':139
'20#.#40.59.227':139
'20#.#40.16.239':139
'20#.#40.116.243':139
'20#.#40.60.28':139
'20#.#40.98.72':139
'20#.#40.28.47':139
'20#.#40.66.193':139
'20#.#40.218.64':139
'20#.#40.238.241':139
'20#.#40.246.128':139
'20#.#40.242.90':139
'20#.#40.209.86':139
'20#.#40.102.157':139
'20#.#40.244.82':139
'20#.#40.12.234':139
'20#.#40.110.107':139
'20#.#40.4.247':139
'20#.#40.234.234':139
'20#.#40.3.35':139
'20#.#40.97.106':139
'20#.#40.89.169':139
'20#.#40.31.182':139
'20#.#40.216.157':139
'20#.#40.222.98':139
'20#.#40.43.202':139
'20#.#40.132.216':139
'20#.#40.221.69':139
'20#.#40.243.82':139
'20#.#40.188.19':139
'20#.#40.112.252':139
'20#.#40.83.112':139
'20#.#40.126.67':139
'20#.#40.44.232':139
'20#.#40.130.116':139
'20#.#40.9.228':139
'20#.#40.87.112':139
'20#.#40.52.228':139
'20#.#40.47.176':139
'20#.#40.18.248':139
'20#.#40.108.127':139
'20#.#40.175.183':139
'20#.#40.23.193':139
'20#.#40.0.207':445
'20#.#40.65.213':445
'20#.#40.20.204':139
'20#.#40.158.196':445
'20#.#40.248.130':139
'20#.#40.137.190':139
'20#.#40.163.174':139
'20#.#40.198.162':139
'20#.#40.15.51':139
'20#.#40.68.37':139
'20#.#40.105.34':139
'20#.#40.200.178':139
'20#.#40.54.227':139
'20#.#40.65.213':139
'20#.#40.28.47':445
'20#.#40.66.193':445
'20#.#40.218.64':445
'20#.#40.238.241':445
'20#.#40.78.20':445
'20#.#40.98.216':445
'20#.#40.194.156':445
'20#.#40.57.207':445
'20#.#40.142.222':445
'20#.#40.12.234':445
'20#.#40.110.107':445
'20#.#40.4.247':445
'20#.#40.234.234':445
'20#.#40.116.243':445
'20#.#40.16.239':445
'20#.#40.98.72':445
'20#.#40.60.28':445
'20#.#40.59.227':445
'20#.#40.156.73':445
'20#.#40.93.80':9988
'20#.#40.209.86':9988
'20#.#40.206.180':9988
'20#.#40.77.47':9988
'20#.#40.206.179':9988
'20#.#40.158.196':139
'20#.#40.0.207':139
'20#.#40.66.125':9988
'20#.#40.39.107':9988
'20#.#40.195.33':445
'20#.#40.138.240':445
'20#.#40.164.227':445
'20#.#40.66.125':445
'20#.#40.109.138':445
'20#.#40.190.84':445
'20#.#40.23.75':9988
'20#.#40.156.253':445
'20#.#40.39.107':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней