Trojan.Starman.6577

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER6ef3.dir00\svchost.exe.mdmp 16325836412032096

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'83.##9.42.64':139
'83.##9.248.98':139
'83.##9.136.252':139
'83.##9.236.26':139
'83.##9.169.110':139
'83.##9.231.233':445
'83.##9.27.118':445
'83.##9.251.9':445
'83.##9.203.247':139
'83.##9.228.24':445
'83.##9.222.96':139
'83.##9.74.222':139
'83.##9.96.221':139
'83.##9.128.112':139
'83.##9.84.138':139
'83.##9.97.39':139
'83.##9.27.97':139
'83.##9.39.61':139
'83.##9.178.74':139
'83.##9.37.122':139
'83.##9.214.161':445
'83.##9.189.144':445
'83.##9.201.182':445
'83.##9.168.68':445
'83.##9.137.217':445
'83.##9.26.61':445
'83.##9.233.228':445
'83.##9.158.53':445
'83.#19.29.9':445
'83.##9.148.94':445
'83.##9.171.57':445
'83.##9.80.63':445
'83.##9.57.93':445
'83.##9.108.82':445
'83.##9.225.227':445
'83.##9.233.124':445
'83.##9.111.195':445
'83.##9.96.213':445
'83.##9.182.87':445
'83.##9.231.202':445
'83.##9.226.195':139
'83.##9.27.118':139
'83.##9.108.82':139
'83.##9.231.233':139
'83.##9.228.24':139
'83.##9.251.9':139
'83.##9.80.63':139
'83.##9.182.87':139
'83.##9.171.57':139
'83.##9.225.227':139
'83.##9.57.93':139
'83.##9.227.178':139
'83.##9.44.169':139
'83.##9.179.141':139
'83.##9.193.94':445
'83.##9.189.121':445
'83.##9.44.169':445
'83.##9.189.45':445
'83.##9.227.178':445
'83.##9.189.45':139
'83.##9.179.141':445
'83.##9.233.228':139
'83.##9.103.42':139
'83.##9.26.61':139
'83.##9.148.94':139
'83.##9.158.53':139
'83.##9.251.70':139
'83.##9.136.48':139
'83.##9.106.47':139
'83.##9.174.158':139
'83.##9.7.177':139
'83.##9.111.195':139
'83.##9.168.68':139
'83.##9.233.124':139
'83.##9.231.202':139
'83.##9.96.213':139
'83.##9.189.144':139
'83.#19.29.9':139
'83.##9.214.161':139
'83.##9.137.217':139
'83.##9.201.182':139
'83.##9.44.206':139
'83.##9.151.157':139
'83.##9.39.240':139
'83.##9.142.93':139
'83.##9.205.222':139
'83.##9.190.103':139
'83.##9.10.15':139
'83.##9.43.21':139
'83.##9.249.106':139
'83.##9.51.130':139
'83.##9.70.41':139
'83.##9.61.201':139
'83.##9.96.208':139
'83.##9.103.57':139
'83.##9.44.27':139
'83.##9.222.220':139
'83.##9.153.178':139
'83.##9.221.81':139
'83.##9.99.121':139
'83.##9.21.215':139
'83.##9.203.100':139
'83.##9.66.224':139
'83.##9.63.91':139
'83.##9.94.203':139
'83.##9.191.134':139
'83.##9.35.38':445
'83.##9.132.79':445
'83.##9.189.169':445
'83.##9.242.131':139
'83.##9.87.15':139
'83.##9.32.193':139
'83.##9.99.201':139
'83.##9.33.39':139
'83.##9.159.54':139
'83.##9.251.170':139
'83.##9.79.253':139
'83.##9.124.79':139
'83.##9.253.147':139
'83.##9.50.203':139
'83.##9.147.224':139
'83.##9.57.104':139
'83.##9.37.122':445
'83.##9.39.61':445
'83.##9.178.74':445
'83.##9.222.96':445
'83.##9.74.222':445
'83.##9.169.110':445
'83.##9.136.252':445
'83.##9.236.26':445
'83.##9.97.39':445
'83.##9.27.97':445
'83.##9.106.47':445
'83.##9.251.70':445
'83.##9.7.177':445
'83.##9.103.42':445
'83.##9.174.158':445
'83.##9.84.138':445
'83.##9.96.221':445
'83.##9.128.112':445
'83.##9.136.48':445
'83.##9.226.195':445
'83.##9.132.79':139
'83.##9.124.101':139
'83.##9.35.38':139
'83.##9.31.96':445
'83.##9.189.169':139
'83.##9.200.168':139
'83.##9.79.157':139
'83.##9.110.177':139
'83.#19.8.12':139
'83.##9.116.208':139
'83.##9.10.204':139
'83.##9.9.198':139
'83.##9.203.247':445
'83.##9.42.64':445
'83.##9.248.98':445
'83.##9.9.198':445
'83.##9.99.129':445
'83.##9.10.204':445
'83.##9.99.129':139
'83.##9.31.96':139
'83.##9.92.63':445
'83.##9.43.184':445
'83.##9.210.178':445
'83.##9.145.98':445
'83.##9.89.217':445
'83.##9.140.130':445
'83.##9.7.114':445
'83.##9.140.114':445
'83.##9.57.131':445
'83.##9.64.210':445
'83.##9.225.64':445
'83.##9.227.168':139
'83.##9.50.17':139
'83.##9.229.88':139
'83.#19.8.47':139
'83.##9.88.201':139
'83.##9.13.51':139
'83.##9.25.26':139
'83.##9.111.198':139
'83.##9.21.227':139
'83.##9.167.148':139
'83.##9.161.83':445
'83.##9.174.184':445
'83.##9.71.152':445
'83.##9.35.74':445
'83.##9.97.252':445
'83.##9.49.97':445
'83.##9.96.170':445
'83.##9.134.122':445
'83.##9.145.120':445
'83.##9.144.235':445
'83.##9.36.195':445
'83.##9.30.87':445
'83.#19.44.8':445
'83.##9.47.75':445
'83.##9.212.58':445
'83.##9.53.204':445
'83.##9.98.94':445
'83.##9.60.175':445
'83.##9.215.31':445
'83.##9.224.103':445
'83.##9.124.144':139
'83.##9.36.195':139
'83.##9.30.87':139
'83.#19.44.8':139
'83.##9.47.75':139
'83.##9.212.58':139
'83.##9.53.204':139
'83.##9.98.94':139
'83.##9.60.175':139
'83.##9.215.31':139
'83.##9.224.103':139
'83.##9.43.184':139
'83.##9.210.178':139
'83.##9.145.98':139
'83.##9.89.217':139
'83.##9.140.130':139
'83.##9.7.114':139
'83.##9.140.114':139
'83.##9.57.131':139
'83.##9.64.210':139
'83.##9.225.64':139
'83.##9.233.165':139
'83.##9.193.233':139
'83.##9.98.86':139
'83.##9.54.127':139
'83.##9.20.131':139
'83.##9.216.69':139
'83.##9.155.157':139
'83.##9.158.61':139
'83.##9.89.34':139
'83.##9.19.16':139
'83.##9.161.83':139
'83.##9.174.184':139
'83.##9.71.152':139
'83.##9.35.74':139
'83.##9.97.252':139
'83.##9.49.97':139
'83.##9.96.170':139
'83.##9.134.122':139
'83.##9.145.120':139
'83.##9.144.235':139
'83.##9.204.247':139
'83.##9.40.82':139
'83.##9.57.23':139
'83.##9.101.32':139
'83.##9.80.169':139
'83.##9.104.25':445
'83.##9.174.104':445
'83.##9.189.121':139
'83.##9.92.63':139
'83.##9.193.94':139
'83.##9.186.94':139
'83.##9.101.138':139
'83.##9.19.50':139
'83.##9.168.186':139
'83.##9.39.168':139
'83.##9.78.140':139
'83.##9.53.155':139
'83.##9.140.215':139
'83.##9.92.189':139
'83.##9.215.147':139
'83.##9.78.140':445
'83.##9.53.155':445
'83.##9.140.215':445
'83.##9.92.189':445
'83.##9.215.147':445
'83.##9.204.247':445
'83.##9.40.82':445
'83.##9.57.23':445
'83.##9.101.32':445
'83.##9.80.169':445
'83.##9.185.32':445
'83.##9.186.185':445
'83.##9.44.168':445
'83.##9.179.173':445
'83.##9.205.174':445
'83.##9.186.94':445
'83.##9.101.138':445
'83.##9.19.50':445
'83.##9.168.186':445
'83.##9.39.168':445
'83.##9.186.185':139
'83.##9.229.88':445
'83.##9.227.168':445
'83.##9.88.201':445
'83.##9.124.144':445
'83.#19.8.47':445
'83.##9.111.198':445
'83.##9.13.51':445
'83.##9.167.148':445
'83.##9.50.17':445
'83.##9.21.227':445
'83.##9.233.165':445
'83.##9.193.233':445
'83.##9.98.86':445
'83.##9.54.127':445
'83.##9.20.131':445
'83.##9.216.69':445
'83.##9.155.157':445
'83.##9.158.61':445
'83.##9.89.34':445
'83.##9.19.16':445
'83.##9.13.51':9988
'83.##9.104.25':139
'83.##9.111.198':9988
'83.##9.174.184':9988
'83.##9.233.165':9988
'83.##9.44.168':139
'83.##9.185.32':139
'83.##9.205.174':139
'83.##9.174.104':139
'83.##9.179.173':139
'83.##9.36.195':9988
'83.##9.215.31':9988
'83.##9.212.58':9988
'83.##9.25.26':445
'83.##9.145.98':9988
'83.##9.71.152':9988
'83.##9.161.83':9988
'83.##9.97.252':9988
'83.##9.224.103':9988
'83.##9.98.94':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней