Trojan.Starman.6482

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd0df.dir00\svchost.exe.mdmp 16325836412028988

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERd0df.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14#.#1.171.19':445
'14#.#1.246.79':445
'14#.#1.62.129':445
'14#.#1.53.131':445
'14#.#1.21.228':445
'14#.#1.112.185':139
'14#.#1.110.61':139
'14#.#1.88.57':139
'14#.#1.15.92':139
'14#.#1.219.145':445
'14#.#1.20.161':445
'14#.#1.253.192':445
'14#.#1.73.56':445
'14#.#1.132.169':445
'14#.#1.147.253':445
'14#.#1.149.29':445
'14#.#1.19.193':445
'14#.#1.132.148':445
'14#.#1.177.236':445
'14#.#1.38.237':139
'14#.#1.100.175':139
'14#.#1.187.100':139
'14#.#1.35.97':139
'14#.#1.175.92':139
'14#.#1.125.35':139
'14#.21.5.35':139
'14#.#1.66.67':139
'14#.#1.233.192':139
'14#.#1.94.243':139
'14#.#1.102.92':139
'14#.#1.176.38':139
'14#.#1.240.122':139
'14#.#1.74.226':139
'14#.#1.38.39':139
'14#.#1.138.57':139
'14#.#1.236.250':139
'14#.#1.225.178':139
'14#.#1.92.192':139
'14#.#1.32.69':139
'14#.#1.165.219':445
'14#.#1.83.165':445
'14#.21.4.55':445
'14#.21.8.29':445
'14#.#1.155.83':445
'14#.#1.44.151':445
'14#.#1.171.234':445
'14#.#1.174.31':445
'14#.#1.200.220':445
'14#.#1.55.18':445
'14#.#1.21.228':139
'14#.21.8.35':445
'14#.#1.171.19':139
'14#.#1.246.79':139
'14#.#1.91.207':445
'14#.21.4.7':445
'14#.#1.18.107':445
'14#.#1.96.58':445
'14#.#1.146.95':445
'14#.#1.12.81':445
'14#.#1.38.115':445
'14#.#1.69.246':445
'14#.#1.59.237':445
'14#.#1.173.196':445
'14#.#1.13.94':445
'14#.21.65.7':445
'14#.#1.130.65':445
'14#.#1.93.234':445
'14#.21.4.26':445
'14#.#1.231.207':445
'14#.#1.110.169':445
'14#.#1.36.42':445
'14#.#1.67.128':445
'14#.#1.51.90':445
'14#.#1.39.187':445
'14#.#1.228.75':445
'14#.#1.226.249':445
'14#.#1.124.11':445
'14#.#1.75.124':445
'14#.#1.251.115':445
'14#.#1.185.113':445
'14#.21.5.35':445
'14#.#1.66.67':445
'14#.#1.95.69':445
'14#.#1.200.136':445
'14#.21.70.0':445
'14#.#1.87.12':445
'14#.#1.13.62':445
'14#.#1.94.243':445
'14#.#1.102.92':445
'14#.#1.35.97':445
'14#.#1.236.250':445
'14#.#1.225.178':445
'14#.#1.175.92':445
'14#.#1.125.35':445
'14#.#1.233.192':445
'14#.#1.100.175':445
'14#.#1.187.100':445
'14#.#1.236.69':445
'14#.#1.95.27':445
'14#.#1.169.130':445
'14#.#1.182.26':445
'14#.#1.110.192':445
'14#.#1.23.133':445
'14#.#1.141.147':445
'14#.#1.141.68':445
'14#.#1.137.254':445
'14#.#1.56.181':445
'14#.#1.201.50':445
'14#.#1.157.241':445
'14#.#1.129.118':445
'14#.#1.192.236':445
'14#.#1.104.215':445
'14#.#1.0.148':445
'14#.#1.128.217':445
'14#.#1.81.165':445
'14#.21.5.73':445
'14#.#1.139.167':445
'14#.#1.0.148':139
'14#.21.5.73':139
'14#.#1.157.241':139
'14#.#1.129.118':139
'14#.#1.139.167':139
'14#.#1.201.50':139
'14#.#1.182.26':139
'14#.#1.128.217':139
'14#.#1.81.165':139
'14#.#1.104.215':139
'14#.#1.95.69':139
'14#.#1.87.12':139
'14#.#1.251.115':139
'14#.#1.185.113':139
'14#.#1.13.62':139
'14#.#1.236.69':139
'14#.#1.192.236':139
'14#.#1.200.136':139
'14#.21.70.0':139
'14#.#1.110.192':139
'14#.#1.74.226':445
'14#.#1.38.39':445
'14#.#1.110.61':445
'14#.#1.38.237':445
'14#.#1.176.38':445
'14#.#1.92.192':445
'14#.#1.32.69':445
'14#.#1.240.122':445
'14#.#1.138.57':445
'14#.#1.112.185':445
'14#.#1.23.133':139
'14#.#1.137.254':139
'14#.#1.95.27':139
'14#.#1.169.130':139
'14#.#1.56.181':139
'14#.#1.88.57':445
'14#.#1.15.92':445
'14#.#1.141.147':139
'14#.#1.141.68':139
'14#.#1.53.131':139
'14#.#1.149.118':445
'14#.#1.192.90':445
'14#.#1.88.125':139
'14#.#1.23.197':139
'14#.#1.110.48':445
'14#.#1.90.156':445
'14#.#1.82.179':445
'14#.#1.85.231':445
'14#.#1.221.245':445
'14#.#1.227.150':139
'14#.#1.134.112':139
'14#.#1.80.81':139
'14#.#1.71.119':139
'14#.#1.203.42':139
'14#.#1.166.103':139
'14#.#1.149.167':139
'14#.#1.182.88':139
'14#.#1.216.42':139
'14#.#1.255.63':139
'14#.#1.54.120':445
'14#.#1.143.10':445
'14#.#1.210.78':445
'14#.21.14.7':445
'14#.#1.83.239':445
'14#.#1.137.53':445
'14#.#1.10.123':445
'14#.#1.93.253':445
'14#.#1.78.34':445
'14#.#1.4.200':445
'14#.21.6.52':445
'14#.#1.22.247':445
'14#.#1.139.105':445
'14#.#1.242.88':445
'14#.#1.96.179':445
'14#.#1.159.29':445
'14#.#1.43.120':445
'14#.#1.160.215':445
'14#.#1.225.131':445
'14#.#1.5.193':445
'14#.#1.159.29':139
'14#.#1.225.131':139
'14#.#1.22.247':139
'14#.#1.139.105':139
'14#.#1.5.193':139
'14#.21.6.52':139
'14#.21.14.7':139
'14#.#1.43.120':139
'14#.#1.160.215':139
'14#.#1.96.179':139
'14#.#1.110.48':139
'14#.#1.192.90':139
'14#.#1.149.118':139
'14#.#1.90.156':139
'14#.#1.85.231':139
'14#.#1.54.120':139
'14#.#1.242.88':139
'14#.#1.221.245':139
'14#.#1.82.179':139
'14#.#1.83.239':139
'14#.#1.4.138':139
'14#.#1.72.230':139
'14#.#1.0.120':139
'14#.21.6.72':139
'14#.#1.233.7':139
'14#.#1.40.48':139
'14#.#1.119.182':139
'14#.#1.34.49':139
'14#.#1.30.49':139
'14#.#1.190.94':139
'14#.#1.137.53':139
'14#.#1.78.34':139
'14#.#1.143.10':139
'14#.#1.210.78':139
'14#.#1.4.200':139
'14#.#1.214.137':139
'14#.#1.132.220':139
'14#.#1.10.123':139
'14#.#1.93.253':139
'14#.#1.36.42':139
'14#.#1.39.187':139
'14#.#1.51.90':139
'14#.#1.110.169':139
'14#.#1.124.11':139
'14#.#1.226.249':139
'14#.#1.231.207':139
'14#.#1.75.124':139
'14#.#1.228.75':139
'14#.#1.67.128':139
'14#.#1.83.165':139
'14#.#1.155.83':139
'14#.21.8.29':139
'14#.#1.165.219':139
'14#.#1.174.31':139
'14#.#1.171.234':139
'14#.#1.12.81':139
'14#.#1.200.220':139
'14#.#1.44.151':139
'14#.#1.59.237':139
'14#.#1.147.253':139
'14#.#1.132.148':139
'14#.#1.20.161':139
'14#.#1.253.192':139
'14#.#1.177.236':139
'14#.#1.219.145':139
'14#.#1.62.129':139
'14#.#1.149.29':139
'14#.#1.19.193':139
'14#.#1.132.169':139
'14#.#1.69.246':139
'14#.#1.13.94':139
'14#.#1.173.196':139
'14#.#1.38.115':139
'14#.#1.93.234':139
'14#.#1.130.65':139
'14#.#1.73.56':139
'14#.21.4.26':139
'14#.21.65.7':139
'14#.#1.119.182':445
'14#.#1.203.42':445
'14#.#1.40.48':445
'14#.#1.71.119':445
'14#.#1.134.112':445
'14#.#1.255.63':445
'14#.#1.216.42':445
'14#.#1.80.81':445
'14#.#1.166.103':445
'14#.#1.30.49':445
'14#.#1.190.94':445
'14#.#1.0.120':445
'14#.#1.214.137':445
'14#.#1.132.220':445
'14#.21.6.72':445
'14#.#1.233.7':445
'14#.#1.34.49':445
'14#.#1.4.138':445
'14#.#1.72.230':445
'14#.#1.149.167':445
'14#.#1.91.207':139
'14#.#1.96.58':139
'14#.#1.10.123':9988
'14#.21.8.35':139
'14#.#1.146.95':139
'14#.#1.55.18':139
'14#.21.4.55':139
'14#.21.4.7':139
'14#.#1.18.107':139
'14#.#1.83.239':9988
'14#.#1.227.150':445
'14#.#1.88.125':445
'14#.#1.182.88':445
'14#.#1.23.197':445
'14#.#1.192.90':9988
'14#.#1.160.215':9988
'14#.21.6.52':9988
'14#.#1.5.193':9988
'14#.#1.43.120':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней