Trojan.Starman.6139

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WERc5d0.dir00\svchost.exe.mdmp 16325836412032096

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc5d0.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'63.##9.96.14':139
'63.##9.26.46':139
'63.##9.47.73':139
'63.##9.234.218':139
'63.##9.72.235':139
'63.##9.2.157':139
'63.##9.166.110':139
'63.##9.142.45':139
'63.##9.207.170':139
'63.##9.174.33':139
'63.##9.157.183':445
'63.##9.7.130':445
'63.##9.130.85':445
'63.##9.7.130':139
'63.##9.225.227':139
'63.##9.205.222':139
'63.##9.219.107':139
'63.##9.27.189':139
'63.##9.225.227':445
'63.##9.223.226':139
'63.##9.238.158':139
'63.##9.245.237':139
'63.##9.56.113':139
'63.##9.30.35':139
'63.##9.247.29':139
'63.##9.84.172':139
'63.##9.10.169':139
'63.##9.171.114':139
'63.##9.149.245':139
'63.##9.103.89':139
'63.##9.195.177':139
'63.##9.181.184':139
'63.##9.4.153':139
'63.##9.84.36':139
'63.##9.53.209':139
'63.##9.30.89':139
'63.##9.2.203':139
'63.##9.190.183':139
'63.##9.39.110':139
'63.##9.181.106':139
'63.##9.125.65':445
'63.##9.166.192':445
'63.##9.52.73':445
'63.##9.54.24':445
'63.##9.47.220':445
'63.#09.4.79':445
'63.##9.83.149':445
'63.##9.134.59':445
'63.##9.162.89':445
'63.#09.5.98':445
'63.##9.99.214':445
'63.##9.222.98':445
'63.##9.20.155':445
'63.##9.165.6':445
'63.##9.53.55':445
'63.##9.250.242':445
'63.##9.228.202':445
'63.##9.118.247':445
'63.##9.110.98':445
'63.##9.217.81':445
'63.##9.68.63':445
'63.##9.104.67':445
'63.##9.62.168':445
'63.##9.149.67':445
'63.##9.210.133':445
'63.##9.130.85':139
'63.##9.157.183':139
'63.##9.210.197':445
'63.##9.104.185':445
'63.##9.198.50':445
'63.##9.237.96':445
'63.##9.122.109':445
'63.##9.44.179':445
'63.##9.168.79':445
'63.#09.9.12':445
'63.##9.188.159':445
'63.##9.255.203':445
'63.##9.64.86':445
'63.##9.5.104':445
'63.##9.145.47':445
'63.##9.4.209':445
'63.##9.160.159':445
'63.##9.101.178':445
'63.##9.196.220':445
'63.##9.235.145':445
'63.##9.213.72':445
'63.##9.76.213':445
'63.##9.52.205':445
'63.##9.175.20':445
'63.##9.147.9':445
'63.##9.103.89':445
'63.##9.171.114':445
'63.##9.149.245':445
'63.##9.238.158':445
'63.##9.245.237':445
'63.##9.126.184':445
'63.##9.46.124':445
'63.##9.124.77':445
'63.##9.84.172':445
'63.##9.10.169':445
'63.##9.247.153':139
'63.##9.157.76':139
'63.##9.19.211':139
'63.##9.199.56':139
'63.##9.255.247':139
'63.##9.215.252':139
'63.##9.62.216':139
'63.##9.252.172':139
'63.##9.21.241':139
'63.##9.172.231':139
'63.##9.18.132':139
'63.##9.48.139':445
'63.##9.191.117':139
'63.##9.48.139':139
'63.##9.60.69':139
'63.##9.151.69':139
'63.##9.179.33':139
'63.##9.18.132':445
'63.##9.60.69':445
'63.##9.191.117':445
'63.##9.223.226':445
'63.##9.27.189':445
'63.##9.76.213':139
'63.##9.52.205':139
'63.##9.213.72':139
'63.##9.72.235':445
'63.##9.47.73':445
'63.##9.234.218':445
'63.##9.205.222':445
'63.##9.219.107':445
'63.##9.196.220':139
'63.##9.235.145':139
'63.##9.46.124':139
'63.##9.124.77':139
'63.##9.126.184':139
'63.##9.175.20':139
'63.##9.147.9':139
'63.##9.160.159':139
'63.##9.101.178':139
'63.##9.4.209':139
'63.##9.181.106':445
'63.##9.190.183':445
'63.##9.39.110':445
'63.##9.195.177':445
'63.##9.181.184':445
'63.##9.247.29':445
'63.##9.56.113':445
'63.##9.30.35':445
'63.##9.30.89':445
'63.##9.2.203':445
'63.##9.174.33':445
'63.##9.142.45':445
'63.##9.207.170':445
'63.##9.96.14':445
'63.##9.26.46':445
'63.##9.53.209':445
'63.##9.4.153':445
'63.##9.84.36':445
'63.##9.2.157':445
'63.##9.166.110':445
'63.##9.107.243':445
'63.##9.7.185':445
'63.##9.0.178':445
'63.##9.20.63':139
'63.##9.232.116':445
'63.##9.46.26':445
'63.#09.12.2':445
'63.##9.145.103':445
'63.##9.241.240':445
'63.##9.87.41':445
'63.##9.52.40':139
'63.##9.73.198':139
'63.##9.26.135':139
'63.##9.146.62':139
'63.##9.55.147':139
'63.##9.165.153':139
'63.##9.240.34':139
'63.##9.22.209':139
'63.##9.200.139':139
'63.##9.206.244':139
'63.##9.130.158':445
'63.##9.246.130':445
'63.##9.240.185':445
'63.##9.242.114':445
'63.##9.217.208':445
'63.##9.102.147':445
'63.##9.240.193':445
'63.##9.1.115':445
'63.##9.73.63':445
'63.##9.224.59':445
'63.##9.92.49':445
'63.##9.134.73':445
'63.##9.22.194':445
'63.##9.11.245':445
'63.##9.165.227':445
'63.#09.61.8':445
'63.##9.25.94':445
'63.##9.162.234':445
'63.##9.142.1':445
'63.##9.196.128':445
'63.##9.134.73':139
'63.##9.142.1':139
'63.##9.92.49':139
'63.##9.165.227':139
'63.##9.22.194':139
'63.##9.25.94':139
'63.##9.242.114':139
'63.#09.61.8':139
'63.##9.196.128':139
'63.##9.162.234':139
'63.##9.0.178':139
'63.##9.7.185':139
'63.##9.241.240':139
'63.##9.107.243':139
'63.##9.232.116':139
'63.#09.12.2':139
'63.##9.11.245':139
'63.##9.46.26':139
'63.##9.145.103':139
'63.##9.87.41':139
'63.##9.179.73':139
'63.##9.20.197':139
'63.##9.250.60':139
'63.##9.188.154':139
'63.##9.63.207':139
'63.##9.96.22':139
'63.##9.164.196':139
'63.##9.122.142':139
'63.##9.121.141':139
'63.##9.65.174':139
'63.##9.246.130':139
'63.##9.73.63':139
'63.##9.130.158':139
'63.##9.217.208':139
'63.##9.240.185':139
'63.##9.240.193':139
'63.##9.35.117':139
'63.##9.102.147':139
'63.##9.224.59':139
'63.##9.1.115':139
'63.##9.168.79':139
'63.#09.9.12':139
'63.##9.83.149':139
'63.##9.134.59':139
'63.#09.4.79':139
'63.##9.5.104':139
'63.##9.145.47':139
'63.##9.122.109':139
'63.##9.44.179':139
'63.##9.237.96':139
'63.##9.54.24':139
'63.##9.47.220':139
'63.##9.228.202':139
'63.##9.118.247':139
'63.##9.250.242':139
'63.##9.162.89':139
'63.#09.5.98':139
'63.##9.166.192':139
'63.##9.52.73':139
'63.##9.125.65':139
'63.##9.111.218':445
'63.##9.105.172':445
'63.##9.130.79':445
'63.##9.210.197':139
'63.##9.103.63':445
'63.##9.153.217':445
'63.##9.11.174':445
'63.##9.217.2':445
'63.##9.192.241':445
'63.##9.20.90':445
'63.##9.149.67':139
'63.##9.210.133':139
'63.##9.255.203':139
'63.##9.64.86':139
'63.##9.188.159':139
'63.##9.104.185':139
'63.##9.198.50':139
'63.##9.104.67':139
'63.##9.62.168':139
'63.##9.68.63':139
'63.##9.26.135':445
'63.##9.52.40':445
'63.##9.55.147':445
'63.##9.164.196':445
'63.##9.146.62':445
'63.##9.22.209':445
'63.##9.165.153':445
'63.##9.206.244':445
'63.##9.73.198':445
'63.##9.200.139':445
'63.##9.250.60':445
'63.##9.179.73':445
'63.##9.63.207':445
'63.##9.35.117':445
'63.##9.188.154':445
'63.##9.122.142':445
'63.##9.96.22':445
'63.##9.65.174':445
'63.##9.20.197':445
'63.##9.121.141':445
'63.##9.165.6':139
'63.##9.53.55':139
'63.##9.11.174':139
'63.##9.217.2':139
'63.##9.153.217':139
'63.##9.110.98':139
'63.##9.217.81':139
'63.##9.222.98':139
'63.##9.20.155':139
'63.##9.99.214':139
'63.##9.241.240':9988
'63.##9.103.63':139
'63.##9.146.62':9988
'63.##9.240.34':445
'63.##9.20.63':445
'63.##9.192.241':139
'63.##9.20.90':139
'63.##9.105.172':139
'63.##9.130.79':139
'63.##9.111.218':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней