Trojan.Starman.6113

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERc44d.dir00\svchost.exe.mdmp 16325836412032180

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc44d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.##5.137.63':139
'64.##5.163.220':139
'64.##5.210.104':139
'64.##5.231.127':139
'64.##5.12.25':139
'64.##5.55.183':139
'64.#25.32.4':139
'64.##5.170.253':139
'64.##5.249.163':139
'64.##5.123.23':139
'64.##5.14.189':445
'64.##5.216.134':445
'64.##5.1.166':445
'64.##5.238.43':445
'64.##5.148.51':445
'64.##5.50.132':445
'64.##5.46.233':139
'64.##5.150.63':445
'64.##5.103.84':445
'64.##5.135.99':445
'64.##5.222.215':139
'64.##5.65.249':445
'64.##5.163.192':139
'64.##5.222.215':445
'64.##5.55.183':445
'64.#25.32.4':445
'64.#25.9.47':139
'64.##5.191.9':139
'64.##5.79.160':139
'64.##5.86.224':139
'64.##5.51.186':139
'64.##5.12.25':445
'64.##5.210.104':445
'64.##5.231.127':445
'64.##5.65.249':139
'64.##5.46.233':445
'64.##5.123.23':445
'64.##5.170.253':445
'64.##5.249.163':445
'64.##5.137.63':445
'64.##5.163.220':445
'64.##5.213.65':445
'64.##5.250.181':445
'64.##5.156.36':445
'64.##5.50.132':139
'64.##5.135.99':139
'64.##5.150.63':139
'64.##5.78.211':445
'64.##5.203.88':445
'64.##5.222.100':445
'64.##5.175.116':445
'64.##5.162.76':445
'64.##5.213.65':139
'64.##5.238.43':139
'64.##5.164.122':139
'64.##5.66.13':139
'64.##5.151.90':139
'64.##5.216.134':139
'64.##5.103.84':139
'64.##5.14.189':139
'64.##5.148.51':139
'64.##5.1.166':139
'64.##5.35.69':445
'64.##5.237.224':445
'64.##5.141.238':445
'64.##5.111.17':445
'64.#25.26.6':445
'64.##5.135.25':445
'64.##5.151.90':445
'64.##5.164.122':445
'64.##5.66.13':445
'64.##5.82.17':445
'64.##5.23.105':445
'64.##5.228.131':445
'64.##5.128.201':445
'64.##5.201.31':445
'64.##5.15.138':445
'64.##5.126.99':445
'64.##5.251.12':445
'64.##5.224.196':445
'64.##5.44.211':445
'64.##5.15.252':445
'64.#25.88.0':445
'64.##5.2.114':445
'64.##5.46.240':445
'64.##5.146.76':445
'64.#25.69.8':445
'64.##5.27.244':445
'64.##5.54.181':445
'64.##5.17.91':445
'64.##5.157.85':445
'64.##5.245.140':445
'64.##5.30.102':445
'64.##5.79.61':445
'64.##5.154.248':445
'64.##5.25.138':445
'64.##5.206.197':445
'64.##5.187.113':445
'64.##5.45.104':445
'64.#25.3.73':445
'64.##5.146.84':445
'64.##5.194.154':445
'64.##5.172.194':445
'64.##5.16.223':445
'64.##5.153.143':139
'64.##5.205.145':139
'64.##5.110.203':139
'64.##5.4.136':139
'64.#25.42.5':139
'64.##5.155.75':139
'64.##5.146.10':139
'64.##5.42.146':139
'64.#25.5.46':139
'64.##5.14.95':139
'64.##5.51.240':445
'64.#25.18.4':445
'64.##5.66.27':445
'64.##5.144.41':445
'64.##5.189.143':445
'64.##5.23.69':139
'64.##5.185.190':139
'64.##5.38.171':139
'64.##5.46.84':445
'64.##5.108.45':445
'64.#25.5.92':445
'64.#25.3.73':139
'64.#25.69.8':139
'64.##5.45.104':139
'64.##5.172.194':139
'64.##5.146.84':139
'64.##5.46.240':139
'64.##5.245.140':139
'64.##5.2.114':139
'64.##5.27.244':139
'64.##5.146.76':139
'64.#25.5.92':139
'64.##5.206.197':139
'64.##5.233.226':139
'64.##5.171.190':139
'64.##5.130.146':139
'64.##5.154.248':139
'64.##5.194.154':139
'64.##5.79.61':139
'64.##5.187.113':139
'64.##5.25.138':139
'64.##5.30.102':139
'64.##5.51.186':445
'64.##5.79.160':445
'64.##5.86.224':445
'64.##5.108.45':139
'64.##5.163.192':445
'64.##5.130.146':445
'64.##5.233.226':445
'64.##5.171.190':445
'64.#25.9.47':445
'64.##5.191.9':445
'64.##5.16.223':139
'64.##5.144.41':139
'64.##5.17.91':139
'64.##5.157.85':139
'64.##5.54.181':139
'64.#25.18.4':139
'64.##5.46.84':139
'64.##5.51.240':139
'64.##5.189.143':139
'64.##5.66.27':139
'64.##5.23.105':139
'64.##5.217.103':445
'64.##5.94.239':445
'64.##5.192.118':445
'64.##5.224.125':445
'64.##5.48.118':445
'64.##5.252.163':445
'64.##5.218.184':445
'64.##5.164.66':445
'64.##5.2.227':445
'64.#25.66.2':445
'64.##5.110.168':139
'64.##5.254.38':139
'64.##5.1.236':139
'64.##5.165.66':139
'64.##5.168.13':139
'64.##5.126.183':139
'64.##5.137.243':445
'64.##5.155.238':139
'64.##5.216.61':139
'64.##5.42.147':139
'64.##5.150.244':445
'64.##5.8.180':445
'64.##5.199.39':445
'64.##5.105.25':445
'64.##5.170.246':445
'64.##5.55.130':445
'64.##5.34.189':445
'64.##5.151.202':445
'64.##5.189.101':445
'64.##5.14.14':445
'64.##5.101.42':445
'64.##5.209.213':445
'64.##5.234.157':445
'64.##5.14.71':445
'64.##5.77.234':445
'64.##5.221.53':445
'64.##5.188.24':445
'64.##5.207.190':445
'64.##5.116.98':445
'64.##5.3.234':445
'64.##5.251.226':445
'64.##5.79.253':139
'64.##5.221.53':139
'64.##5.14.71':139
'64.##5.77.234':139
'64.##5.218.184':139
'64.##5.150.244':139
'64.##5.251.226':139
'64.##5.116.98':139
'64.##5.3.234':139
'64.##5.209.213':139
'64.##5.234.157':139
'64.##5.94.239':139
'64.##5.217.103':139
'64.##5.2.227':139
'64.##5.48.118':139
'64.##5.192.118':139
'64.##5.164.66':139
'64.##5.252.163':139
'64.#25.66.2':139
'64.##5.137.243':139
'64.##5.224.125':139
'64.##5.188.24':139
'64.##5.197.37':139
'64.##5.96.245':139
'64.##5.10.34':139
'64.##5.151.202':139
'64.##5.34.125':139
'64.##5.173.84':139
'64.#25.0.60':139
'64.##5.84.157':139
'64.##5.15.101':139
'64.##5.248.55':139
'64.##5.105.25':139
'64.##5.8.180':139
'64.##5.55.130':139
'64.##5.207.190':139
'64.##5.170.246':139
'64.##5.189.101':139
'64.##5.34.189':139
'64.##5.101.42':139
'64.##5.199.39':139
'64.##5.14.14':139
'64.##5.154.249':445
'64.##5.227.7':445
'64.##5.158.109':445
'64.##5.1.242':445
'64.##5.108.244':445
'64.##5.156.36':139
'64.##5.175.116':139
'64.##5.250.181':139
'64.##5.118.227':445
'64.##5.95.84':445
'64.##5.95.84':139
'64.##5.228.126':445
'64.##5.118.227':139
'64.##5.154.249':139
'64.##5.227.7':139
'64.##5.241.205':445
'64.##5.48.242':445
'64.##5.51.19':445
'64.##5.211.22':445
'64.##5.154.180':445
'64.##5.162.76':139
'64.##5.224.196':139
'64.#25.26.6':139
'64.##5.251.12':139
'64.#25.88.0':139
'64.##5.44.211':139
'64.##5.141.238':139
'64.##5.82.17':139
'64.##5.237.224':139
'64.##5.135.25':139
'64.##5.111.17':139
'64.##5.35.69':139
'64.##5.15.138':139
'64.##5.203.88':139
'64.##5.222.100':139
'64.##5.78.211':139
'64.##5.128.201':139
'64.##5.15.252':139
'64.##5.228.131':139
'64.##5.126.99':139
'64.##5.201.31':139
'64.##5.158.109':139
'64.##5.110.168':445
'64.##5.254.38':445
'64.##5.1.236':445
'64.##5.165.66':445
'64.##5.168.13':445
'64.##5.126.183':445
'64.##5.94.239':9988
'64.##5.155.238':445
'64.##5.216.61':445
'64.##5.42.147':445
'64.##5.96.245':445
'64.##5.15.101':445
'64.##5.197.37':445
'64.##5.34.125':445
'64.##5.10.34':445
'64.#25.0.60':445
'64.##5.79.253':445
'64.##5.173.84':445
'64.##5.248.55':445
'64.##5.84.157':445
'64.##5.164.66':9988
'64.##5.211.22':139
'64.##5.154.180':139
'64.##5.228.126':139
'64.##5.10.34':9988
'64.##5.84.157':9988
'64.##5.1.242':139
'64.##5.108.244':139
'64.##5.48.242':139
'64.##5.51.19':139
'64.##5.241.205':139
'64.##5.209.213':9988
'64.##5.251.226':9988
'64.##5.221.53':9988
'64.##5.48.118':9988
'64.##5.137.243':9988
'64.##5.14.14':9988
'64.##5.151.202':9988
'64.##5.8.180':9988
'64.##5.170.246':9988
'64.##5.55.130':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней