Trojan.Starman.5035

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER5e64.dir00\svchost.exe.mdmp 16325836412032240

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5e64.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'13#.#8.31.101':139
'13#.#8.49.45':445
'13#.#8.148.238':445
'13#.#8.49.45':139
'13#.#8.31.101':445
'13#.#8.21.121':139
'13#.#8.151.18':139
'13#.#8.181.29':139
'13#.#8.148.92':139
'13#.#8.179.150':445
'13#.#8.38.152':445
'13#.#8.224.38':445
'13#.#8.27.67':445
'13#.#8.152.26':445
'13#.#8.53.124':445
'13#.#8.178.167':445
'13#.#8.10.173':445
'13#.#8.226.6':445
'13#.#8.213.139':445
'13#.#8.82.81':139
'13#.#8.116.83':139
'13#.#8.67.70':139
'13#.#8.106.69':139
'13#.#8.129.154':139
'13#.#8.10.219':139
'13#.#8.34.204':139
'13#.#8.52.58':139
'13#.#8.219.225':139
'13#.#8.88.105':139
'13#.#8.8.145':139
'13#.#8.31.55':139
'13#.#8.72.102':139
'13#.#8.252.100':139
'13#.#8.234.124':139
'13#.#8.112.14':139
'13#.#8.74.209':139
'13#.#8.53.222':139
'13#.#8.14.111':139
'13#.#8.109.33':445
'13#.#8.24.66':445
'13#.#8.101.240':445
'13#.#8.10.206':445
'13#.#8.217.24':445
'13#.88.32.3':445
'13#.#8.75.64':445
'13#.#8.135.145':445
'13#.#8.233.113':445
'13#.#8.150.159':445
'13#.#8.103.81':445
'13#.#8.31.129':445
'13#.#8.119.209':445
'13#.#8.7.111':445
'13#.#8.18.91':445
'13#.#8.207.142':445
'13#.#8.34.184':445
'13#.#8.144.122':445
'13#.#8.251.144':445
'13#.#8.154.180':445
'13#.#8.79.228':445
'13#.#8.216.85':445
'13#.#8.22.132':445
'13#.#8.242.79':445
'13#.#8.76.35':445
'13#.#8.132.137':445
'13#.#8.122.59':445
'13#.#8.35.138':445
'13#.#8.226.94':445
'13#.#8.191.196':445
'13#.#8.130.177':445
'13#.#8.154.162':445
'13#.#8.165.82':445
'13#.#8.49.74':445
'13#.#8.19.173':445
'13#.#8.254.190':445
'13#.#8.214.184':445
'13#.#8.167.163':445
'13#.#8.13.161':139
'13#.#8.49.24':445
'13#.#8.37.120':445
'13#.#8.13.161':445
'13#.#8.56.36':445
'13#.#8.81.39':445
'13#.#8.206.114':445
'13#.#8.115.206':445
'13#.#8.61.81':445
'13#.#8.114.198':445
'13#.#8.34.204':445
'13#.#8.106.69':445
'13#.#8.82.81':445
'13#.#8.88.105':445
'13#.#8.67.70':445
'13#.#8.116.83':445
'13#.#8.219.225':445
'13#.#8.10.219':445
'13#.#8.129.154':445
'13#.#8.52.58':445
'13#.#8.41.92':445
'13#.#8.113.103':445
'13#.#8.198.216':445
'13#.#8.62.24':445
'13#.#8.35.62':445
'13#.#8.37.40':139
'13#.#8.155.73':139
'13#.#8.138.82':445
'13#.#8.108.143':445
'13#.#8.195.79':445
'13#.#8.137.112':445
'13#.#8.121.44':445
'13#.#8.54.115':445
'13#.#8.117.54':445
'13#.#8.30.121':445
'13#.#8.34.33':445
'13#.#8.137.11':445
'13#.#8.210.30':445
'13#.#8.234.209':445
'13#.#8.30.121':139
'13#.#8.210.30':139
'13#.#8.137.112':139
'13#.#8.121.44':139
'13#.#8.234.209':139
'13#.#8.195.79':139
'13#.#8.198.216':139
'13#.#8.34.33':139
'13#.#8.137.11':139
'13#.#8.117.54':139
'13#.#8.37.120':139
'13#.#8.81.39':139
'13#.#8.56.36':139
'13#.#8.49.24':139
'13#.#8.61.81':139
'13#.#8.115.206':139
'13#.#8.54.115':139
'13#.#8.114.198':139
'13#.#8.206.114':139
'13#.#8.8.145':445
'13#.#8.31.55':445
'13#.#8.72.102':445
'13#.#8.252.100':445
'13#.#8.234.124':445
'13#.#8.112.14':445
'13#.#8.74.209':445
'13#.#8.53.222':445
'13#.#8.14.111':445
'13#.#8.151.18':445
'13#.#8.113.103':139
'13#.#8.35.62':139
'13#.#8.62.24':139
'13#.#8.41.92':139
'13#.#8.138.82':139
'13#.#8.148.92':445
'13#.#8.21.121':445
'13#.#8.108.143':139
'13#.#8.181.29':445
'13#.#8.158.229':139
'13#.#8.213.132':445
'13#.#8.94.235':139
'13#.#8.254.94':139
'13#.#8.5.132':445
'13#.#8.58.54':445
'13#.#8.162.80':445
'13#.#8.126.12':445
'13#.#8.14.129':445
'13#.#8.235.234':139
'13#.#8.174.113':139
'13#.#8.50.163':139
'13#.#8.25.69':139
'13#.#8.95.62':139
'13#.#8.59.69':139
'13#.#8.121.21':139
'13#.#8.235.203':139
'13#.#8.165.144':139
'13#.#8.122.113':139
'13#.88.0.26':445
'13#.#8.231.137':445
'13#.#8.181.65':445
'13#.#8.66.207':445
'13#.#8.82.146':445
'13#.#8.99.19':445
'13#.#8.255.182':445
'13#.#8.10.215':445
'13#.#8.13.75':445
'13#.#8.66.49':445
'13#.#8.33.249':445
'13#.#8.13.58':445
'13#.#8.26.85':445
'13#.#8.13.159':445
'13#.#8.47.210':445
'13#.#8.185.109':445
'13#.#8.48.169':445
'13#.#8.69.39':445
'13#.#8.165.196':445
'13#.#8.165.196':139
'13#.#8.185.109':139
'13#.#8.47.210':139
'13#.#8.69.39':139
'13#.#8.48.169':139
'13#.#8.66.207':139
'13#.88.0.26':139
'13#.#8.66.49':139
'13#.#8.181.65':139
'13#.#8.13.58':139
'13#.#8.5.132':139
'13#.#8.126.12':139
'13#.#8.26.85':139
'13#.#8.162.80':139
'13#.#8.213.132':139
'13#.#8.13.159':139
'13#.#8.33.249':139
'13#.#8.14.129':139
'13#.#8.58.54':139
'13#.#8.226.197':139
'13#.#8.75.248':139
'13#.#8.51.97':139
'13#.#8.60.153':139
'13#.#8.112.137':139
'13#.#8.236.20':139
'13#.#8.245.228':139
'13#.#8.50.231':139
'13#.#8.146.196':139
'13#.#8.66.204':139
'13#.#8.10.215':139
'13#.#8.13.75':139
'13#.#8.231.137':139
'13#.#8.82.146':139
'13#.#8.99.19':139
'13#.#8.39.135':139
'13#.#8.204.0':139
'13#.#8.255.182':139
'13#.#8.229.220':139
'13#.#8.229.220':445
'13#.#8.49.74':139
'13#.#8.214.184':139
'13#.#8.191.196':139
'13#.#8.130.177':139
'13#.#8.167.163':139
'13#.#8.226.94':139
'13#.#8.216.85':139
'13#.#8.19.173':139
'13#.#8.254.190':139
'13#.#8.165.82':139
'13#.#8.24.66':139
'13#.#8.217.24':139
'13#.#8.10.206':139
'13#.#8.109.33':139
'13#.#8.135.145':139
'13#.#8.75.64':139
'13#.#8.154.162':139
'13#.#8.233.113':139
'13#.88.32.3':139
'13#.#8.53.124':139
'13#.#8.226.6':139
'13#.#8.38.152':139
'13#.#8.224.38':139
'13#.#8.213.139':139
'13#.#8.179.150':139
'13#.#8.148.238':139
'13#.#8.178.167':139
'13#.#8.10.173':139
'13#.#8.152.26':139
'13#.#8.79.228':139
'13#.#8.242.79':139
'13#.#8.22.132':139
'13#.#8.154.180':139
'13#.#8.122.59':139
'13#.#8.132.137':139
'13#.#8.27.67':139
'13#.#8.35.138':139
'13#.#8.76.35':139
'13#.#8.25.69':445
'13#.#8.95.62':445
'13#.#8.236.20':445
'13#.#8.245.228':445
'13#.#8.174.113':445
'13#.#8.165.144':445
'13#.#8.122.113':445
'13#.#8.50.163':445
'13#.#8.59.69':445
'13#.#8.146.196':445
'13#.#8.66.204':445
'13#.#8.51.97':445
'13#.#8.39.135':445
'13#.#8.204.0':445
'13#.#8.60.153':445
'13#.#8.112.137':445
'13#.#8.50.231':445
'13#.#8.226.197':445
'13#.#8.75.248':445
'13#.#8.18.91':139
'13#.#8.144.122':139
'13#.#8.103.81':139
'13#.#8.31.129':139
'13#.#8.251.144':139
'13#.#8.150.159':139
'13#.#8.101.240':139
'13#.#8.207.142':139
'13#.#8.34.184':139
'13#.#8.7.111':139
'13#.#8.235.234':445
'13#.#8.94.235':445
'13#.#8.121.21':445
'13#.#8.235.203':445
'13#.#8.254.94':445
'13#.#8.47.210':9988
'13#.#8.119.209':139
'13#.#8.158.229':445
'13#.#8.229.220':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней