Trojan.Starman.5777

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1c75.dir00\svchost.exe.mdmp 16325836412029812

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1c75.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14#.#0.34.33':445
'14#.#0.51.187':445
'14#.80.4.63':139
'14#.#0.190.201':139
'14#.#0.215.22':445
'14#.#0.190.201':445
'14#.#0.174.239':139
'14#.#0.44.131':445
'14#.80.4.63':445
'14#.#0.188.240':445
'14#.#0.170.188':445
'14#.#0.55.164':445
'14#.#0.100.165':445
'14#.#0.235.170':445
'14#.#0.215.22':139
'14#.#0.44.131':139
'14#.#0.34.33':139
'14#.#0.51.187':139
'14#.#0.193.238':139
'14#.#0.236.57':139
'14#.#0.66.122':139
'14#.#0.206.52':139
'14#.#0.44.214':139
'14#.#0.106.227':139
'14#.#0.101.100':139
'14#.#0.49.78':139
'14#.#0.209.52':139
'14#.#0.242.19':139
'14#.#0.77.155':139
'14#.#0.45.142':139
'14#.#0.194.78':139
'14#.#0.141.174':139
'14#.#0.124.103':139
'14#.#0.16.239':139
'14#.#0.28.123':139
'14#.#0.156.148':139
'14#.#0.244.4':139
'14#.#0.169.43':445
'14#.#0.11.43':445
'14#.#0.83.196':445
'14#.#0.83.189':445
'14#.#0.212.238':445
'14#.#0.202.156':445
'14#.#0.181.211':445
'14#.80.99.5':445
'14#.#0.46.166':445
'14#.#0.148.254':445
'14#.#0.226.132':445
'14#.#0.240.74':445
'14#.#0.13.125':445
'14#.#0.126.156':445
'14#.#0.96.99':445
'14#.#0.207.146':445
'14#.#0.75.200':445
'14#.#0.236.212':445
'14#.#0.1.149':445
'14#.#0.252.218':445
'14#.#0.140.58':445
'14#.#0.25.251':445
'14#.#0.147.135':445
'14#.#0.5.244':445
'14#.#0.191.185':445
'14#.#0.127.228':445
'14#.#0.116.127':445
'14#.#0.182.119':445
'14#.#0.184.155':445
'14#.#0.114.136':445
'14#.#0.2.115':445
'14#.#0.86.187':445
'14#.#0.136.212':445
'14#.#0.191.197':445
'14#.#0.195.159':445
'14#.#0.246.92':445
'14#.#0.75.167':445
'14#.#0.109.116':445
'14#.#0.3.136':139
'14#.#0.111.51':445
'14#.#0.204.240':445
'14#.#0.184.233':445
'14#.#0.23.170':445
'14#.#0.40.87':445
'14#.80.9.39':445
'14#.#0.184.171':445
'14#.#0.215.15':445
'14#.#0.69.115':445
'14#.#0.209.52':445
'14#.#0.242.19':445
'14#.#0.66.122':445
'14#.#0.106.227':445
'14#.#0.101.100':445
'14#.#0.89.176':445
'14#.#0.237.229':445
'14#.#0.49.78':445
'14#.#0.3.136':445
'14#.#0.139.174':445
'14#.#0.179.81':445
'14#.#0.34.88':139
'14#.#0.202.229':445
'14#.#0.243.93':445
'14#.#0.193.245':139
'14#.#0.111.218':139
'14#.#0.37.93':139
'14#.#0.194.60':139
'14#.#0.95.16':139
'14#.#0.155.74':445
'14#.#0.18.160':445
'14#.#0.38.108':445
'14#.#0.73.230':445
'14#.#0.209.143':445
'14#.#0.49.252':445
'14#.#0.162.192':445
'14#.#0.66.207':445
'14#.#0.125.212':445
'14#.#0.236.57':445
'14#.#0.139.174':139
'14#.#0.38.108':139
'14#.80.9.39':139
'14#.#0.184.171':139
'14#.#0.73.230':139
'14#.#0.209.143':139
'14#.#0.66.207':139
'14#.#0.155.74':139
'14#.#0.18.160':139
'14#.#0.184.233':139
'14#.#0.23.170':139
'14#.#0.89.176':139
'14#.#0.237.229':139
'14#.#0.111.51':139
'14#.#0.215.15':139
'14#.#0.69.115':139
'14#.#0.204.240':139
'14#.#0.40.87':139
'14#.#0.125.212':139
'14#.#0.124.103':445
'14#.#0.156.148':445
'14#.#0.77.155':445
'14#.#0.45.142':445
'14#.#0.244.4':445
'14#.#0.206.52':445
'14#.#0.44.214':445
'14#.#0.16.239':445
'14#.#0.28.123':445
'14#.#0.202.229':139
'14#.#0.243.93':139
'14#.#0.49.252':139
'14#.#0.162.192':139
'14#.#0.179.81':139
'14#.#0.194.78':445
'14#.#0.141.174':445
'14#.#0.174.239':445
'14#.#0.193.238':445
'14#.#0.122.145':139
'14#.#0.243.138':139
'14#.80.6.34':139
'14#.#0.202.247':139
'14#.#0.221.59':445
'14#.#0.27.204':445
'14#.#0.46.11':445
'14#.#0.186.152':445
'14#.#0.233.157':445
'14#.#0.30.157':139
'14#.#0.43.80':139
'14#.#0.19.179':139
'14#.#0.42.191':139
'14#.#0.73.17':139
'14#.#0.166.24':139
'14#.#0.204.106':139
'14#.#0.182.4':139
'14#.#0.57.182':139
'14#.#0.53.152':445
'14#.#0.159.224':445
'14#.#0.35.190':445
'14#.#0.9.128':445
'14#.#0.27.218':445
'14#.#0.117.252':445
'14#.#0.23.249':445
'14#.#0.71.215':445
'14#.#0.104.36':445
'14#.#0.39.104':445
'14#.#0.89.31':445
'14#.#0.192.174':445
'14#.#0.69.231':445
'14#.#0.77.213':445
'14#.#0.225.10':445
'14#.#0.34.199':445
'14#.#0.93.205':445
'14#.#0.178.159':445
'14#.#0.239.27':445
'14#.#0.98.148':139
'14#.#0.53.152':139
'14#.#0.186.152':139
'14#.#0.233.157':139
'14#.#0.93.205':139
'14#.#0.27.204':139
'14#.#0.239.27':139
'14#.#0.27.218':139
'14#.#0.89.31':139
'14#.#0.192.174':139
'14#.#0.69.231':139
'14#.#0.178.159':139
'14#.#0.221.59':139
'14#.#0.159.224':139
'14#.#0.225.10':139
'14#.#0.46.11':139
'14#.#0.77.213':139
'14#.#0.9.128':139
'14#.#0.34.199':139
'14#.#0.117.252':139
'14#.#0.39.28':139
'14#.#0.229.87':139
'14#.#0.48.165':139
'14#.#0.52.184':139
'14#.#0.12.212':139
'14#.#0.63.225':139
'14#.#0.65.102':139
'14#.#0.71.12':139
'14#.#0.254.5':139
'14#.#0.39.104':139
'14#.#0.23.249':139
'14#.#0.35.190':139
'14#.#0.104.36':139
'14#.#0.71.215':139
'14#.#0.58.185':139
'14#.#0.71.225':139
'14#.#0.241.77':139
'14#.#0.25.218':139
'14#.#0.241.77':445
'14#.#0.86.187':139
'14#.#0.136.212':139
'14#.80.99.5':139
'14#.#0.252.218':139
'14#.#0.114.136':139
'14#.#0.75.167':139
'14#.#0.109.116':139
'14#.#0.2.115':139
'14#.#0.191.197':139
'14#.#0.212.238':139
'14#.#0.11.43':139
'14#.#0.75.200':139
'14#.#0.83.189':139
'14#.#0.83.196':139
'14#.#0.148.254':139
'14#.#0.181.211':139
'14#.#0.202.156':139
'14#.#0.46.166':139
'14#.#0.195.159':139
'14#.#0.55.164':139
'14#.#0.100.165':139
'14#.#0.116.127':139
'14#.#0.169.43':139
'14#.#0.188.240':139
'14#.#0.49.167':445
'14#.#0.249.112':445
'14#.#0.170.188':139
'14#.#0.235.170':139
'14#.#0.5.244':139
'14#.#0.140.58':139
'14#.#0.246.92':139
'14#.#0.147.135':139
'14#.#0.25.251':139
'14#.#0.184.155':139
'14#.#0.127.228':139
'14#.#0.191.185':139
'14#.#0.182.119':139
'14#.#0.207.146':139
'14#.#0.65.102':445
'14#.#0.98.148':445
'14#.#0.254.5':445
'14#.#0.63.225':445
'14#.#0.19.179':445
'14#.#0.43.80':445
'14#.#0.73.17':445
'14#.#0.30.157':445
'14#.#0.42.191':445
'14#.#0.71.225':445
'14#.#0.48.165':445
'14#.#0.25.218':445
'14#.#0.58.185':445
'14#.#0.52.184':445
'14#.#0.12.212':445
'14#.#0.71.12':445
'14#.#0.39.28':445
'14#.#0.229.87':445
'14#.#0.182.4':445
'14#.#0.13.125':139
'14#.#0.126.156':139
'14#.#0.49.167':139
'14#.#0.249.112':139
'14#.#0.226.132':139
'14#.#0.236.212':139
'14#.#0.1.149':139
'14#.#0.240.74':139
'14#.#0.96.99':139
'14#.#0.204.106':445
'14#.80.6.34':445
'14#.#0.57.182':445
'14#.#0.166.24':445
'14#.#0.202.247':445
'14#.#0.186.152':9988
'14#.#0.221.59':9988
'14#.#0.122.145':445
'14#.#0.243.138':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней