Trojan.Starman.6580

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER7395.dir00\svchost.exe.mdmp 16325836412027888

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER7395.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'24.##.86.208':445
'24.##.19.237':139
'24.##.163.76':445
'24.##.16.164':445
'24.##.101.20':139
'24.##.101.20':445
'24.##.48.175':445
'24.##.48.175':139
'24.##.19.237':445
'24.#8.77.45':445
'24.##.221.162':445
'24.##.243.80':445
'24.#8.15.83':445
'24.#8.37.25':445
'24.##.30.179':445
'24.##.64.241':445
'24.##.52.230':445
'24.##.58.216':445
'24.##.65.210':445
'24.##.94.206':139
'24.##.91.222':139
'24.##.136.92':139
'24.##.172.23':139
'24.##.221.171':139
'24.##.90.208':139
'24.##.149.254':139
'24.##.203.63':139
'24.#8.21.91':139
'24.##.49.145':139
'24.##.37.186':139
'24.#8.3.30':139
'24.#8.86.24':139
'24.##.240.156':139
'24.##.88.240':139
'24.##.142.83':139
'24.##.14.195':139
'24.##.168.126':139
'24.##.129.206':139
'24.##.188.169':139
'24.#8.29.4':445
'24.##.189.54':445
'24.#8.41.56':445
'24.##.62.206':445
'24.##.31.142':445
'24.##.33.125':445
'24.##.137.62':445
'24.##.71.119':445
'24.##.102.138':445
'24.#8.0.106':445
'24.#8.17.97':445
'24.##.16.164':139
'24.##.86.208':139
'24.#8.77.45':139
'24.##.163.76':139
'24.##.247.53':445
'24.#8.38.70':445
'24.##.232.239':445
'24.#8.77.6':445
'24.##.114.190':445
'24.#8.22.20':445
'24.##.40.175':445
'24.##.163.14':445
'24.##.182.122':445
'24.##.99.146':445
'24.#8.1.48':445
'24.##.125.159':445
'24.##.51.229':445
'24.##.179.68':445
'24.##.13.188':445
'24.##.162.16':445
'24.##.50.192':445
'24.##.165.38':445
'24.##.135.219':445
'24.#8.3.193':445
'24.##.29.251':445
'24.#8.80.57':445
'24.##.125.80':445
'24.##.126.165':445
'24.##.105.85':445
'24.#8.8.53':445
'24.#8.9.131':445
'24.##.22.102':445
'24.#8.25.53':445
'24.#8.92.6':445
'24.#8.90.12':445
'24.##.57.112':445
'24.#8.90.90':445
'24.#8.40.18':445
'24.#8.13.84':445
'24.##.136.92':445
'24.##.90.208':445
'24.##.221.171':445
'24.##.91.222':445
'24.#8.21.91':445
'24.##.203.63':445
'24.##.191.45':445
'24.##.49.145':445
'24.##.149.254':445
'24.#8.46.53':445
'24.##.13.232':445
'24.##.33.254':445
'24.#8.81.88':445
'24.##.66.170':445
'24.#8.61.90':445
'24.##.131.108':139
'24.#8.1.191':139
'24.##.184.244':445
'24.##.131.84':139
'24.##.149.236':445
'24.##.30.101':445
'24.##.151.20':445
'24.##.130.55':445
'24.#8.2.200':445
'24.##.43.116':445
'24.##.171.222':445
'24.##.238.171':445
'24.##.174.129':445
'24.##.25.158':445
'24.##.172.23':445
'24.##.130.55':139
'24.#8.2.200':139
'24.##.57.112':139
'24.#8.46.53':139
'24.##.30.101':139
'24.##.174.129':139
'24.##.25.158':139
'24.##.151.20':139
'24.##.43.116':139
'24.#8.90.90':139
'24.##.22.102':139
'24.#8.8.53':139
'24.##.191.45':139
'24.#8.13.84':139
'24.#8.25.53':139
'24.#8.40.18':139
'24.#8.90.12':139
'24.#8.9.131':139
'24.#8.92.6':139
'24.##.171.222':139
'24.#8.86.24':445
'24.##.142.83':445
'24.##.88.240':445
'24.#8.3.30':445
'24.##.129.206':445
'24.##.168.126':445
'24.##.37.186':445
'24.##.188.169':445
'24.##.14.195':445
'24.##.240.156':445
'24.#8.81.88':139
'24.##.66.170':139
'24.##.238.171':139
'24.##.149.236':139
'24.##.13.232':139
'24.##.184.244':139
'24.##.94.206':445
'24.#8.61.90':139
'24.##.33.254':139
'24.##.52.230':139
'24.##.229.216':445
'24.##.90.254':445
'24.##.152.161':139
'24.#8.86.45':445
'24.##.163.34':445
'24.##.21.159':445
'24.#8.83.42':445
'24.##.133.180':445
'24.##.209.213':445
'24.##.137.75':139
'24.#8.10.90':139
'24.##.194.175':139
'24.#8.19.63':139
'24.##.15.156':139
'24.##.144.96':139
'24.#8.91.6':139
'24.#8.31.81':139
'24.##.63.198':139
'24.#8.76.20':139
'24.#8.9.112':445
'24.#8.6.150':445
'24.##.187.214':445
'24.##.247.253':445
'24.##.34.101':445
'24.##.249.235':445
'24.#8.174.2':445
'24.##.145.104':445
'24.##.139.240':445
'24.##.182.139':445
'24.#8.44.29':445
'24.##.216.209':445
'24.##.95.222':445
'24.##.19.100':445
'24.##.18.242':445
'24.#8.3.243':445
'24.##.156.252':445
'24.##.50.249':445
'24.##.246.228':445
'24.##.253.26':445
'24.##.92.228':139
'24.##.209.213':139
'24.##.163.34':139
'24.##.216.209':139
'24.##.90.254':139
'24.#8.3.243':139
'24.##.50.249':139
'24.#8.44.29':139
'24.##.253.26':139
'24.##.156.252':139
'24.##.19.100':139
'24.#8.86.45':139
'24.##.18.242':139
'24.##.246.228':139
'24.##.21.159':139
'24.##.133.180':139
'24.#8.83.42':139
'24.##.95.222':139
'24.#8.9.112':139
'24.##.229.216':139
'24.##.247.253':139
'24.##.76.193':139
'24.#8.142.1':139
'24.##.236.127':139
'24.##.103.60':139
'24.##.165.253':139
'24.##.80.138':139
'24.##.144.216':139
'24.##.34.135':139
'24.##.69.207':139
'24.#8.77.15':139
'24.##.187.214':139
'24.##.249.235':139
'24.##.34.101':139
'24.#8.6.150':139
'24.##.139.240':139
'24.##.145.104':139
'24.##.66.185':139
'24.##.182.139':139
'24.#8.174.2':139
'24.#8.3.193':139
'24.##.50.192':139
'24.#8.22.20':139
'24.##.135.219':139
'24.##.165.38':139
'24.##.105.85':139
'24.#8.80.57':139
'24.##.29.251':139
'24.##.126.165':139
'24.##.71.119':139
'24.##.31.142':139
'24.##.189.54':139
'24.#8.17.97':139
'24.##.62.206':139
'24.#8.41.56':139
'24.#8.0.106':139
'24.##.137.62':139
'24.##.33.125':139
'24.##.102.138':139
'24.##.125.80':139
'24.#8.37.25':139
'24.##.221.162':139
'24.#8.29.4':139
'24.#8.15.83':139
'24.##.243.80':139
'24.##.65.210':139
'24.##.64.241':139
'24.##.30.179':139
'24.##.58.216':139
'24.##.51.229':139
'24.##.99.146':139
'24.##.40.175':139
'24.##.162.16':139
'24.##.182.122':139
'24.##.163.14':139
'24.##.13.188':139
'24.##.125.159':139
'24.#8.1.48':139
'24.##.179.68':139
'24.##.232.239':139
'24.#8.19.63':445
'24.##.15.156':445
'24.##.144.216':445
'24.##.92.228':445
'24.#8.10.90':445
'24.##.63.198':445
'24.#8.76.20':445
'24.##.194.175':445
'24.##.144.96':445
'24.##.80.138':445
'24.##.236.127':445
'24.##.103.60':445
'24.##.66.185':445
'24.#8.77.15':445
'24.##.76.193':445
'24.##.34.135':445
'24.##.69.207':445
'24.#8.142.1':445
'24.##.165.253':445
'24.#8.91.6':445
'24.##.76.193':9988
'24.#8.142.1':9988
'24.##.236.127':9988
'24.##.103.60':9988
'24.#8.10.90':9988
'24.##.114.190':139
'24.#8.38.70':139
'24.##.247.53':139
'24.#8.77.6':139
'24.##.66.185':9988
'24.##.152.161':445
'24.#8.86.45':9988
'24.#8.31.81':445
'24.##.137.75':445
'24.##.247.253':9988
'24.#8.174.2':9988
'24.##.145.104':9988
'24.##.249.235':9988
'24.##.182.139':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней