Trojan.Starman.6594

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2006.dir00\svchost.exe.mdmp 16325836412032268

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2006.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'24.##3.108.185':139
'24.##3.252.19':139
'24.##3.63.223':139
'24.##3.68.53':139
'24.##3.250.251':139
'24.##3.93.67':445
'24.##3.63.223':445
'24.##3.11.160':445
'24.##3.147.43':445
'24.##3.93.67':139
'24.##3.119.24':445
'24.##3.17.119':445
'24.##3.236.168':445
'24.##3.24.40':445
'24.##3.5.109':445
'24.##3.11.160':139
'24.##3.147.43':139
'24.##3.90.56':445
'24.##3.153.52':445
'24.##3.68.53':445
'24.##3.189.242':139
'24.##3.146.80':139
'24.##3.251.109':139
'24.##3.242.250':139
'24.##3.231.154':139
'24.##3.165.250':139
'24.##3.115.219':139
'24.##3.227.38':139
'24.##3.214.210':139
'24.##3.109.172':139
'24.##3.250.251':445
'24.##3.107.36':139
'24.##3.108.185':445
'24.##3.252.19':445
'24.##3.86.134':139
'24.##3.219.140':139
'24.##3.171.185':139
'24.##3.17.18':139
'24.##3.27.28':139
'24.##3.221.180':445
'24.##3.28.40':445
'24.##3.99.183':445
'24.##3.220.17':445
'24.##3.129.201':445
'24.##3.4.128':445
'24.##3.23.40':445
'24.##3.156.211':445
'24.##3.123.141':445
'24.##3.183.61':445
'24.##3.153.52':139
'24.##3.208.166':445
'24.##3.5.109':139
'24.##3.90.56':139
'24.##3.135.208':445
'24.##3.235.23':445
'24.##3.61.235':445
'24.##3.237.135':445
'24.##3.37.203':445
'24.##3.85.178':445
'24.##3.112.93':445
'24.##3.249.112':445
'24.##3.64.65':445
'24.##3.93.64':445
'24.##3.227.15':445
'24.##3.76.79':445
'24.##3.191.201':445
'24.##3.68.94':445
'24.##3.7.180':445
'24.##3.25.47':445
'24.##3.124.210':445
'24.##3.30.164':445
'24.##3.194.85':445
'24.##3.138.19':445
'24.##3.73.31':445
'24.##3.222.230':445
'24.##3.10.119':445
'24.##3.158.159':445
'24.##3.231.123':445
'24.##3.163.8':445
'24.##3.63.210':445
'24.##3.203.91':445
'24.##3.8.213':445
'24.##3.15.76':445
'24.##3.120.25':445
'24.##3.33.150':445
'24.##3.162.120':445
'24.##3.68.10':445
'24.##3.10.95':445
'24.##3.165.250':445
'24.##3.115.219':445
'24.##3.227.38':445
'24.##3.214.210':445
'24.##3.81.77':445
'24.##3.226.51':445
'24.##3.212.140':445
'24.##3.88.249':445
'24.##3.76.134':445
'24.##3.157.33':445
'24.##3.62.207':139
'24.##3.67.85':139
'24.##3.29.178':445
'24.##3.135.6':139
'24.##3.235.130':139
'24.##3.67.98':139
'24.##3.201.232':139
'24.##3.124.95':139
'24.##3.249.247':139
'24.##3.238.218':445
'24.##3.167.168':445
'24.##3.159.56':445
'24.##3.221.156':445
'24.##3.168.221':445
'24.##3.162.249':445
'24.##3.141.76':445
'24.#03.51.6':445
'24.##3.97.128':445
'24.##3.108.166':445
'24.##3.68.10':139
'24.##3.120.25':139
'24.##3.15.76':139
'24.##3.162.120':139
'24.##3.33.150':139
'24.##3.168.221':139
'24.##3.167.168':139
'24.##3.157.33':139
'24.##3.221.156':139
'24.##3.63.210':139
'24.##3.76.134':139
'24.##3.226.51':139
'24.##3.81.77':139
'24.##3.88.249':139
'24.##3.212.140':139
'24.##3.8.213':139
'24.##3.163.8':139
'24.##3.10.95':139
'24.##3.203.91':139
'24.##3.159.56':139
'24.##3.171.185':445
'24.##3.109.172':445
'24.##3.27.28':445
'24.##3.219.140':445
'24.##3.251.109':445
'24.##3.146.80':445
'24.##3.231.154':445
'24.##3.242.250':445
'24.##3.189.242':445
'24.##3.17.18':445
'24.##3.108.166':139
'24.##3.141.76':139
'24.##3.162.249':139
'24.##3.97.128':139
'24.#03.51.6':139
'24.##3.107.36':445
'24.##3.86.134':445
'24.##3.238.218':139
'24.##3.29.178':139
'24.##3.17.119':139
'24.##3.23.110':445
'24.##3.219.128':445
'24.##3.6.184':139
'24.##3.97.190':139
'24.##3.59.219':445
'24.##3.150.150':445
'24.##3.201.51':445
'24.##3.59.223':445
'24.#03.18.8':445
'24.##3.108.60':139
'24.##3.197.182':139
'24.##3.215.57':139
'24.##3.177.120':139
'24.##3.183.211':139
'24.##3.124.111':139
'24.##3.172.112':139
'24.##3.212.91':139
'24.##3.14.111':139
'24.##3.117.80':139
'24.##3.120.23':445
'24.##3.22.203':445
'24.##3.61.58':445
'24.##3.172.172':445
'24.##3.42.79':445
'24.##3.183.8':445
'24.##3.19.211':445
'24.##3.208.98':445
'24.##3.131.220':445
'24.##3.7.117':445
'24.##3.139.44':445
'24.##3.195.97':445
'24.##3.208.121':445
'24.##3.176.31':445
'24.##3.82.175':445
'24.##3.96.28':445
'24.##3.90.89':445
'24.##3.211.202':445
'24.##3.14.44':445
'24.##3.234.150':445
'24.##3.96.28':139
'24.##3.14.44':139
'24.##3.195.97':139
'24.##3.208.121':139
'24.##3.234.150':139
'24.##3.139.44':139
'24.##3.172.172':139
'24.##3.90.89':139
'24.##3.211.202':139
'24.##3.82.175':139
'24.##3.59.219':139
'24.##3.59.223':139
'24.##3.23.110':139
'24.##3.219.128':139
'24.#03.18.8':139
'24.##3.120.23':139
'24.##3.176.31':139
'24.##3.150.150':139
'24.##3.201.51':139
'24.##3.42.79':139
'24.##3.64.16':139
'24.##3.32.219':139
'24.##3.109.79':139
'24.##3.153.204':139
'24.##3.18.80':139
'24.##3.135.175':139
'24.##3.253.247':139
'24.##3.142.74':139
'24.##3.175.200':139
'24.##3.20.120':139
'24.##3.183.8':139
'24.##3.131.220':139
'24.##3.22.203':139
'24.##3.61.58':139
'24.##3.7.117':139
'24.##3.11.142':139
'24.##3.38.149':139
'24.##3.19.211':139
'24.##3.208.98':139
'24.##3.156.211':139
'24.##3.123.141':139
'24.##3.28.40':139
'24.##3.129.201':139
'24.##3.4.128':139
'24.##3.194.85':139
'24.##3.138.19':139
'24.##3.23.40':139
'24.##3.85.178':139
'24.##3.221.180':139
'24.##3.237.135':139
'24.##3.37.203':139
'24.##3.208.166':139
'24.##3.135.208':139
'24.##3.235.23':139
'24.##3.99.183':139
'24.##3.220.17':139
'24.##3.61.235':139
'24.##3.183.61':139
'24.##3.124.210':139
'24.##3.68.94':139
'24.##3.7.180':139
'24.##3.249.112':139
'24.##3.227.15':139
'24.##3.76.79':139
'24.##3.24.40':139
'24.##3.119.24':139
'24.##3.191.201':139
'24.##3.236.168':139
'24.##3.112.93':139
'24.##3.158.159':139
'24.##3.231.123':139
'24.##3.30.164':139
'24.##3.73.31':139
'24.##3.222.230':139
'24.##3.64.65':139
'24.##3.93.64':139
'24.##3.10.119':139
'24.##3.25.47':139
'24.##3.177.120':445
'24.##3.183.211':445
'24.##3.135.175':445
'24.##3.253.247':445
'24.##3.197.182':445
'24.##3.14.111':445
'24.##3.117.80':445
'24.##3.215.57':445
'24.##3.124.111':445
'24.##3.175.200':445
'24.##3.20.120':445
'24.##3.109.79':445
'24.##3.11.142':445
'24.##3.38.149':445
'24.##3.153.204':445
'24.##3.18.80':445
'24.##3.142.74':445
'24.##3.64.16':445
'24.##3.32.219':445
'24.##3.172.112':445
'24.##3.22.203':9988
'24.##3.61.58':9988
'24.##3.208.121':9988
'24.##3.139.44':9988
'24.##3.208.98':9988
'24.##3.215.57':9988
'24.##3.117.80':9988
'24.##3.64.16':9988
'24.##3.124.111':9988
'24.##3.195.97':9988
'24.##3.6.184':445
'24.##3.97.190':445
'24.##3.212.91':445
'24.##3.108.60':445
'24.##3.59.219':9988
'24.##3.59.223':9988
'24.##3.176.31':9988
'24.##3.23.110':9988
'24.##3.219.128':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней