Trojan.Starman.5582

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERafae.dir00\svchost.exe.mdmp 16325836412028848

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERafae.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'72.#7.7.101':139
'72.#7.22.28':139
'72.##.15.161':139
'72.#7.32.11':139
'72.##.81.218':139
'72.##.186.150':139
'72.##.207.112':139
'72.##.129.179':139
'72.##.22.140':139
'72.#7.10.10':139
'72.##.195.106':445
'72.##.229.194':139
'72.##.106.146':445
'72.##.103.164':445
'72.##.146.103':445
'72.##.75.235':139
'72.##.77.154':139
'72.##.234.107':139
'72.##.35.191':139
'72.##.236.192':139
'72.##.215.84':139
'72.#7.68.45':139
'72.##.132.165':139
'72.##.59.129':139
'72.##.177.141':139
'72.##.33.238':139
'72.#7.99.3':139
'72.##.41.200':139
'72.##.171.200':139
'72.##.146.69':139
'72.##.164.82':139
'72.#7.27.42':139
'72.#7.39.31':139
'72.##.235.34':139
'72.##.62.200':139
'72.#7.142.5':139
'72.##.178.205':139
'72.#7.64.2':139
'72.#7.205.5':139
'72.##.132.132':139
'72.#7.49.8':139
'72.##.58.207':445
'72.#7.91.95':445
'72.##.234.34':445
'72.##.127.161':445
'72.##.78.127':445
'72.##.70.245':445
'72.#7.79.48':445
'72.#7.25.13':445
'72.##.171.182':445
'72.##.111.105':445
'72.##.144.243':445
'72.##.143.144':445
'72.##.118.62':445
'72.##.215.242':445
'72.##.198.99':445
'72.##.89.169':445
'72.#7.162.8':445
'72.##.61.141':445
'72.##.142.219':445
'72.##.206.187':445
'72.##.74.115':445
'72.##.164.93':139
'72.##.103.164':139
'72.#7.93.30':139
'72.##.106.172':445
'72.##.30.107':445
'72.#7.93.30':445
'72.##.164.93':445
'72.##.195.106':139
'72.##.146.103':139
'72.##.106.146':139
'72.##.53.212':445
'72.##.111.157':445
'72.##.87.142':445
'72.##.228.73':445
'72.##.137.161':445
'72.##.152.236':445
'72.##.219.80':445
'72.##.236.172':445
'72.##.122.111':445
'72.##.40.242':445
'72.##.18.122':139
'72.#7.20.42':139
'72.##.237.230':139
'72.#7.36.84':139
'72.##.126.14':445
'72.##.76.137':139
'72.#7.36.84':445
'72.#7.20.42':445
'72.##.76.137':445
'72.##.34.236':139
'72.#7.28.88':139
'72.##.18.122':445
'72.##.10.147':445
'72.##.41.200':445
'72.##.171.200':445
'72.#7.99.3':445
'72.##.202.246':445
'72.##.58.145':445
'72.#7.83.13':445
'72.##.122.223':445
'72.##.184.238':445
'72.##.237.230':445
'72.##.197.119':139
'72.##.184.11':139
'72.##.142.10':139
'72.##.149.114':139
'72.##.84.186':139
'72.##.119.162':139
'72.##.148.24':139
'72.##.108.96':139
'72.##.90.254':139
'72.##.207.198':139
'72.##.143.241':139
'72.##.135.144':139
'72.##.114.142':139
'72.##.34.236':445
'72.#7.28.88':445
'72.#7.168.9':139
'72.##.136.140':139
'72.##.239.123':139
'72.##.172.135':139
'72.##.101.18':139
'72.#7.32.11':445
'72.##.81.218':445
'72.##.77.154':445
'72.##.234.107':445
'72.##.75.235':445
'72.##.22.140':445
'72.#7.10.10':445
'72.#7.22.28':445
'72.##.15.161':445
'72.#7.7.101':445
'72.#7.83.13':139
'72.##.202.246':139
'72.##.184.238':139
'72.##.10.147':139
'72.##.122.223':139
'72.##.35.191':445
'72.##.236.192':445
'72.##.229.194':445
'72.##.58.145':139
'72.##.126.14':139
'72.##.129.179':445
'72.##.177.141':445
'72.##.33.238':445
'72.#7.64.2':445
'72.#7.205.5':445
'72.##.178.205':445
'72.##.146.69':445
'72.##.164.82':445
'72.##.132.165':445
'72.##.59.129':445
'72.#7.68.45':445
'72.##.62.200':445
'72.#7.142.5':445
'72.##.215.84':445
'72.##.186.150':445
'72.##.207.112':445
'72.##.132.132':445
'72.#7.49.8':445
'72.#7.39.31':445
'72.##.235.34':445
'72.#7.27.42':445
'72.##.128.50':445
'72.##.152.10':445
'72.#7.3.31':445
'72.##.190.79':445
'72.##.196.131':445
'72.##.131.219':445
'72.##.255.58':445
'72.##.188.157':445
'72.##.202.38':445
'72.##.164.191':445
'72.#7.21.19':445
'72.##.29.182':139
'72.#7.22.80':139
'72.##.255.81':139
'72.##.148.234':139
'72.#7.8.231':139
'72.##.105.170':139
'72.##.96.226':139
'72.##.173.127':139
'72.##.90.198':139
'72.#7.67.53':139
'72.##.107.204':445
'72.##.79.150':445
'72.##.167.58':445
'72.#7.168.3':445
'72.##.232.228':445
'72.##.40.238':445
'72.##.34.135':445
'72.##.80.104':445
'72.#7.30.60':445
'72.#7.46.99':445
'72.#7.46.88':445
'72.##.10.244':445
'72.##.146.204':445
'72.##.229.77':445
'72.##.28.189':445
'72.##.191.185':445
'72.##.15.205':445
'72.#7.24.18':445
'72.#7.75.93':445
'72.#7.16.65':445
'72.##.80.206':445
'72.##.229.77':139
'72.##.10.244':139
'72.##.191.185':139
'72.##.107.204':139
'72.##.28.189':139
'72.#7.75.93':139
'72.##.15.205':139
'72.##.80.206':139
'72.##.146.204':139
'72.#7.16.65':139
'72.##.190.79':139
'72.##.131.219':139
'72.##.196.131':139
'72.##.202.38':139
'72.#7.21.19':139
'72.##.255.58':139
'72.##.188.157':139
'72.##.152.10':139
'72.##.164.191':139
'72.#7.3.31':139
'72.##.232.228':139
'72.#7.71.63':139
'72.#7.1.159':139
'72.#7.25.58':139
'72.##.225.45':139
'72.##.188.183':139
'72.##.119.226':139
'72.##.37.220':139
'72.#7.32.91':139
'72.#7.57.46':139
'72.##.100.27':139
'72.##.79.150':139
'72.##.167.58':139
'72.##.40.238':139
'72.#7.24.18':139
'72.#7.168.3':139
'72.#7.30.60':139
'72.##.80.104':139
'72.##.34.135':139
'72.#7.46.99':139
'72.#7.46.88':139
'72.##.225.45':445
'72.##.111.105':139
'72.#7.25.13':139
'72.##.171.182':139
'72.##.58.207':139
'72.#7.91.95':139
'72.##.228.73':139
'72.##.137.161':139
'72.##.74.115':139
'72.##.70.245':139
'72.#7.79.48':139
'72.##.206.187':139
'72.##.61.141':139
'72.##.142.219':139
'72.##.144.243':139
'72.##.143.144':139
'72.##.78.127':139
'72.##.234.34':139
'72.##.127.161':139
'72.##.89.169':139
'72.#7.162.8':139
'72.##.87.142':139
'72.##.97.212':445
'72.#7.67.97':445
'72.##.207.215':445
'72.##.182.107':445
'72.##.30.182':445
'72.##.237.147':445
'72.##.255.236':445
'72.##.36.214':445
'72.#7.1.68':445
'72.##.215.155':445
'72.##.40.242':139
'72.##.236.172':139
'72.##.122.111':139
'72.##.53.212':139
'72.##.111.157':139
'72.##.30.107':139
'72.##.37.105':445
'72.##.106.172':139
'72.##.152.236':139
'72.##.219.80':139
'72.##.29.182':445
'72.##.90.198':445
'72.#7.22.80':445
'72.#7.8.231':445
'72.##.255.81':445
'72.##.96.226':445
'72.##.131.219':9988
'72.##.105.170':445
'72.#7.67.53':445
'72.##.173.127':445
'72.#7.1.159':445
'72.#7.57.46':445
'72.#7.71.63':445
'72.##.188.183':445
'72.#7.25.58':445
'72.##.148.234':445
'72.##.37.220':445
'72.##.119.226':445
'72.##.100.27':445
'72.#7.32.91':445
'72.##.196.131':9988
'72.##.36.214':139
'72.##.237.147':139
'72.##.215.155':139
'72.#7.67.97':139
'72.#7.1.68':139
'72.##.198.99':139
'72.##.118.62':139
'72.##.215.242':139
'72.##.255.236':139
'72.##.128.50':139
'72.##.90.198':9988
'72.#7.67.53':9988
'72.##.119.226':9988
'72.##.164.191':9988
'72.##.80.206':9988
'72.##.207.215':139
'72.##.97.212':139
'72.##.30.182':139
'72.##.37.105':139
'72.##.182.107':139

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней