Trojan.Starman.6383

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER1c1f.dir00\svchost.exe.mdmp 16325836412032252

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1c1f.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'63.##8.72.215':139
'63.##8.28.24':139
'63.##8.116.232':139
'63.##8.175.161':139
'63.##8.232.162':139
'63.##8.69.138':139
'63.##8.174.68':139
'63.##8.11.201':139
'63.##8.59.11':139
'63.##8.28.172':139
'63.##8.226.233':139
'63.##8.54.241':139
'63.##8.74.228':139
'63.##8.114.44':139
'63.##8.6.130':445
'63.##8.77.121':445
'63.##8.72.18':139
'63.##8.230.236':139
'63.#38.1.27':139
'63.##8.44.185':139
'63.##8.198.50':139
'63.##8.43.229':139
'63.##8.175.161':445
'63.##8.232.162':445
'63.##8.226.233':445
'63.##8.72.18':445
'63.##8.230.236':445
'63.##8.59.11':445
'63.##8.28.172':445
'63.##8.28.24':445
'63.##8.116.232':445
'63.##8.72.215':445
'63.#38.1.27':445
'63.##8.36.130':139
'63.##8.195.162':139
'63.##8.97.41':139
'63.##8.92.64':139
'63.##8.71.67':139
'63.##8.44.185':445
'63.##8.198.50':445
'63.##8.74.228':445
'63.##8.114.44':445
'63.##8.54.241':445
'63.##8.226.159':139
'63.##8.25.166':139
'63.##8.104.24':139
'63.##8.96.191':139
'63.##8.146.3':139
'63.##8.90.60':445
'63.##8.71.90':445
'63.##8.77.121':139
'63.##8.125.45':139
'63.##8.6.130':139
'63.##8.154.159':139
'63.##8.111.112':139
'63.##8.113.229':139
'63.##8.88.15':139
'63.##8.214.150':139
'63.##8.111.148':139
'63.##8.122.136':139
'63.##8.147.85':139
'63.##8.137.24':139
'63.##8.93.190':139
'63.##8.42.126':139
'63.##8.28.185':445
'63.##8.154.159':445
'63.##8.96.191':445
'63.##8.147.85':445
'63.##8.137.24':445
'63.##8.122.136':445
'63.##8.25.166':445
'63.##8.125.45':445
'63.##8.226.159':445
'63.##8.146.3':445
'63.##8.104.24':445
'63.##8.42.126':445
'63.##8.253.60':445
'63.##8.214.150':445
'63.##8.61.53':445
'63.##8.4.145':445
'63.##8.226.148':445
'63.##8.113.229':445
'63.##8.93.190':445
'63.##8.111.112':445
'63.##8.111.148':445
'63.##8.88.15':445
'63.##8.81.214':445
'63.##8.116.48':445
'63.##8.86.128':445
'63.##8.210.26':445
'63.##8.118.210':445
'63.##8.87.224':139
'63.##8.208.197':139
'63.##8.63.31':139
'63.##8.51.113':445
'63.##8.147.138':445
'63.##8.96.234':445
'63.##8.199.93':445
'63.##8.254.25':445
'63.##8.255.56':445
'63.##8.107.32':445
'63.##8.199.11':445
'63.##8.7.210':445
'63.##8.151.7':445
'63.##8.210.190':445
'63.##8.93.254':445
'63.##8.191.94':445
'63.##8.243.208':139
'63.##8.254.174':139
'63.##8.122.238':139
'63.##8.132.221':139
'63.##8.146.46':139
'63.##8.81.118':139
'63.##8.69.198':139
'63.##8.76.69':139
'63.#38.0.37':139
'63.##8.178.132':139
'63.##8.12.15':139
'63.##8.23.26':139
'63.##8.43.200':139
'63.##8.69.117':139
'63.##8.38.22':139
'63.#38.55.8':139
'63.##8.11.217':139
'63.##8.236.57':139
'63.#38.0.88':139
'63.##8.111.27':139
'63.##8.63.214':139
'63.##8.27.37':139
'63.##8.37.233':139
'63.##8.92.39':139
'63.##8.220.45':139
'63.##8.28.150':139
'63.##8.129.125':139
'63.##8.255.56':139
'63.##8.199.93':139
'63.##8.199.11':139
'63.##8.193.168':139
'63.##8.107.32':139
'63.##8.30.38':139
'63.##8.43.229':445
'63.##8.92.64':445
'63.##8.174.68':445
'63.##8.11.201':445
'63.##8.69.138':445
'63.##8.195.162':445
'63.##8.216.209':139
'63.##8.36.130':445
'63.##8.71.67':445
'63.##8.97.41':445
'63.##8.254.25':139
'63.##8.30.38':445
'63.##8.28.150':445
'63.##8.216.209':445
'63.##8.51.113':139
'63.##8.147.138':139
'63.##8.92.39':445
'63.##8.193.168':445
'63.##8.37.233':445
'63.##8.129.125':445
'63.##8.220.45':445
'63.##8.116.48':139
'63.##8.7.210':139
'63.##8.151.7':139
'63.##8.210.190':139
'63.##8.93.254':139
'63.##8.191.94':139
'63.##8.86.128':139
'63.##8.81.214':139
'63.##8.118.210':139
'63.##8.96.234':139
'63.##8.210.26':139
'63.##8.127.202':445
'63.##8.100.134':445
'63.##8.6.170':445
'63.##8.92.98':445
'63.##8.43.107':445
'63.##8.129.191':445
'63.##8.205.145':445
'63.##8.216.138':445
'63.##8.38.215':445
'63.##8.217.21':445
'63.##8.98.10':445
'63.##8.28.98':139
'63.##8.252.18':139
'63.##8.76.164':139
'63.##8.23.137':139
'63.##8.164.23':139
'63.##8.170.237':445
'63.##8.121.184':445
'63.##8.193.236':139
'63.##8.151.251':139
'63.##8.33.152':139
'63.##8.22.28':445
'63.##8.119.220':445
'63.##8.140.130':445
'63.##8.195.46':445
'63.##8.205.183':445
'63.##8.54.206':445
'63.##8.177.183':445
'63.##8.4.195':445
'63.##8.152.74':445
'63.##8.18.71':445
'63.##8.105.164':445
'63.##8.179.202':445
'63.##8.52.190':445
'63.##8.158.154':445
'63.##8.189.199':445
'63.##8.62.202':445
'63.##8.40.106':445
'63.##8.141.155':445
'63.##8.120.78':445
'63.##8.147.75':445
'63.##8.210.133':445
'63.##8.129.18':445
'63.##8.62.202':139
'63.##8.40.106':139
'63.##8.22.28':139
'63.##8.129.191':139
'63.##8.205.145':139
'63.##8.210.133':139
'63.##8.129.18':139
'63.##8.158.154':139
'63.##8.189.199':139
'63.##8.52.190':139
'63.##8.216.138':139
'63.##8.170.237':139
'63.##8.43.107':139
'63.##8.92.98':139
'63.##8.121.184':139
'63.##8.98.10':139
'63.##8.38.215':139
'63.##8.217.21':139
'63.##8.100.134':139
'63.##8.6.170':139
'63.##8.127.202':139
'63.##8.147.75':139
'63.##8.23.209':139
'63.##8.206.65':139
'63.##8.21.142':139
'63.##8.177.183':139
'63.##8.4.195':139
'63.##8.33.182':139
'63.##8.65.80':139
'63.##8.150.127':139
'63.##8.112.67':139
'63.##8.60.184':139
'63.##8.152.74':139
'63.##8.205.183':139
'63.##8.54.206':139
'63.##8.179.202':139
'63.##8.141.155':139
'63.##8.120.78':139
'63.##8.18.71':139
'63.##8.105.164':139
'63.##8.140.130':139
'63.##8.195.46':139
'63.##8.119.220':139
'63.##8.212.53':445
'63.##8.200.94':445
'63.##8.90.112':445
'63.##8.242.150':445
'63.##8.83.243':445
'63.##8.97.222':445
'63.##8.217.113':445
'63.##8.222.83':445
'63.##8.56.247':445
'63.##8.53.212':445
'63.##8.203.239':139
'63.##8.169.254':139
'63.##8.244.213':139
'63.#38.23.4':139
'63.##8.88.132':139
'63.##8.85.234':139
'63.##8.192.120':139
'63.##8.23.158':139
'63.##8.121.0':139
'63.##8.237.244':139
'63.##8.123.9':139
'63.##8.133.33':445
'63.##8.90.60':139
'63.##8.71.90':139
'63.##8.203.239':445
'63.##8.192.120':445
'63.##8.23.158':445
'63.##8.61.53':139
'63.##8.253.60':139
'63.##8.226.148':139
'63.##8.28.185':139
'63.##8.4.145':139
'63.##8.121.0':445
'63.##8.88.132':445
'63.##8.85.234':445
'63.#38.55.1':445
'63.##8.222.179':445
'63.##8.139.222':445
'63.##8.237.244':445
'63.##8.123.9':445
'63.##8.244.213':445
'63.#38.23.4':445
'63.##8.169.254':445
'63.##8.33.152':445
'63.##8.193.236':445
'63.##8.151.251':445
'63.##8.28.98':445
'63.##8.252.18':445
'63.##8.6.170':9988
'63.##8.127.202':9988
'63.##8.121.184':9988
'63.##8.98.10':9988
'63.##8.170.237':9988
'63.##8.76.164':445
'63.##8.112.67':445
'63.##8.60.184':445
'63.##8.206.65':445
'63.##8.21.142':445
'63.##8.23.209':445
'63.##8.23.137':445
'63.##8.164.23':445
'63.##8.65.80':445
'63.##8.150.127':445
'63.##8.33.182':445
'63.##8.38.215':9988
'63.##8.222.83':139
'63.##8.97.222':139
'63.##8.53.212':139
'63.##8.200.94':139
'63.##8.56.247':139
'63.##8.139.222':139
'63.#38.55.1':139
'63.##8.222.179':139
'63.##8.217.113':139
'63.##8.133.33':139
'63.##8.212.53':139
'63.##8.40.106':9988
'63.##8.189.199':9988
'63.##8.129.191':9988
'63.##8.217.21':9988
'63.##8.216.138':9988
'63.##8.83.243':139
'63.##8.90.112':139
'63.##8.242.150':139
'63.##8.52.190':9988
'63.##8.158.154':9988

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней