Trojan.Starman.4803

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1108 -dm 7 7 %TEMP%\WER07c4.dir00\svchost.exe.mdmp 16325836412029040

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER07c4.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'84.##6.203.27':139
'84.##6.225.203':139
'84.##6.255.52':445
'84.##6.106.196':445
'84.##6.11.116':139
'84.##6.70.99':139
'84.##6.49.75':139
'84.##6.50.105':139
'84.##6.97.50':139
'84.##6.53.79':445
'84.##6.10.217':445
'84.##6.163.186':445
'84.##6.197.76':445
'84.##6.133.231':445
'84.##6.42.132':445
'84.##6.197.48':445
'84.##6.87.107':445
'84.##6.18.148':445
'84.##6.13.118':445
'84.##6.52.178':139
'84.##6.21.24':139
'84.##6.175.232':139
'84.##6.224.156':139
'84.#06.1.7':139
'84.##6.216.229':139
'84.##6.51.171':139
'84.##6.59.60':139
'84.##6.43.163':139
'84.#06.5.50':139
'84.##6.151.92':139
'84.##6.11.161':139
'84.##6.76.192':139
'84.##6.43.116':139
'84.##6.175.79':139
'84.##6.236.178':139
'84.##6.58.50':139
'84.##6.92.206':139
'84.##6.236.87':139
'84.#06.85.9':139
'84.##6.106.196':139
'84.##6.109.110':445
'84.##6.56.127':445
'84.##6.99.15':445
'84.#06.8.96':445
'84.##6.34.79':445
'84.##6.10.112':445
'84.##6.31.29':445
'84.##6.160.100':445
'84.##6.157.37':445
'84.##6.68.55':445
'84.##6.14.137':445
'84.##6.177.73':445
'84.##6.84.75':445
'84.##6.16.200':445
'84.##6.69.81':445
'84.##6.42.146':445
'84.##6.179.5':445
'84.##6.178.69':445
'84.##6.35.179':445
'84.##6.97.96':445
'84.##6.42.132':139
'84.##6.18.148':139
'84.##6.10.217':139
'84.##6.163.186':139
'84.##6.13.118':139
'84.##6.53.79':139
'84.##6.255.52':139
'84.##6.197.48':139
'84.##6.87.107':139
'84.##6.133.231':139
'84.##6.210.206':445
'84.##6.14.45':445
'84.##6.45.151':445
'84.##6.40.218':445
'84.##6.93.20':445
'84.##6.219.28':445
'84.##6.197.76':139
'84.##6.158.92':445
'84.##6.221.106':445
'84.##6.72.41':139
'84.##6.157.72':139
'84.##6.128.29':445
'84.##6.211.4':139
'84.##6.189.157':139
'84.##6.155.84':139
'84.##6.120.154':139
'84.##6.124.189':139
'84.##6.28.173':139
'84.##6.231.246':445
'84.##6.122.23':445
'84.##6.43.122':445
'84.##6.143.112':445
'84.##6.22.232':445
'84.##6.121.43':445
'84.##6.49.141':445
'84.##6.246.203':445
'84.##6.119.120':445
'84.##6.161.3':445
'84.##6.151.192':139
'84.##6.7.190':445
'84.##6.167.167':445
'84.##6.120.154':445
'84.##6.151.192':445
'84.##6.187.136':445
'84.##6.18.201':139
'84.##6.64.208':139
'84.##6.170.190':139
'84.##6.41.72':139
'84.##6.155.84':445
'84.##6.187.136':139
'84.##6.211.4':445
'84.##6.167.167':139
'84.##6.7.190':139
'84.##6.72.41':445
'84.##6.124.189':445
'84.##6.28.173':445
'84.##6.157.72':445
'84.##6.189.157':445
'84.##6.213.14':445
'84.##6.203.27':445
'84.##6.225.203':445
'84.##6.231.246':139
'84.##6.128.29':139
'84.##6.11.116':445
'84.##6.70.99':445
'84.##6.49.75':445
'84.##6.50.105':445
'84.##6.97.50':445
'84.##6.246.203':139
'84.##6.22.232':139
'84.##6.122.23':139
'84.##6.213.14':139
'84.##6.143.112':139
'84.##6.43.122':139
'84.##6.161.3':139
'84.##6.49.141':139
'84.##6.121.43':139
'84.##6.119.120':139
'84.##6.52.178':445
'84.##6.21.24':445
'84.##6.175.232':445
'84.##6.224.156':445
'84.#06.1.7':445
'84.##6.216.229':445
'84.##6.51.171':445
'84.##6.59.60':445
'84.##6.43.163':445
'84.#06.5.50':445
'84.##6.151.92':445
'84.##6.11.161':445
'84.##6.76.192':445
'84.##6.43.116':445
'84.##6.175.79':445
'84.##6.236.178':445
'84.##6.58.50':445
'84.##6.92.206':445
'84.##6.236.87':445
'84.#06.85.9':445
'84.##6.3.199':445
'84.##6.77.21':445
'84.##6.39.141':139
'84.##6.227.50':445
'84.##6.169.226':445
'84.##6.241.84':445
'84.##6.136.23':445
'84.##6.168.34':445
'84.##6.64.109':445
'84.##6.29.35':139
'84.##6.178.190':139
'84.##6.34.152':139
'84.##6.187.45':139
'84.##6.44.213':139
'84.##6.157.114':139
'84.##6.204.33':139
'84.##6.63.63':139
'84.##6.162.27':139
'84.##6.21.112':139
'84.##6.193.140':445
'84.##6.181.154':445
'84.##6.61.182':445
'84.##6.38.84':445
'84.##6.64.71':445
'84.##6.189.61':445
'84.##6.154.196':445
'84.##6.245.173':445
'84.##6.102.146':445
'84.##6.242.202':445
'84.##6.42.77':445
'84.##6.200.162':445
'84.##6.104.87':445
'84.##6.216.144':445
'84.##6.166.27':445
'84.##6.180.145':445
'84.##6.107.182':445
'84.##6.119.199':445
'84.##6.162.6':445
'84.##6.215.114':445
'84.##6.236.225':139
'84.##6.104.87':139
'84.##6.180.145':139
'84.##6.166.27':139
'84.##6.200.162':139
'84.##6.215.114':139
'84.##6.42.77':139
'84.##6.119.199':139
'84.##6.162.6':139
'84.##6.107.182':139
'84.##6.216.144':139
'84.##6.169.226':139
'84.##6.241.84':139
'84.##6.3.199':139
'84.##6.227.50':139
'84.##6.168.34':139
'84.##6.136.23':139
'84.##6.193.140':139
'84.##6.64.109':139
'84.##6.77.21':139
'84.##6.38.84':139
'84.##6.105.45':139
'84.##6.95.105':139
'84.##6.54.38':139
'84.##6.45.54':139
'84.##6.91.199':139
'84.##6.150.4':139
'84.##6.62.149':139
'84.##6.252.226':139
'84.##6.49.223':139
'84.##6.90.191':139
'84.##6.61.182':139
'84.##6.189.61':139
'84.##6.64.71':139
'84.##6.181.154':139
'84.##6.242.202':139
'84.##6.245.173':139
'84.##6.138.23':139
'84.##6.154.196':139
'84.##6.102.146':139
'84.##6.109.110':139
'84.##6.56.127':139
'84.##6.99.15':139
'84.#06.8.96':139
'84.##6.34.79':139
'84.##6.10.112':139
'84.##6.31.29':139
'84.##6.160.100':139
'84.##6.157.37':139
'84.##6.68.55':139
'84.##6.14.137':139
'84.##6.177.73':139
'84.##6.84.75':139
'84.##6.16.200':139
'84.##6.69.81':139
'84.##6.42.146':139
'84.##6.179.5':139
'84.##6.178.69':139
'84.##6.35.179':139
'84.##6.97.96':139
'84.##6.224.130':445
'84.##6.48.31':445
'84.##6.57.230':445
'84.#06.0.58':445
'84.##6.162.252':445
'84.##6.81.32':445
'84.##6.88.178':445
'84.##6.19.250':445
'84.##6.196.174':445
'84.##6.46.219':445
'84.##6.210.206':139
'84.##6.14.45':139
'84.##6.45.151':139
'84.##6.40.218':139
'84.##6.93.20':139
'84.##6.219.28':139
'84.##6.45.252':445
'84.##6.158.92':139
'84.##6.221.106':139
'84.##6.88.178':139
'84.##6.187.45':445
'84.##6.44.213':445
'84.##6.62.149':445
'84.##6.236.225':445
'84.##6.178.190':445
'84.##6.162.27':445
'84.##6.21.112':445
'84.##6.157.114':445
'84.##6.34.152':445
'84.##6.150.4':445
'84.##6.54.38':445
'84.##6.45.54':445
'84.##6.90.191':445
'84.##6.138.23':445
'84.##6.105.45':445
'84.##6.252.226':445
'84.##6.49.223':445
'84.##6.95.105':445
'84.##6.91.199':445
'84.##6.204.33':445
'84.#06.0.58':139
'84.##6.224.130':139
'84.##6.46.219':139
'84.##6.57.230':139
'84.##6.48.31':139
'84.##6.196.174':139
'84.##6.81.32':139
'84.##6.162.252':139
'84.##6.19.250':139
'84.##6.45.252':139
'84.##6.39.141':445
'84.##6.3.199':9988
'84.##6.63.63':445
'84.##6.29.35':445
'84.##6.227.50':9988
'84.##6.42.77':9988
'84.##6.200.162':9988
'84.##6.162.6':9988
'84.##6.180.145':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней