Trojan.Starman.5002

Trojan.Starman.5002

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'83.##.245.110':445
'83.##.100.36':445
'83.##.209.162':445
'83.##.37.161':445
'83.##.165.57':445
'83.##.146.95':445
'83.#6.77.91':445
'83.##.69.173':445
'83.#6.95.69':445
'83.##.146.182':139
'83.##.111.24':139
'83.##.156.173':139
'83.##.246.93':139
'83.##.107.111':139
'83.##.122.224':445
'83.##.162.122':445
'83.##.21.250':139
'83.#6.7.232':139
'83.##.111.24':445
'83.##.107.111':445
'83.##.246.93':445
'83.##.146.182':445
'83.##.21.250':445
'83.##.124.235':139
'83.##.149.246':139
'83.#6.7.232':445
'83.##.193.95':139
'83.##.138.187':445
'83.##.54.186':445
'83.#6.8.209':445
'83.##.106.124':445
'83.##.172.214':445
'83.##.173.68':445
'83.##.156.173':445
'83.#6.86.88':445
'83.##.147.216':445
'83.##.173.68':139
'83.#6.30.42':445
'83.#6.22.30':445
'83.##.249.109':445
'83.##.225.138':445
'83.#6.4.69':445
'83.##.67.158':445
'83.##.174.200':445
'83.##.169.228':445
'83.#6.0.18':445
'83.##.176.145':445
'83.##.37.205':445
'83.##.192.165':445
'83.##.24.217':445
'83.##.27.173':445
'83.#6.59.22':445
'83.##.38.114':445
'83.##.94.210':445
'83.#6.92.94':445
'83.#6.8.209':139
'83.##.106.124':139
'83.##.146.95':139
'83.#6.77.91':139
'83.##.138.187':139
'83.#6.86.88':139
'83.##.147.216':139
'83.##.54.186':139
'83.##.172.214':139
'83.##.209.162':139
'83.##.37.161':139
'83.##.122.224':139
'83.##.162.122':139
'83.##.245.110':139
'83.##.69.173':139
'83.#6.95.69':139
'83.##.100.36':139
'83.##.165.57':139
'83.##.58.111':139
'83.##.220.204':139
'83.##.106.247':445
'83.##.111.47':139
'83.##.193.219':139
'83.#6.102.2':139
'83.##.79.131':139
'83.##.58.120':139
'83.#6.28.54':139
'83.#6.45.49':445
'83.##.18.116':445
'83.#6.81.55':445
'83.##.54.135':445
'83.##.159.134':445
'83.##.136.240':445
'83.##.116.137':445
'83.##.144.33':445
'83.##.239.239':445
'83.##.50.151':139
'83.##.149.25':139
'83.##.83.110':139
'83.##.30.237':139
'83.#6.94.99':139
'83.##.247.189':139
'83.##.166.156':139
'83.#6.173.9':139
'83.##.241.235':139
'83.#6.67.74':139
'83.#6.82.58':139
'83.#6.63.75':139
'83.#6.84.99':139
'83.##.200.175':139
'83.##.107.174':139
'83.##.175.217':139
'83.#6.33.17':139
'83.#6.10.33':139
'83.##.55.195':445
'83.##.55.195':139
'83.#6.81.55':139
'83.##.249.146':139
'83.##.111.55':139
'83.##.54.135':139
'83.##.159.134':139
'83.##.144.33':139
'83.#6.45.49':139
'83.##.18.116':139
'83.##.247.121':139
'83.##.236.247':139
'83.##.41.150':139
'83.##.13.253':139
'83.#6.23.36':139
'83.##.46.225':139
'83.##.26.146':139
'83.##.155.233':139
'83.#6.9.19':139
'83.#6.23.36':445
'83.##.155.233':445
'83.##.247.121':445
'83.##.236.247':445
'83.#6.9.19':445
'83.##.249.146':445
'83.##.111.55':445
'83.##.46.225':445
'83.##.26.146':445
'83.##.116.137':139
'83.##.106.247':139
'83.##.239.239':139
'83.##.136.240':139
'83.##.193.95':445
'83.##.41.150':445
'83.##.13.253':445
'83.##.124.235':445
'83.##.149.246':445
'83.##.14.139':139
'83.#6.95.38':139
'83.##.125.174':139
'83.##.112.139':139
'83.##.249.195':139
'83.##.41.213':445
'83.#6.177.7':445
'83.#6.52.69':445
'83.##.21.218':445
'83.##.179.197':139
'83.#6.49.89':139
'83.#6.41.32':139
'83.##.57.217':139
'83.##.118.136':139
'83.##.231.180':139
'83.#6.4.30':139
'83.#6.79.83':139
'83.##.56.108':139
'83.##.247.202':445
'83.##.183.250':445
'83.#6.38.12':445
'83.##.76.237':445
'83.#6.18.30':445
'83.##.155.66':445
'83.##.62.248':445
'83.##.151.142':445
'83.##.63.142':445
'83.##.225.176':445
'83.##.134.185':445
'83.##.109.227':445
'83.##.181.55':445
'83.##.101.207':445
'83.##.57.232':445
'83.#6.140.0':445
'83.##.165.226':445
'83.##.248.135':445
'83.##.91.130':139
'83.##.57.232':139
'83.#6.140.0':139
'83.##.165.226':139
'83.##.248.135':139
'83.#6.38.12':139
'83.##.183.250':139
'83.#6.18.30':139
'83.##.76.237':139
'83.##.247.202':139
'83.##.21.218':139
'83.#6.52.69':139
'83.#6.177.7':139
'83.##.109.227':139
'83.##.41.213':139
'83.##.134.185':139
'83.##.101.207':139
'83.##.181.55':139
'83.##.225.176':139
'83.##.44.141':139
'83.##.217.239':139
'83.#6.15.96':139
'83.##.166.15':139
'83.##.119.73':139
'83.#6.2.73':139
'83.##.110.141':139
'83.##.227.144':139
'83.##.160.189':139
'83.##.155.66':139
'83.##.62.248':139
'83.##.151.142':139
'83.##.63.142':139
'83.##.233.38':139
'83.#6.43.75':139
'83.##.95.169':139
'83.##.43.150':139
'83.##.204.40':139
'83.##.192.165':139
'83.##.24.217':139
'83.#6.0.4':139
'83.#6.58.93':139
'83.##.37.205':139
'83.##.94.210':139
'83.#6.92.94':139
'83.##.176.145':139
'83.##.27.173':139
'83.#6.79.83':9988
'83.##.125.174':9988
'83.#6.2.73':9988
'83.##.118.136':9988
'83.#6.15.28':139
'83.##.127.28':139
'83.##.132.100':139
'83.##.20.213':139
'83.#6.16.87':139
'83.##.20.213':445
'83.#6.15.28':445
'83.##.67.158':139
'83.##.174.200':139
'83.#6.16.87':445
'83.##.132.100':445
'83.#6.58.93':445
'83.##.127.28':445
'83.#6.0.4':445
'83.##.249.109':139
'83.##.225.138':139
'83.##.38.114':139
'83.#6.59.22':139
'83.#6.30.42':139
'83.##.169.228':139
'83.#6.0.18':139
'83.#6.22.30':139
'83.#6.4.69':139
'83.##.204.40':9988
'83.##.160.189':445
'83.#6.2.73':445
'83.##.119.73':445
'83.##.227.144':445
'83.##.110.141':445
'83.##.57.217':445
'83.##.179.197':445
'83.##.91.130':445
'83.#6.41.32':445
'83.##.204.40':445
'83.#6.43.75':445
'83.##.233.38':445
'83.##.43.150':445
'83.##.95.169':445
'83.##.44.141':445
'83.##.217.239':445
'83.#6.15.96':445
'83.##.166.15':445
'83.##.225.176':9988
'83.#6.177.7':9988
'83.#6.95.38':445
'83.##.249.195':445
'83.##.109.227':9988
'83.##.63.142':9988
'83.##.62.248':9988
'83.##.134.185':9988
'83.##.41.213':9988
'83.#6.79.83':445
'83.##.56.108':445
'83.##.118.136':445
'83.#6.49.89':445
'83.##.231.180':445
'83.##.112.139':445
'83.##.14.139':445
'83.#6.4.30':445
'83.##.125.174':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней