Trojan.Starman.5233

Trojan.Starman.5233

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'81.##3.24.187':139
'81.##3.86.225':139
'81.##3.32.114':139
'81.##3.134.117':139
'81.##3.186.54':139
'81.##3.241.158':139
'81.##3.94.99':139
'81.##3.172.16':139
'81.##3.44.132':139
'81.##3.45.197':139
'81.##3.247.37':139
'81.##3.170.8':139
'81.##3.208.60':139
'81.##3.13.141':139
'81.##3.65.42':139
'81.##3.82.65':139
'81.##3.214.109':139
'81.##3.26.77':139
'81.##3.150.191':139
'81.##3.131.254':139
'81.##3.87.111':139
'81.##3.167.247':139
'81.##3.56.70':139
'81.##3.111.97':139
'81.##3.23.122':139
'81.#33.64.6':139
'81.#33.7.14':139
'81.#33.1.8':139
'81.##3.140.212':139
'81.##3.191.140':139
'81.##3.39.124':139
'81.##3.14.215':139
'81.##3.113.203':445
'81.##3.201.15':445
'81.##3.89.132':445
'81.##3.22.62':445
'81.##3.20.27':445
'81.##3.28.122':445
'81.##3.21.201':445
'81.##3.82.231':445
'81.##3.108.191':139
'81.##3.8.163':139
'81.##3.89.201':139
'81.##3.38.68':139
'81.##3.218.160':139
'81.##3.20.220':139
'81.##3.160.178':139
'81.##3.168.217':139
'81.##3.20.220':445
'81.##3.167.83':139
'81.##3.168.217':445
'81.##3.218.160':445
'81.##3.12.239':139
'81.##3.221.118':139
'81.##3.33.161':139
'81.##3.89.192':139
'81.##3.207.101':445
'81.##3.89.201':445
'81.##3.144.51':445
'81.##3.102.40':445
'81.##3.8.163':445
'81.##3.160.178':445
'81.##3.38.68':445
'81.##3.108.191':445
'81.##3.176.93':139
'81.##3.150.191':445
'81.##3.131.254':445
'81.##3.140.212':445
'81.##3.191.140':445
'81.##3.56.70':445
'81.##3.111.97':445
'81.##3.214.109':445
'81.##3.26.77':445
'81.#33.7.14':445
'81.#33.1.8':445
'81.##3.186.54':445
'81.##3.241.158':445
'81.##3.39.124':445
'81.##3.14.215':445
'81.##3.23.122':445
'81.#33.64.6':445
'81.##3.55.23':445
'81.##3.152.3':445
'81.##3.238.172':445
'81.##3.119.224':445
'81.##3.220.49':445
'81.##3.28.173':445
'81.##3.189.190':445
'81.##3.66.15':445
'81.##3.176.93':445
'81.##3.73.177':445
'81.##3.87.111':445
'81.##3.167.247':445
'81.##3.168.227':445
'81.##3.173.177':445
'81.##3.20.74':445
'81.##3.210.20':445
'81.##3.66.15':139
'81.##3.220.49':139
'81.##3.152.3':139
'81.##3.189.190':139
'81.##3.33.161':445
'81.##3.89.192':445
'81.##3.28.173':139
'81.##3.167.83':445
'81.##3.210.20':139
'81.##3.168.227':139
'81.##3.73.177':139
'81.##3.20.74':139
'81.##3.119.224':139
'81.##3.55.23':139
'81.##3.173.177':139
'81.##3.238.172':139
'81.##3.32.114':445
'81.##3.134.117':445
'81.##3.208.60':445
'81.##3.13.141':445
'81.##3.94.99':445
'81.##3.172.16':445
'81.##3.24.187':445
'81.##3.86.225':445
'81.##3.247.37':445
'81.##3.170.8':445
'81.##3.12.239':445
'81.##3.221.118':445
'81.##3.65.42':445
'81.##3.82.65':445
'81.##3.44.132':445
'81.##3.45.197':445
'81.##3.218.195':139
'81.##3.17.45':139
'81.##3.109.70':139
'81.##3.186.109':139
'81.##3.84.34':139
'81.##3.43.115':139
'81.##3.76.221':139
'81.##3.252.189':139
'81.##3.101.135':139
'81.##3.110.14':139
'81.##3.184.113':139
'81.##3.128.217':139
'81.##3.48.64':139
'81.##3.219.84':139
'81.##3.25.252':139
'81.##3.64.226':139
'81.##3.194.74':445
'81.##3.93.12':445
'81.##3.147.49':445
'81.##3.137.29':445
'81.##3.237.90':445
'81.##3.1.220':445
'81.##3.36.254':445
'81.##3.230.18':445
'81.##3.132.69':139
'81.##3.241.2':445
'81.##3.226.42':139
'81.##3.69.226':139
'81.##3.221.61':445
'81.##3.89.243':445
'81.##3.248.124':445
'81.##3.169.103':445
'81.##3.230.18':139
'81.##3.237.90':139
'81.##3.93.12':139
'81.##3.36.254':139
'81.##3.41.40':139
'81.##3.174.40':139
'81.##3.1.220':139
'81.##3.40.83':139
'81.##3.221.61':139
'81.##3.248.124':139
'81.##3.169.103':139
'81.##3.241.2':139
'81.##3.137.29':139
'81.##3.194.74':139
'81.##3.89.243':139
'81.##3.147.49':139
'81.##3.47.31':139
'81.##3.236.152':139
'81.##3.159.217':139
'81.##3.225.4':139
'81.##3.194.45':139
'81.##3.57.68':139
'81.##3.85.185':139
'81.#33.9.69':139
'81.##3.64.206':139
'81.##3.218.98':139
'81.##3.71.76':139
'81.##3.170.133':139
'81.##3.191.196':139
'81.##3.190.226':139
'81.##3.107.107':139
'81.##3.179.27':139
'81.##3.40.83':445
'81.##3.170.133':9988
'81.##3.179.27':9988
'81.##3.1.220':9988
'81.##3.71.76':9988
'81.#33.9.69':9988
'81.##3.57.68':9988
'81.##3.225.4':9988
'81.##3.47.31':9988
'81.##3.226.42':445
'81.##3.69.226':445
'81.##3.84.34':445
'81.##3.43.115':445
'81.##3.169.103':9988
'81.##3.237.90':9988
'81.##3.132.69':445
'81.##3.241.2':9988
'81.##3.82.231':139
'81.##3.20.27':139
'81.##3.201.15':139
'81.##3.21.201':139
'81.##3.102.40':139
'81.##3.207.101':139
'81.##3.28.122':139
'81.##3.144.51':139
'81.##3.184.113':9988
'81.##3.48.64':9988
'81.##3.109.70':9988
'81.##3.194.45':9988
'81.##3.22.62':139
'81.##3.113.203':139
'81.##3.101.135':9988
'81.##3.89.132':139
'81.##3.159.217':445
'81.##3.225.4':445
'81.##3.191.196':445
'81.##3.190.226':445
'81.##3.85.185':445
'81.#33.9.69':445
'81.##3.47.31':445
'81.##3.236.152':445
'81.##3.71.76':445
'81.##3.170.133':445
'81.##3.41.40':445
'81.##3.174.40':445
'81.##3.107.107':445
'81.##3.179.27':445
'81.##3.64.206':445
'81.##3.218.98':445
'81.##3.109.70':445
'81.##3.186.109':445
'81.##3.48.64':445
'81.##3.219.84':445
'81.##3.76.221':445
'81.##3.252.189':445
'81.##3.218.195':445
'81.##3.17.45':445
'81.##3.184.113':445
'81.##3.128.217':445
'81.##3.194.45':445
'81.##3.57.68':445
'81.##3.25.252':445
'81.##3.64.226':445
'81.##3.101.135':445
'81.##3.110.14':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней