Trojan.Starman.5164

Trojan.Starman.5164

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER12ad.dir00\svchost.exe.mdmp 16325836412032428

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER12ad.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'69.##8.33.14':445
'69.##8.32.26':445
'69.##8.209.60':445
'69.##8.63.176':445
'69.##8.218.92':445
'69.##8.190.217':445
'69.##8.162.147':445
'69.##8.93.162':445
'69.#18.1.79':445
'69.##8.46.119':445
'69.##8.129.208':445
'69.##8.56.57':445
'69.##8.23.136':445
'69.##8.152.58':445
'69.#18.5.91':445
'69.##8.148.73':445
'69.##8.241.190':445
'69.##8.245.180':445
'69.##8.43.17':445
'69.##8.69.28':445
'69.##8.119.68':445
'69.##8.223.83':445
'69.##8.41.224':445
'69.##8.51.233':445
'69.##8.144.213':445
'69.##8.2.114':445
'69.##8.120.173':445
'69.##8.130.241':445
'69.##8.49.184':445
'69.##8.55.226':445
'69.##8.35.79':445
'69.##8.34.170':445
'69.##8.226.44':445
'69.##8.107.102':445
'69.##8.245.180':139
'69.##8.43.17':139
'69.##8.69.28':139
'69.##8.119.68':139
'69.##8.223.83':139
'69.##8.41.224':139
'69.##8.51.233':139
'69.##8.144.213':139
'69.##8.2.114':139
'69.##8.120.173':139
'69.##8.130.241':139
'69.##8.49.184':139
'69.##8.55.226':139
'69.##8.35.79':139
'69.##8.34.170':139
'69.##8.226.44':139
'69.##8.108.193':139
'69.##8.251.86':139
'69.##8.213.250':139
'69.##8.133.134':139
'69.##8.240.0':139
'69.##8.107.147':139
'69.##8.155.39':445
'69.##8.39.39':139
'69.##8.170.147':139
'69.##8.123.111':139
'69.##8.154.3':139
'69.##8.131.57':139
'69.##8.125.134':139
'69.##8.80.191':139
'69.##8.134.80':139
'69.##8.217.233':139
'69.##8.216.69':139
'69.#18.55.6':139
'69.##8.229.51':139
'69.##8.152.98':139
'69.##8.8.165':139
'69.##8.75.103':139
'69.##8.118.75':139
'69.##8.171.229':139
'69.##8.28.69':139
'69.##8.115.2':139
'69.##8.28.82':139
'69.##8.196.112':139
'69.##8.155.71':139
'69.##8.153.27':139
'69.##8.202.153':139
'69.##8.179.92':139
'69.##8.27.128':139
'69.##8.45.53':139
'69.##8.14.219':139
'69.##8.183.14':139
'69.#18.5.79':139
'69.##8.6.223':139
'69.##8.124.86':139
'69.##8.96.142':139
'69.##8.46.77':139
'69.#18.6.95':139
'69.##8.136.105':139
'69.##8.74.136':139
'69.##8.100.36':139
'69.##8.229.55':139
'69.##8.30.111':139
'69.##8.119.191':139
'69.##8.24.74':139
'69.##8.90.24':139
'69.##8.201.12':139
'69.##8.240.0':445
'69.##8.251.86':445
'69.##8.134.80':445
'69.##8.133.134':445
'69.##8.170.147':445
'69.##8.107.147':445
'69.##8.213.250':445
'69.##8.39.39':445
'69.##8.125.134':445
'69.##8.123.111':445
'69.##8.108.193':445
'69.##8.131.57':445
'69.##8.216.69':445
'69.##8.80.191':445
'69.##8.154.3':445
'69.##8.217.233':445
'69.##8.25.174':139
'69.##8.96.204':139
'69.##8.155.139':139
'69.##8.88.230':139
'69.##8.30.88':139
'69.##8.72.117':139
'69.##8.160.222':139
'69.##8.113.155':139
'69.##8.34.48':139
'69.##8.168.110':139
'69.##8.56.148':139
'69.##8.161.25':139
'69.##8.142.161':139
'69.##8.28.206':139
'69.##8.115.85':139
'69.##8.49.189':139
'69.#18.8.31':139
'69.##8.58.120':139
'69.##8.251.57':139
'69.##8.25.144':139
'69.##8.120.25':139
'69.##8.151.100':139
'69.##8.72.13':139
'69.##8.45.251':139
'69.##8.72.46':139
'69.##8.215.22':139
'69.##8.207.47':139
'69.##8.171.0':139
'69.##8.6.117':139
'69.##8.166.167':139
'69.##8.140.43':139
'69.##8.84.41':139
'69.##8.33.214':139
'69.##8.40.72':139
'69.##8.242.211':445
'69.##8.33.171':445
'69.##8.47.93':445
'69.##8.132.127':445
'69.##8.224.250':445
'69.##8.117.225':445
'69.##8.34.169':445
'69.##8.125.49':445
'69.##8.222.101':445
'69.##8.200.207':445
'69.##8.133.250':445
'69.##8.144.111':445
'69.##8.248.79':445
'69.##8.16.81':445
'69.##8.80.65':445
'69.##8.111.196':445
'69.##8.104.150':139
'69.##8.242.211':139
'69.##8.33.171':139
'69.##8.47.93':139
'69.##8.132.127':139
'69.##8.224.250':139
'69.##8.117.225':139
'69.##8.125.49':139
'69.##8.34.169':139
'69.##8.222.101':139
'69.##8.200.207':139
'69.##8.133.250':139
'69.##8.16.81':139
'69.##8.80.65':139
'69.##8.248.79':139
'69.##8.111.196':139
'69.##8.144.111':139
'69.##8.119.210':139
'69.##8.192.101':139
'69.##8.33.230':139
'69.##8.39.65':139
'69.##8.19.246':139
'69.##8.76.198':139
'69.##8.172.120':139
'69.##8.41.161':139
'69.#18.2.27':139
'69.##8.47.72':139
'69.##8.184.46':139
'69.#18.8.20':139
'69.##8.61.129':139
'69.##8.181.120':139
'69.##8.87.247':139
'69.##8.241.183':139
'69.##8.163.157':139
'69.##8.166.167':9988
'69.##8.45.251':9988
'69.##8.104.150':9988
'69.##8.207.47':9988
'69.##8.155.39':139
'69.##8.107.102':139
'69.##8.151.100':9988
'69.##8.40.72':9988
'69.#18.8.20':9988
'69.##8.80.65':9988
'69.##8.40.72':445
'69.##8.39.65':9988
'69.##8.47.72':9988
'69.##8.76.198':9988
'69.##8.200.207':9988
'69.##8.16.81':9988
'69.##8.129.208':139
'69.##8.32.26':139
'69.##8.162.147':139
'69.##8.63.176':139
'69.##8.33.14':139
'69.##8.190.217':139
'69.##8.241.190':139
'69.##8.93.162':139
'69.##8.218.92':139
'69.##8.46.119':139
'69.#18.5.91':139
'69.##8.56.57':139
'69.#18.1.79':139
'69.##8.152.58':139
'69.##8.209.60':139
'69.##8.148.73':139
'69.##8.23.136':139
'69.##8.72.13':445
'69.##8.19.246':445
'69.##8.192.101':445
'69.##8.87.247':445
'69.##8.39.65':445
'69.#18.2.27':445
'69.##8.76.198':445
'69.##8.33.230':445
'69.##8.41.161':445
'69.##8.47.72':445
'69.##8.61.129':445
'69.##8.119.210':445
'69.#18.8.20':445
'69.##8.241.183':445
'69.##8.181.120':445
'69.##8.184.46':445
'69.##8.163.157':445
'69.##8.172.120':445
'69.##8.25.144':445
'69.##8.58.120':445
'69.##8.166.167':445
'69.##8.140.43':445
'69.##8.72.46':445
'69.##8.151.100':445
'69.##8.251.57':445
'69.##8.45.251':445
'69.##8.6.117':445
'69.##8.215.22':445
'69.##8.104.150':445
'69.##8.171.0':445
'69.##8.33.214':445
'69.##8.120.25':445
'69.##8.207.47':445
'69.##8.84.41':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней