Trojan.Starman.5279

Trojan.Starman.5279

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERcb90.dir00\svchost.exe.mdmp 16325836412032384

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WERcb90.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'14.##.130.165':445
'14.##.10.131':445
'14.##.22.151':445
'14.##.57.151':445
'14.##.117.246':445
'14.##.122.180':445
'14.##.111.11':445
'14.##.201.110':445
'14.##.181.158':445
'14.#0.15.89':445
'14.##.219.53':445
'14.##.158.15':445
'14.##.254.135':445
'14.##.79.154':445
'14.##.23.221':445
'14.#0.8.249':445
'14.#0.77.18':445
'14.##.101.51':445
'14.##.130.202':445
'14.#0.46.63':445
'14.#0.2.227':445
'14.##.66.149':445
'14.##.197.238':445
'14.##.212.129':445
'14.##.111.212':445
'14.#0.26.65':445
'14.##.38.131':445
'14.##.217.177':445
'14.##.20.163':445
'14.##.34.238':445
'14.##.219.105':445
'14.##.205.41':445
'14.##.176.187':445
'14.##.130.202':139
'14.##.212.129':139
'14.#0.2.227':139
'14.##.101.51':139
'14.##.197.238':139
'14.##.166.199':139
'14.##.111.212':139
'14.##.66.149':139
'14.##.38.131':139
'14.##.205.41':139
'14.##.20.163':139
'14.#0.26.65':139
'14.##.219.105':139
'14.#0.46.63':139
'14.##.176.187':139
'14.##.34.238':139
'14.##.138.56':139
'14.##.119.124':139
'14.#0.80.60':139
'14.#0.66.53':139
'14.#0.88.51':139
'14.##.42.171':445
'14.##.95.145':445
'14.##.221.204':139
'14.##.171.144':445
'14.#0.98.8':139
'14.##.194.196':139
'14.##.236.205':139
'14.#0.62.47':139
'14.##.106.218':139
'14.##.52.237':139
'14.##.216.181':139
'14.##.187.112':139
'14.##.224.105':139
'14.##.23.252':139
'14.#0.46.74':139
'14.#0.4.38':139
'14.#0.13.51':139
'14.##.227.13':139
'14.#0.15.36':139
'14.##.68.162':139
'14.##.202.202':139
'14.##.24.193':139
'14.##.188.86':139
'14.##.202.187':139
'14.##.219.62':139
'14.##.31.148':139
'14.#0.30.71':139
'14.#0.39.66':139
'14.##.185.226':139
'14.#0.5.243':139
'14.##.46.244':139
'14.##.118.179':139
'14.##.30.183':139
'14.#0.58.80':139
'14.##.35.161':139
'14.#0.48.58':139
'14.##.150.164':139
'14.##.73.190':139
'14.##.146.20':139
'14.#0.2.152':139
'14.##.228.57':139
'14.##.174.219':139
'14.##.135.52':139
'14.##.67.225':139
'14.##.251.185':139
'14.#0.66.53':445
'14.#0.88.51':445
'14.##.106.218':445
'14.##.52.237':445
'14.##.221.204':445
'14.#0.7.104':139
'14.##.119.124':445
'14.#0.80.60':445
'14.##.236.205':445
'14.#0.62.47':445
'14.##.166.199':445
'14.##.138.56':445
'14.##.216.181':445
'14.##.187.112':445
'14.#0.98.8':445
'14.##.194.196':445
'14.##.108.93':139
'14.#0.214.3':139
'14.##.97.248':139
'14.##.103.151':139
'14.##.213.113':139
'14.##.237.162':139
'14.##.85.237':139
'14.#0.81.36':139
'14.##.237.208':139
'14.#0.58.90':139
'14.##.135.26':139
'14.##.103.79':139
'14.##.246.86':139
'14.##.159.33':139
'14.##.251.158':139
'14.##.139.34':139
'14.##.33.114':139
'14.##.75.156':139
'14.##.207.163':139
'14.##.229.132':139
'14.##.161.64':139
'14.##.223.222':139
'14.##.135.171':139
'14.#0.51.9':139
'14.#0.41.92':139
'14.#0.78.67':139
'14.#0.58.53':139
'14.##.55.146':139
'14.##.88.254':139
'14.##.224.60':139
'14.##.86.146':139
'14.##.194.87':139
'14.##.202.208':139
'14.##.71.211':139
'14.#0.65.7':445
'14.##.132.65':445
'14.##.213.203':445
'14.#0.6.214':445
'14.##.81.147':445
'14.##.190.80':445
'14.##.68.132':445
'14.##.150.243':445
'14.##.224.106':445
'14.##.165.233':445
'14.##.144.19':139
'14.##.66.216':445
'14.##.142.111':445
'14.##.68.166':445
'14.##.10.123':445
'14.#0.55.77':445
'14.##.132.65':139
'14.##.68.132':139
'14.#0.6.214':139
'14.#0.65.7':139
'14.##.190.80':139
'14.##.111.190':139
'14.##.150.243':139
'14.##.81.147':139
'14.##.142.111':139
'14.##.66.216':139
'14.#0.55.77':139
'14.##.224.106':139
'14.##.68.166':139
'14.##.213.203':139
'14.##.165.233':139
'14.##.10.123':139
'14.##.168.111':139
'14.##.18.179':139
'14.##.206.17':139
'14.##.198.196':139
'14.##.109.142':139
'14.##.103.105':139
'14.##.24.209':139
'14.##.104.27':139
'14.#0.4.177':139
'14.#0.22.62':139
'14.##.95.246':139
'14.#0.70.87':139
'14.##.32.231':139
'14.##.229.95':139
'14.##.70.254':139
'14.##.211.100':139
'14.#0.1.87':139
'14.#0.51.9':9988
'14.##.71.211':9988
'14.##.229.132':9988
'14.##.75.156':9988
'14.##.95.145':139
'14.##.219.53':139
'14.##.171.144':139
'14.##.42.171':139
'14.##.144.19':445
'14.##.81.147':9988
'14.##.135.171':445
'14.##.71.211':445
'14.#0.55.77':9988
'14.##.88.254':9988
'14.##.150.243':9988
'14.##.66.216':9988
'14.##.158.15':139
'14.##.111.11':139
'14.##.201.110':139
'14.##.130.165':139
'14.##.10.131':139
'14.#0.77.18':139
'14.##.217.177':139
'14.##.117.246':139
'14.##.122.180':139
'14.##.23.221':139
'14.#0.8.249':139
'14.##.181.158':139
'14.#0.15.89':139
'14.##.22.151':139
'14.##.57.151':139
'14.##.254.135':139
'14.##.79.154':139
'14.##.198.196':445
'14.##.109.142':445
'14.##.229.95':445
'14.##.70.254':445
'14.##.206.17':445
'14.#0.4.177':445
'14.##.18.179':445
'14.##.104.27':445
'14.#0.70.87':445
'14.##.32.231':445
'14.##.168.111':445
'14.##.111.190':445
'14.##.211.100':445
'14.#0.1.87':445
'14.#0.22.62':445
'14.##.95.246':445
'14.##.103.105':445
'14.##.161.64':445
'14.##.75.156':445
'14.##.86.146':445
'14.##.229.132':445
'14.#0.41.92':445
'14.##.223.222':445
'14.##.207.163':445
'14.#0.51.9':445
'14.##.88.254':445
'14.#0.78.67':445
'14.##.24.209':445
'14.##.55.146':445
'14.##.202.208':445
'14.##.224.60':445
'14.#0.58.53':445
'14.##.194.87':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней