Trojan.Starman.5479

Trojan.Starman.5479

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'58.#23.77.6':139
'58.##3.193.214':139
'58.##3.143.245':139
'58.##3.51.76':139
'58.##3.168.69':139
'58.##3.96.45':139
'58.##3.187.209':139
'58.##3.63.156':139
'58.##3.164.149':139
'58.##3.53.104':445
'58.##3.184.91':445
'58.##3.45.233':139
'58.##3.57.41':139
'58.##3.243.151':139
'58.##3.181.159':139
'58.##3.185.22':139
'58.##3.15.99':139
'58.##3.187.111':139
'58.##3.37.41':139
'58.##3.222.200':139
'58.##3.97.229':139
'58.##3.163.240':139
'58.##3.109.129':139
'58.##3.41.72':139
'58.##3.240.134':139
'58.##3.128.147':139
'58.##3.95.95':139
'58.##3.245.22':139
'58.##3.17.186':139
'58.##3.152.112':139
'58.##3.91.68':139
'58.##3.178.5':445
'58.#23.46.3':445
'58.##3.170.184':445
'58.#23.36.3':445
'58.##3.113.216':445
'58.##3.150.68':445
'58.##3.73.179':139
'58.##3.150.68':139
'58.##3.3.198':445
'58.##3.113.216':139
'58.#23.46.3':139
'58.##3.170.184':139
'58.##3.106.142':445
'58.##3.197.180':445
'58.#23.4.22':445
'58.##3.165.87':445
'58.##3.73.179':445
'58.##3.158.134':445
'58.##3.11.245':445
'58.##3.53.104':139
'58.##3.150.203':445
'58.##3.74.72':445
'58.##3.204.234':445
'58.##3.96.142':445
'58.##3.184.91':139
'58.##3.150.203':139
'58.##3.158.134':139
'58.##3.11.245':139
'58.##3.96.142':139
'58.##3.178.5':139
'58.##3.74.72':139
'58.##3.204.234':139
'58.##3.251.39':139
'58.##3.76.21':445
'58.##3.251.39':445
'58.##3.97.229':445
'58.##3.157.250':445
'58.##3.19.240':445
'58.##3.215.41':445
'58.##3.245.186':445
'58.##3.163.240':445
'58.##3.37.41':445
'58.##3.41.72':445
'58.##3.17.186':445
'58.##3.187.111':445
'58.##3.109.129':445
'58.##3.222.200':445
'58.##3.15.99':445
'58.##3.156.196':445
'58.##3.105.245':139
'58.##3.83.113':139
'58.##3.195.18':139
'58.##3.154.127':139
'58.##3.39.147':139
'58.##3.247.171':139
'58.##3.209.206':139
'58.##3.125.27':139
'58.##3.161.239':445
'58.##3.44.162':445
'58.##3.14.121':445
'58.##3.3.125':445
'58.##3.196.53':139
'58.##3.53.101':445
'58.##3.101.96':445
'58.##3.152.112':445
'58.##3.101.96':139
'58.##3.3.125':139
'58.##3.161.239':139
'58.##3.53.101':139
'58.##3.181.159':445
'58.##3.45.233':445
'58.##3.164.149':445
'58.##3.44.162':139
'58.##3.245.186':139
'58.##3.157.250':139
'58.##3.76.21':139
'58.##3.215.41':139
'58.##3.14.121':139
'58.##3.156.196':139
'58.##3.19.240':139
'58.##3.243.151':445
'58.##3.95.95':445
'58.##3.185.22':445
'58.##3.168.69':445
'58.##3.128.147':445
'58.##3.91.68':445
'58.##3.245.22':445
'58.##3.240.134':445
'58.##3.96.45':445
'58.##3.143.245':445
'58.##3.63.156':445
'58.##3.57.41':445
'58.##3.193.214':445
'58.##3.187.209':445
'58.##3.51.76':445
'58.#23.77.6':445
'58.#23.36.3':139
'58.##3.255.147':139
'58.##3.136.38':139
'58.##3.30.222':139
'58.##3.60.45':139
'58.##3.1.149':139
'58.##3.144.164':139
'58.##3.21.10':139
'58.##3.24.212':139
'58.##3.231.89':139
'58.##3.89.127':139
'58.##3.233.93':139
'58.##3.93.58':139
'58.#23.80.5':139
'58.##3.33.207':139
'58.##3.117.174':139
'58.##3.122.51':139
'58.##3.43.174':445
'58.##3.16.120':445
'58.##3.119.211':445
'58.##3.132.141':445
'58.##3.252.108':445
'58.##3.132.20':445
'58.##3.234.229':445
'58.##3.128.95':445
'58.#23.78.4':139
'58.##3.233.18':139
'58.##3.19.122':139
'58.##3.114.36':445
'58.##3.39.166':445
'58.##3.252.254':445
'58.##3.155.134':445
'58.##3.164.77':139
'58.##3.132.20':139
'58.##3.234.229':139
'58.##3.132.141':139
'58.##3.252.108':139
'58.##3.34.47':139
'58.##3.47.24':139
'58.##3.239.165':139
'58.##3.43.174':139
'58.##3.155.134':139
'58.##3.39.166':139
'58.##3.114.36':139
'58.##3.252.254':139
'58.##3.16.120':139
'58.##3.119.211':139
'58.##3.128.95':139
'58.##3.42.33':139
'58.##3.28.14':139
'58.##3.4.194':139
'58.##3.98.165':139
'58.##3.112.28':139
'58.##3.13.93':139
'58.##3.231.137':139
'58.##3.178.112':139
'58.##3.81.103':139
'58.##3.234.65':139
'58.##3.118.220':139
'58.##3.53.240':139
'58.##3.207.228':139
'58.##3.103.214':139
'58.##3.159.90':139
'58.##3.51.139':139
'58.##3.239.165':445
'58.##3.252.108':9988
'58.##3.231.137':9988
'58.##3.39.166':9988
'58.##3.28.14':9988
'58.##3.51.139':9988
'58.##3.207.228':9988
'58.##3.42.33':9988
'58.##3.239.165':9988
'58.##3.122.51':445
'58.##3.1.149':445
'58.##3.144.164':445
'58.##3.19.122':445
'58.##3.164.77':9988
'58.#23.78.4':445
'58.##3.233.18':445
'58.##3.47.24':9988
'58.##3.106.142':139
'58.##3.234.65':9988
'58.##3.34.47':9988
'58.##3.165.87':139
'58.##3.3.198':139
'58.##3.197.180':139
'58.#23.4.22':139
'58.##3.119.211':9988
'58.##3.132.141':9988
'58.##3.53.240':9988
'58.##3.132.20':9988
'58.##3.43.174':9988
'58.##3.103.214':9988
'58.##3.128.95':9988
'58.##3.252.254':9988
'58.##3.21.10':445
'58.##3.81.103':445
'58.##3.103.214':445
'58.##3.159.90':445
'58.##3.98.165':445
'58.##3.112.28':445
'58.##3.28.14':445
'58.##3.4.194':445
'58.##3.51.139':445
'58.##3.42.33':445
'58.##3.34.47':445
'58.##3.47.24':445
'58.##3.53.240':445
'58.##3.207.228':445
'58.##3.234.65':445
'58.##3.118.220':445
'58.##3.178.112':445
'58.##3.24.212':445
'58.#23.80.5':445
'58.##3.33.207':445
'58.##3.30.222':445
'58.##3.60.45':445
'58.##3.255.147':445
'58.##3.136.38':445
'58.##3.117.174':445
'58.##3.164.77':445
'58.##3.13.93':445
'58.##3.231.137':445
'58.##3.233.93':445
'58.##3.93.58':445
'58.##3.231.89':445
'58.##3.89.127':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней