Trojan.Starman.5288

Trojan.Starman.5288

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER27ff.dir00\svchost.exe.mdmp 16325836412029988

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'84.##5.144.42':445
'84.##5.50.144':445
'84.##5.207.186':445
'84.##5.67.159':445
'84.##5.154.142':445
'84.#35.6.24':445
'84.##5.172.50':445
'84.#35.4.20':445
'84.##5.148.192':445
'84.##5.20.182':445
'84.##5.180.1':445
'84.##5.192.86':445
'84.##5.70.45':445
'84.##5.31.251':445
'84.##5.40.202':445
'84.##5.75.46':445
'84.##5.133.99':445
'84.##5.188.238':445
'84.##5.90.249':445
'84.##5.7.140':445
'84.##5.242.134':445
'84.##5.104.126':445
'84.##5.148.156':445
'84.##5.77.148':445
'84.##5.202.19':445
'84.##5.128.24':445
'84.##5.230.2':445
'84.##5.79.230':445
'84.##5.178.85':445
'84.##5.249.101':445
'84.##5.44.98':445
'84.##5.165.14':445
'84.##5.117.161':445
'84.##5.148.156':139
'84.##5.77.148':139
'84.##5.133.99':139
'84.##5.188.238':139
'84.##5.104.126':139
'84.##5.88.214':139
'84.##5.242.134':139
'84.##5.144.137':139
'84.##5.165.14':139
'84.##5.44.98':139
'84.##5.202.19':139
'84.##5.128.24':139
'84.##5.90.249':139
'84.##5.7.140':139
'84.##5.178.85':139
'84.##5.249.101':139
'84.##5.46.211':139
'84.##5.152.128':139
'84.##5.54.134':139
'84.##5.144.54':139
'84.##5.230.238':445
'84.##5.161.231':445
'84.##5.130.24':139
'84.##5.213.141':445
'84.##5.130.65':139
'84.##5.80.69':139
'84.##5.73.97':139
'84.##5.147.220':139
'84.##5.64.178':139
'84.##5.134.0':139
'84.##5.247.166':139
'84.##5.109.247':139
'84.##5.144.137':445
'84.##5.143.120':139
'84.##5.133.140':139
'84.##5.56.236':139
'84.##5.140.52':139
'84.##5.222.17':139
'84.##5.69.172':139
'84.##5.187.13':139
'84.##5.178.128':139
'84.##5.113.127':139
'84.##5.95.192':139
'84.##5.222.61':139
'84.##5.173.165':139
'84.##5.64.227':139
'84.##5.10.29':139
'84.##5.195.167':139
'84.##5.227.154':139
'84.##5.214.254':139
'84.##5.246.90':139
'84.##5.104.159':139
'84.##5.200.76':139
'84.##5.185.52':139
'84.##5.101.240':139
'84.##5.39.242':139
'84.##5.14.40':139
'84.##5.239.164':139
'84.##5.222.19':139
'84.##5.246.0':139
'84.##5.199.245':139
'84.##5.28.77':139
'84.##5.75.239':139
'84.##5.11.124':139
'84.##5.76.200':139
'84.##5.164.33':139
'84.##5.144.54':445
'84.##5.46.211':445
'84.##5.134.0':445
'84.##5.54.134':445
'84.##5.127.149':139
'84.##5.186.208':139
'84.##5.152.128':445
'84.##5.130.24':445
'84.##5.147.220':445
'84.##5.130.65':445
'84.##5.88.214':445
'84.##5.73.97':445
'84.##5.109.247':445
'84.##5.64.178':445
'84.##5.80.69':445
'84.##5.247.166':445
'84.##5.136.139':139
'84.##5.212.167':139
'84.#35.79.7':139
'84.##5.65.177':139
'84.##5.44.131':139
'84.##5.14.60':139
'84.##5.154.212':139
'84.##5.131.154':139
'84.##5.226.90':139
'84.##5.88.35':139
'84.##5.127.203':139
'84.##5.252.25':139
'84.#35.13.1':139
'84.##5.55.46':139
'84.##5.90.60':139
'84.##5.153.251':139
'84.##5.56.228':139
'84.##5.211.56':139
'84.##5.202.100':139
'84.##5.223.128':139
'84.##5.156.63':139
'84.##5.60.247':139
'84.##5.20.244':139
'84.##5.123.217':139
'84.##5.10.134':139
'84.##5.22.140':139
'84.##5.222.158':139
'84.##5.17.34':139
'84.##5.81.224':139
'84.##5.249.147':139
'84.##5.160.64':139
'84.#35.6.70':139
'84.##5.106.224':445
'84.##5.236.135':445
'84.##5.160.14':445
'84.##5.94.159':445
'84.##5.139.57':445
'84.##5.110.199':445
'84.##5.198.15':445
'84.##5.127.102':445
'84.##5.107.211':445
'84.##5.43.69':445
'84.##5.225.158':139
'84.##5.132.157':139
'84.##5.81.243':445
'84.##5.95.194':445
'84.##5.38.74':445
'84.##5.115.52':445
'84.##5.75.10':139
'84.##5.198.15':139
'84.##5.127.102':139
'84.##5.106.224':139
'84.##5.236.135':139
'84.##5.227.191':139
'84.##5.185.80':139
'84.##5.139.57':139
'84.##5.110.199':139
'84.##5.95.194':139
'84.##5.43.69':139
'84.##5.38.74':139
'84.##5.115.52':139
'84.##5.81.243':139
'84.##5.160.14':139
'84.##5.94.159':139
'84.##5.107.211':139
'84.##5.128.213':139
'84.##5.69.95':139
'84.##5.234.216':139
'84.##5.122.192':139
'84.##5.118.17':139
'84.##5.143.191':139
'84.##5.27.50':139
'84.#35.0.96':139
'84.##5.44.181':139
'84.##5.91.45':139
'84.#35.36.4':139
'84.##5.181.86':139
'84.##5.141.91':139
'84.##5.226.113':139
'84.##5.44.91':139
'84.##5.122.94':139
'84.##5.227.191':445
'84.##5.213.141':139
'84.##5.230.238':139
'84.##5.156.63':9988
'84.##5.132.157':9988
'84.##5.180.1':139
'84.##5.192.86':139
'84.##5.161.231':139
'84.##5.117.161':139
'84.##5.132.157':445
'84.#35.0.96':9988
'84.##5.60.247':445
'84.##5.225.158':445
'84.##5.234.216':9988
'84.##5.123.217':9988
'84.##5.122.94':9988
'84.##5.118.17':9988
'84.##5.172.50':139
'84.#35.4.20':139
'84.##5.144.42':139
'84.##5.50.144':139
'84.##5.230.2':139
'84.##5.79.230':139
'84.##5.154.142':139
'84.#35.6.24':139
'84.##5.40.202':139
'84.##5.75.46':139
'84.##5.148.192':139
'84.##5.20.182':139
'84.##5.207.186':139
'84.##5.67.159':139
'84.##5.70.45':139
'84.##5.31.251':139
'84.##5.156.63':445
'84.##5.122.192':445
'84.##5.128.213':445
'84.##5.226.113':445
'84.##5.234.216':445
'84.#35.0.96':445
'84.##5.143.191':445
'84.##5.69.95':445
'84.##5.27.50':445
'84.##5.181.86':445
'84.##5.44.181':445
'84.##5.185.80':445
'84.#35.36.4':445
'84.##5.122.94':445
'84.##5.141.91':445
'84.##5.91.45':445
'84.##5.44.91':445
'84.##5.249.147':445
'84.##5.223.128':445
'84.##5.81.224':445
'84.##5.202.100':445
'84.##5.20.244':445
'84.##5.123.217':445
'84.##5.56.228':445
'84.##5.211.56':445
'84.##5.222.158':445
'84.##5.17.34':445
'84.##5.118.17':445
'84.##5.75.10':445
'84.##5.160.64':445
'84.#35.6.70':445
'84.##5.10.134':445
'84.##5.22.140':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней