Trojan.Starman.5311

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WEReacf.dir00\svchost.exe.mdmp 16325836412032060

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WEReacf.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'67.##1.33.56':9988
'67.##1.209.143':9988
'67.##1.28.18':9988
'67.##1.37.189':9988
'67.##1.156.32':9988
'67.##1.11.85':9988
'67.##1.193.244':9988
'67.##1.17.27':9988
'67.##1.85.168':9988
'67.##1.70.155':9988
'67.##1.42.148':9988
'67.##1.83.165':9988
'67.##1.212.94':9988
'67.##1.154.209':9988
'67.##1.39.70':9988
'67.##1.47.247':9988
'67.##1.24.152':9988
'67.##1.252.148':9988
'67.##1.21.59':9988
'67.##1.246.254':9988
'67.##1.21.47':9988
'67.##1.94.110':9988
'67.##1.11.254':9988
'67.##1.213.154':445
'67.##1.154.163':445
'67.##1.68.117':445
'67.##1.8.163':9988
'67.##1.133.178':9988
'67.##1.25.206':445
'67.##1.88.46':445
'67.##1.212.94':445
'67.##1.121.45':445
'67.##1.126.243':445
'67.#81.29.7':445
'67.##1.232.62':9988
'67.##1.13.73':9988
'67.##1.26.250':9988
'67.##1.113.63':9988
'67.##1.66.131':9988
'67.##1.253.193':9988
'67.##1.69.85':9988
'67.##1.70.83':9988
'67.##1.165.14':9988
'67.##1.83.187':9988
'67.##1.36.171':9988
'67.##1.128.90':9988
'67.#81.29.7':9988
'67.##1.252.45':139
'67.##1.88.202':139
'67.##1.62.17':139
'67.##1.136.249':139
'67.##1.220.47':139
'67.##1.202.94':139
'67.##1.25.214':139
'67.##1.160.125':139
'67.##1.85.67':139
'67.##1.95.64':139
'67.##1.105.197':139
'67.##1.136.112':139
'67.##1.32.130':139
'67.##1.26.196':139
'67.##1.225.31':139
'67.##1.179.122':139
'67.##1.122.225':139
'67.##1.250.2':139
'67.##1.215.199':139
'67.##1.207.16':139
'67.##1.15.54':139
'67.##1.254.165':139
'67.##1.186.156':139
'67.##1.63.194':9988
'67.##1.121.45':9988
'67.##1.108.17':9988
'67.##1.108.248':9988
'67.##1.178.198':9988
'67.##1.68.117':9988
'67.##1.154.163':9988
'67.##1.88.46':9988
'67.##1.25.206':9988
'67.##1.213.154':9988
'67.##1.126.243':9988
'67.##1.117.69':9988
'67.##1.198.114':139
'67.##1.114.225':139
'67.##1.192.197':139
'67.#81.8.39':139
'67.##1.240.157':139
'67.##1.27.45':139
'67.##1.57.136':139
'67.##1.81.23':9988
'67.##1.36.102':139
'67.##1.16.246':139
'67.##1.57.45':139
'67.##1.37.189':139
'67.##1.117.69':139
'67.##1.165.14':139
'67.##1.70.83':139
'67.##1.83.165':139
'67.##1.33.56':139
'67.##1.39.70':139
'67.##1.70.155':139
'67.##1.178.198':139
'67.##1.81.23':139
'67.##1.246.254':139
'67.##1.252.148':139
'67.##1.212.94':139
'67.##1.94.110':139
'67.##1.88.46':139
'67.#81.29.7':139
'67.##1.121.45':139
'67.##1.24.152':139
'67.##1.83.187':139
'67.##1.108.248':139
'67.##1.11.254':139
'67.##1.21.47':139
'67.##1.128.90':139
'67.##1.232.62':139
'67.##1.133.178':139
'67.##1.209.143':139
'67.##1.28.18':139
'67.##1.36.171':139
'67.##1.193.244':139
'67.##1.63.194':139
'67.##1.47.247':139
'67.##1.113.63':139
'67.##1.108.17':139
'67.##1.8.163':139
'67.##1.66.131':139
'67.##1.21.59':139
'67.##1.13.73':139
'67.##1.156.32':139
'67.##1.154.209':139
'67.##1.11.85':139
'67.##1.17.27':139
'67.##1.85.168':139
'67.##1.253.193':139
'67.##1.42.148':139
'67.##1.69.85':139
'67.##1.26.250':139
'67.##1.126.243':139
'67.##1.246.254':445
'67.##1.39.70':445
'67.##1.81.23':445
'67.##1.117.69':445
'67.##1.33.56':445
'67.##1.178.198':445
'67.##1.156.32':445
'67.##1.21.59':445
'67.##1.11.85':445
'67.##1.70.155':445
'67.##1.154.209':445
'67.##1.37.189':445
'67.##1.128.90':445
'67.##1.11.254':445
'67.##1.21.47':445
'67.##1.94.110':445
'67.##1.24.152':445
'67.##1.83.187':445
'67.##1.83.165':445
'67.##1.165.14':445
'67.##1.70.83':445
'67.##1.108.248':445
'67.##1.252.148':445
'67.##1.63.194':445
'67.##1.232.62':445
'67.##1.108.17':445
'67.##1.193.244':445
'67.##1.47.247':445
'67.##1.113.63':445
'67.##1.154.163':139
'67.##1.25.206':139
'67.##1.213.154':139
'67.##1.133.178':445
'67.##1.68.117':139
'67.##1.209.143':445
'67.##1.26.250':445
'67.##1.253.193':445
'67.##1.69.85':445
'67.##1.13.73':445
'67.##1.17.27':445
'67.##1.42.148':445
'67.##1.36.171':445
'67.##1.8.163':445
'67.##1.66.131':445
'67.##1.85.168':445
'67.##1.28.18':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней