Trojan.Starman.5335

Trojan.Starman.5335

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER06a3.dir00\svchost.exe.mdmp 16325836412032128

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER06a3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'69.##.19.144':445
'69.#0.80.92':445
'69.##.54.158':445
'69.#0.1.133':445
'69.#0.85.29':445
'69.#0.24.6':445
'69.#0.67.39':445
'69.##.31.246':445
'69.##.224.162':445
'69.##.137.178':445
'69.##.149.112':139
'69.##.89.149':139
'69.##.16.125':445
'69.#0.32.87':445
'69.##.116.241':445
'69.##.38.233':445
'69.##.211.200':445
'69.#0.115.7':445
'69.#0.2.167':445
'69.##.215.174':139
'69.##.12.188':445
'69.##.215.174':445
'69.##.181.248':139
'69.##.106.103':445
'69.##.108.83':445
'69.##.89.149':445
'69.##.12.188':139
'69.##.112.246':445
'69.##.149.112':445
'69.##.106.103':139
'69.##.108.83':139
'69.#0.115.7':139
'69.#0.2.167':139
'69.##.112.246':139
'69.#0.31.66':9988
'69.##.138.162':9988
'69.#0.72.94':9988
'69.##.148.195':9988
'69.##.245.88':9988
'69.##.99.221':9988
'69.##.28.118':9988
'69.#0.3.9':9988
'69.##.110.83':9988
'69.#0.77.39':9988
'69.##.236.156':9988
'69.#0.9.129':9988
'69.##.26.219':9988
'69.##.129.49':9988
'69.##.183.84':9988
'69.##.58.192':9988
'69.#0.9.162':9988
'69.#0.80.92':139
'69.#0.67.39':139
'69.#0.1.133':139
'69.##.19.144':139
'69.#0.24.6':139
'69.##.211.200':139
'69.##.31.246':139
'69.#0.85.29':139
'69.##.137.178':139
'69.##.116.241':139
'69.##.103.116':9988
'69.##.224.162':139
'69.#0.32.87':139
'69.##.54.158':139
'69.##.38.233':139
'69.##.16.125':139
'69.##.154.30':139
'69.##.130.251':139
'69.##.125.116':139
'69.##.47.114':139
'69.#0.9.160':139
'69.##.68.216':139
'69.##.161.217':139
'69.##.218.88':139
'69.##.230.53':139
'69.##.102.50':139
'69.##.29.203':139
'69.##.56.142':139
'69.##.117.58':139
'69.##.166.118':139
'69.##.75.153':139
'69.##.15.195':139
'69.##.107.122':139
'69.##.200.53':139
'69.##.84.192':139
'69.##.205.171':139
'69.##.141.233':139
'69.##.161.93':139
'69.#0.166.7':139
'69.##.238.165':139
'69.##.122.173':139
'69.#0.7.114':139
'69.##.120.127':139
'69.##.122.111':139
'69.##.121.85':139
'69.##.167.162':139
'69.##.105.124':139
'69.#0.6.23':139
'69.##.252.134':139
'69.##.124.252':139
'69.##.244.175':445
'69.##.90.161':139
'69.##.240.226':139
'69.##.201.197':139
'69.##.34.215':139
'69.#0.1.0':139
'69.##.244.175':139
'69.##.46.119':139
'69.#0.1.132':139
'69.##.53.100':139
'69.##.141.133':139
'69.##.76.177':139
'69.#0.54.26':139
'69.##.218.188':139
'69.##.212.163':139
'69.##.86.141':139
'69.#0.93.86':139
'69.##.181.248':445
'69.##.34.215':445
'69.##.90.161':445
'69.##.212.163':445
'69.##.201.197':445
'69.#0.1.132':445
'69.#0.1.0':445
'69.##.240.226':445
'69.##.46.119':445
'69.#0.54.26':445
'69.##.53.100':445
'69.##.154.30':445
'69.##.76.177':445
'69.#0.93.86':445
'69.##.218.188':445
'69.##.141.133':445
'69.##.86.141':445
'69.#0.94.88':139
'69.##.28.118':139
'69.#0.72.94':139
'69.#0.23.49':139
'69.##.230.124':139
'69.##.99.221':139
'69.##.103.116':139
'69.##.26.219':139
'69.##.110.83':139
'69.##.148.195':139
'69.##.199.67':139
'69.##.236.156':139
'69.##.129.49':139
'69.#0.31.66':139
'69.##.138.162':139
'69.#0.9.162':139
'69.##.179.226':139
'69.#0.9.129':445
'69.##.116.253':445
'69.##.199.249':445
'69.##.190.217':445
'69.#0.37.78':445
'69.##.180.219':445
'69.##.36.228':445
'69.#0.81.57':445
'69.##.103.250':445
'69.##.249.164':445
'69.##.99.103':445
'69.##.200.221':445
'69.#0.3.9':445
'69.#0.77.39':445
'69.#0.96.1':445
'69.#0.96.96':445
'69.##.132.167':139
'69.#0.9.129':139
'69.##.116.253':139
'69.##.199.249':139
'69.##.190.217':139
'69.#0.37.78':139
'69.##.180.219':139
'69.##.36.228':139
'69.#0.81.57':139
'69.##.200.221':139
'69.##.249.164':139
'69.##.99.103':139
'69.##.103.250':139
'69.#0.3.9':139
'69.#0.77.39':139
'69.#0.96.1':139
'69.#0.96.96':139
'69.#0.38.41':139
'69.#0.37.50':139
'69.##.84.226':139
'69.#0.38.89':139
'69.#0.14.67':139
'69.##.89.153':139
'69.##.93.174':139
'69.##.183.84':139
'69.##.245.88':139
'69.#0.33.13':139
'69.##.129.148':139
'69.#0.73.38':139
'69.##.110.190':139
'69.#0.48.47':139
'69.##.138.96':139
'69.##.58.192':139
'69.##.47.132':139
'69.#0.38.41':445
'69.#0.96.1':9988
'69.#0.37.50':9988
'69.##.179.226':9988
'69.##.99.103':9988
'69.##.93.174':9988
'69.#0.81.57':9988
'69.#0.48.47':9988
'69.##.180.219':9988
'69.##.103.250':9988
'69.##.249.164':9988
'69.##.200.221':9988
'69.#0.96.96':9988
'69.##.84.226':9988
'69.##.230.124':9988
'69.#0.38.41':9988
'69.#0.33.13':9988
'69.##.47.132':9988
'69.##.89.153':9988
'69.#0.23.49':9988
'69.#0.94.88':9988
'69.##.138.96':9988
'69.##.199.249':9988
'69.#0.14.67':9988
'69.##.190.217':9988
'69.##.116.253':9988
'69.##.129.148':9988
'69.#0.37.78':9988
'69.##.199.67':9988
'69.##.110.190':9988
'69.##.132.167':9988
'69.##.36.228':9988
'69.#0.38.89':9988
'69.#0.73.38':9988
'69.##.179.226':445
'69.#0.37.50':445
'69.##.84.226':445
'69.#0.38.89':445
'69.#0.14.67':445
'69.##.89.153':445
'69.##.93.174':445
'69.##.183.84':445
'69.##.245.88':445
'69.#0.33.13':445
'69.##.129.148':445
'69.#0.73.38':445
'69.##.110.190':445
'69.#0.48.47':445
'69.##.138.96':445
'69.##.58.192':445
'69.##.47.132':445
'69.##.132.167':445
'69.#0.94.88':445
'69.##.28.118':445
'69.#0.72.94':445
'69.#0.23.49':445
'69.##.230.124':445
'69.##.99.221':445
'69.##.103.116':445
'69.##.26.219':445
'69.##.110.83':445
'69.##.148.195':445
'69.##.199.67':445
'69.##.236.156':445
'69.##.129.49':445
'69.#0.31.66':445
'69.##.138.162':445
'69.#0.9.162':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней