Trojan.Starman.6047

Trojan.Starman.6047

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER531c.dir00\svchost.exe.mdmp 16325836412031988

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER531c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'69.##.163.72':445
'69.##.146.162':445
'69.#0.26.4':445
'69.##.156.52':445
'69.#0.53.64':445
'69.##.255.186':445
'69.##.149.151':445
'69.#0.81.91':445
'69.##.227.13':445
'69.##.66.229':445
'69.##.128.168':445
'69.#0.11.88':445
'69.##.212.188':445
'69.##.83.105':445
'69.##.176.127':445
'69.##.16.136':445
'69.#0.243.2':445
'69.##.248.182':445
'69.##.65.181':445
'69.#0.7.91':445
'69.##.61.236':445
'69.##.49.232':445
'69.##.16.144':445
'69.##.70.133':445
'69.##.133.208':445
'69.#0.11.53':445
'69.##.190.198':445
'69.##.161.119':445
'69.#0.55.6':445
'69.##.157.124':445
'69.#0.1.243':445
'69.##.93.254':445
'69.##.138.130':445
'69.##.16.144':139
'69.##.49.232':139
'69.#0.243.2':139
'69.##.248.182':139
'69.##.159.87':139
'69.##.30.133':139
'69.##.70.133':139
'69.##.61.236':139
'69.#0.55.6':139
'69.#0.1.243':139
'69.##.133.208':139
'69.#0.11.53':139
'69.##.65.181':139
'69.#0.7.91':139
'69.##.93.254':139
'69.##.157.124':139
'69.##.128.57':139
'69.##.174.132':139
'69.##.89.111':139
'69.##.71.131':139
'69.##.222.163':445
'69.##.73.227':445
'69.##.194.226':445
'69.##.185.239':445
'69.##.237.165':139
'69.#0.80.20':139
'69.#0.31.78':139
'69.##.166.31':139
'69.##.34.172':139
'69.#0.45.25':139
'69.##.92.136':139
'69.#0.23.81':139
'69.##.28.114':139
'69.##.202.114':139
'69.##.164.127':139
'69.#0.57.36':139
'69.##.173.171':139
'69.##.155.173':139
'69.##.31.224':139
'69.##.51.176':139
'69.##.60.226':139
'69.##.196.60':139
'69.##.195.164':139
'69.#0.226.2':139
'69.#0.1.226':139
'69.#0.54.23':139
'69.##.41.104':139
'69.#0.4.200':139
'69.#0.22.49':139
'69.##.246.21':139
'69.##.240.158':139
'69.#0.215.9':139
'69.##.200.192':139
'69.##.96.190':139
'69.##.46.103':139
'69.##.215.48':139
'69.##.140.40':139
'69.##.126.140':139
'69.##.216.214':139
'69.##.59.113':139
'69.##.123.254':139
'69.##.22.124':139
'69.##.27.253':139
'69.##.38.153':139
'69.##.249.196':139
'69.##.89.111':445
'69.##.71.131':445
'69.##.34.172':445
'69.#0.45.25':445
'69.##.243.174':139
'69.##.114.131':139
'69.##.128.57':445
'69.##.174.132':445
'69.#0.31.78':445
'69.##.166.31':445
'69.##.159.87':445
'69.##.30.133':445
'69.##.92.136':445
'69.#0.23.81':445
'69.##.237.165':445
'69.#0.80.20':445
'69.##.18.140':139
'69.#0.1.48':139
'69.##.138.147':139
'69.#0.94.81':139
'69.##.100.182':139
'69.##.82.167':139
'69.##.148.83':139
'69.##.75.239':139
'69.##.44.224':139
'69.##.180.247':139
'69.##.177.246':139
'69.##.126.241':139
'69.##.29.178':139
'69.##.42.239':139
'69.##.245.111':139
'69.#0.32.73':139
'69.##.161.119':139
'69.##.144.15':139
'69.##.141.143':139
'69.##.59.188':139
'69.#0.15.59':139
'69.#0.51.89':139
'69.##.37.251':139
'69.##.154.135':139
'69.##.230.165':139
'69.#0.40.70':139
'69.##.233.28':139
'69.##.193.62':139
'69.##.160.129':139
'69.##.145.218':139
'69.##.156.42':139
'69.##.137.99':139
'69.##.233.145':139
'69.##.197.10':445
'69.##.186.196':445
'69.##.91.165':445
'69.##.169.136':445
'69.##.170.227':445
'69.#0.11.51':445
'69.#0.21.5':445
'69.##.228.153':445
'69.#0.76.13':445
'69.##.30.183':445
'69.#0.28.81':139
'69.##.171.28':139
'69.#0.33.90':445
'69.##.38.243':445
'69.##.143.97':445
'69.##.31.203':445
'69.#0.8.136':139
'69.#0.21.5':139
'69.##.228.153':139
'69.##.197.10':139
'69.##.186.196':139
'69.##.229.117':139
'69.##.142.190':139
'69.##.170.227':139
'69.#0.11.51':139
'69.##.31.203':139
'69.#0.76.13':139
'69.#0.33.90':139
'69.##.30.183':139
'69.##.91.165':139
'69.##.169.136':139
'69.##.143.97':139
'69.##.38.243':139
'69.##.14.219':139
'69.##.47.227':139
'69.#0.49.63':139
'69.##.66.191':139
'69.##.45.112':139
'69.#0.56.45':139
'69.#0.83.81':139
'69.##.111.83':139
'69.##.113.34':139
'69.##.112.32':139
'69.##.250.48':139
'69.##.219.248':139
'69.##.149.40':139
'69.##.21.173':139
'69.##.112.112':139
'69.#0.68.71':139
'69.##.194.226':139
'69.##.185.239':139
'69.##.45.112':9988
'69.##.233.145':9988
'69.##.138.130':139
'69.##.128.168':139
'69.##.222.163':139
'69.##.73.227':139
'69.#0.28.81':445
'69.##.171.28':445
'69.#0.51.89':445
'69.##.37.251':445
'69.#0.68.71':9988
'69.##.30.183':9988
'69.##.250.48':9988
'69.##.113.34':9988
'69.##.146.162':139
'69.##.149.151':139
'69.##.156.52':139
'69.##.163.72':139
'69.##.255.186':139
'69.##.190.198':139
'69.#0.81.91':139
'69.#0.53.64':139
'69.##.66.229':139
'69.##.176.127':139
'69.#0.11.88':139
'69.##.227.13':139
'69.##.83.105':139
'69.#0.26.4':139
'69.##.16.136':139
'69.##.212.188':139
'69.##.230.165':445
'69.#0.49.63':445
'69.##.66.191':445
'69.##.149.40':445
'69.##.21.173':445
'69.#0.83.81':445
'69.##.111.83':445
'69.##.47.227':445
'69.##.14.219':445
'69.##.250.48':445
'69.##.219.248':445
'69.##.229.117':445
'69.##.142.190':445
'69.##.112.112':445
'69.#0.68.71':445
'69.##.113.34':445
'69.##.112.32':445
'69.##.156.42':445
'69.##.59.188':445
'69.##.233.145':445
'69.##.145.218':445
'69.##.141.143':445
'69.##.154.135':445
'69.#0.15.59':445
'69.##.144.15':445
'69.#0.8.136':445
'69.##.193.62':445
'69.##.45.112':445
'69.#0.56.45':445
'69.##.233.28':445
'69.##.137.99':445
'69.##.160.129':445
'69.#0.40.70':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней