Trojan.Starman.5377

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER227c.dir00\svchost.exe.mdmp 16325836412032144

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER227c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'21#.#50.90.174':139
'21#.#50.77.185':139
'21#.#50.84.79':139
'21#.#50.249.26':139
'21#.#50.186.213':139
'21#.#50.162.93':139
'21#.#50.238.78':139
'21#.#50.43.9':139
'21#.#50.230.229':139
'21#.#50.202.222':139
'21#.#50.104.212':139
'21#.#50.112.17':139
'21#.#50.95.201':445
'21#.#50.76.198':445
'21#.#50.15.165':445
'21#.#50.166.237':445
'21#.#50.24.140':445
'21#.#50.59.40':445
'21#.#50.58.141':139
'21#.#50.140.123':139
'21#.#50.248.154':139
'21#.#50.66.228':445
'21#.#50.42.46':139
'21#.#50.57.25':139
'21#.#50.63.243':445
'21#.#50.221.114':445
'21#.#50.55.55':9988
'21#.#50.47.18':9988
'21#.#50.7.124':9988
'21#.#50.35.151':445
'21#.#50.210.243':445
'21#.#50.243.226':445
'21#.#50.237.185':445
'21#.#50.144.126':445
'21#.#50.71.211':445
'21#.#50.12.200':9988
'21#.#50.15.165':139
'21#.#50.95.201':139
'21#.#50.166.237':139
'21#.#50.80.36':139
'21#.#50.24.140':139
'21#.#50.76.198':139
'21#.#50.186.2':9988
'21#.#50.90.217':9988
'21#.#50.71.211':9988
'21#.#50.59.40':139
'21#.#50.66.228':139
'21#.#50.113.220':139
'21#.#50.101.0':139
'21#.#50.103.193':139
'21#.#50.83.39':139
'21#.#50.102.193':139
'21#.#50.114.31':139
'21#.#50.155.122':139
'21#.#50.140.71':139
'21#.#50.82.206':139
'21#.#50.187.115':139
'21#.#50.7.89':139
'21#.#50.77.72':139
'21#.#50.76.241':139
'21#.#50.21.208':139
'21#.#50.151.42':445
'21#.#50.71.45':445
'21#.#50.45.151':445
'21#.#50.32.166':139
'21#.#50.57.60':139
'21#.#50.243.44':139
'21#.#50.202.71':139
'21#.#50.53.197':139
'21#.#50.17.120':139
'21#.#50.190.42':139
'21#.#50.77.185':445
'21#.#50.43.9':445
'21#.#50.162.93':445
'21#.#50.84.79':445
'21#.#50.90.174':445
'21#.#50.80.36':445
'21#.#50.238.78':445
'21#.#50.57.25':445
'21#.#50.104.212':445
'21#.#50.202.222':445
'21#.#50.230.229':445
'21#.#50.186.213':445
'21#.#50.45.151':139
'21#.#50.151.42':139
'21#.#50.71.45':139
'21#.#50.42.229':139
'21#.#50.41.13':139
'21#.#50.42.46':445
'21#.#50.112.17':445
'21#.#50.249.26':445
'21#.#50.140.123':445
'21#.#50.248.154':445
'21#.#50.58.141':445
'21#.#50.214.239':139
'21#.#50.25.57':139
'21#.#50.26.215':139
'21#.#50.90.217':139
'21#.#50.125.26':139
'21#.#50.51.94':139
'21#.#50.39.114':139
'21#.#50.218.115':139
'21#.#50.12.200':139
'21#.#50.167.54':139
'21#.#50.65.123':139
'21#.#50.35.151':139
'21#.#50.10.241':139
'21#.#50.97.136':139
'21#.#50.107.174':139
'21#.#50.243.226':139
'21#.#50.226.124':139
'21#.#50.36.32':139
'21#.#50.144.126':139
'21#.#50.237.185':139
'21#.#50.245.222':139
'21#.#50.186.2':139
'21#.#50.166.89':139
'21#.#50.137.250':139
'21#.#50.47.18':139
'21#.#50.37.104':139
'21#.#50.71.199':139
'21#.#50.161.34':139
'21#.#50.34.71':139
'21#.#50.90.242':139
'21#.#50.7.124':139
'21#.#50.107.58':139
'21#.#50.55.55':139
'21#.#50.38.36':139
'21#.#50.241.163':139
'21#.#50.230.160':139
'21#.#50.57.119':139
'21#.#50.100.130':139
'21#.#50.58.180':139
'21#.#50.64.127':139
'21#.#50.79.63':139
'21#.#50.22.233':139
'21#.#50.117.14':139
'21#.#50.62.230':139
'21#.#50.162.132':139
'21#.#50.122.145':139
'21#.#50.102.220':139
'21#.#50.65.123':445
'21#.#50.12.200':445
'21#.#50.167.54':445
'21#.#50.25.57':445
'21#.#50.51.94':445
'21#.#50.39.114':445
'21#.#50.64.127':445
'21#.#50.58.180':445
'21#.#50.79.63':445
'21#.#50.218.115':445
'21#.#50.137.250':445
'21#.#50.214.239':445
'21#.#50.245.222':445
'21#.#50.97.136':445
'21#.#50.36.32':445
'21#.#50.107.174':445
'21#.#50.226.124':445
'21#.#50.10.241':445
'21#.#50.125.26':445
'21#.#50.26.215':445
'21#.#50.90.217':445
'21#.#50.186.2':445
'21#.#50.166.89':445
'21#.#50.57.119':445
'21#.#50.38.36':445
'21#.#50.107.58':445
'21#.#50.7.124':445
'21#.#50.47.18':445
'21#.#50.37.104':445
'21#.#50.55.55':445
'21#.#50.71.211':139
'21#.#50.210.243':139
'21#.#50.221.114':139
'21#.#50.241.163':445
'21#.#50.63.243':139
'21#.#50.90.242':445
'21#.#50.122.145':445
'21#.#50.62.230':445
'21#.#50.102.220':445
'21#.#50.100.130':445
'21#.#50.22.233':445
'21#.#50.230.160':445
'21#.#50.34.71':445
'21#.#50.71.199':445
'21#.#50.161.34':445
'21#.#50.117.14':445
'21#.#50.162.132':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней