Trojan.Starman.6363

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER5df0.dir00\svchost.exe.mdmp 16325836412032072

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5df0.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'83.##8.98.155':139
'83.##8.34.120':139
'83.##8.23.43':139
'83.##8.46.39':139
'83.##8.39.131':139
'83.##8.6.167':139
'83.##8.134.139':139
'83.##8.29.223':139
'83.##8.71.72':139
'83.##8.247.250':139
'83.##8.170.232':139
'83.##8.120.63':139
'83.##8.2.159':139
'83.##8.56.201':139
'83.##8.6.141':139
'83.##8.140.251':139
'83.##8.139.9':139
'83.##8.70.199':139
'83.##8.80.217':139
'83.##8.251.9':139
'83.##8.228.164':139
'83.##8.48.223':139
'83.##8.224.0':139
'83.##8.10.129':139
'83.##8.128.125':139
'83.##8.124.228':139
'83.##8.37.167':139
'83.##8.14.99':139
'83.#08.5.93':139
'83.##8.227.45':139
'83.##8.177.138':139
'83.##8.190.62':139
'83.##8.107.90':139
'83.##8.174.135':139
'83.##8.126.71':9988
'83.##8.148.50':9988
'83.##8.180.216':9988
'83.##8.133.245':139
'83.##8.158.84':9988
'83.##8.75.149':9988
'83.##8.229.249':139
'83.##8.250.80':139
'83.##8.189.237':139
'83.##8.54.117':139
'83.#08.3.34':139
'83.##8.6.230':139
'83.##8.8.199':139
'83.##8.158.81':139
'83.##8.81.232':139
'83.##8.37.235':139
'83.##8.2.129':139
'83.##8.59.180':139
'83.##8.180.157':139
'83.##8.39.233':139
'83.##8.46.39':445
'83.##8.39.131':445
'83.##8.6.167':445
'83.##8.228.164':445
'83.##8.48.223':445
'83.##8.224.0':445
'83.##8.98.155':445
'83.##8.170.232':445
'83.##8.120.63':445
'83.##8.2.159':445
'83.##8.34.120':445
'83.##8.23.43':445
'83.##8.134.139':445
'83.##8.139.9':445
'83.##8.70.199':445
'83.##8.80.217':445
'83.##8.12.37':445
'83.##8.154.145':445
'83.##8.39.233':445
'83.##8.56.201':445
'83.##8.10.129':445
'83.##8.128.125':445
'83.##8.124.228':445
'83.##8.6.141':445
'83.##8.140.251':445
'83.##8.251.9':445
'83.##8.29.223':445
'83.##8.177.138':445
'83.##8.190.62':445
'83.##8.107.90':445
'83.##8.158.81':445
'83.##8.81.232':445
'83.##8.37.235':445
'83.##8.14.99':445
'83.##8.133.245':445
'83.##8.12.37':139
'83.##8.154.145':139
'83.#08.5.93':445
'83.##8.227.45':445
'83.##8.174.135':445
'83.##8.54.117':445
'83.#08.3.34':445
'83.##8.6.230':445
'83.##8.71.72':445
'83.##8.247.250':445
'83.##8.37.167':445
'83.##8.229.249':445
'83.##8.2.129':445
'83.##8.59.180':445
'83.##8.180.157':445
'83.##8.250.80':445
'83.##8.189.237':445
'83.##8.8.199':445
'83.##8.198.35':9988
'83.##8.99.64':139
'83.##8.162.126':139
'83.##8.126.71':139
'83.##8.171.100':139
'83.##8.100.198':139
'83.##8.106.103':139
'83.##8.0.194':139
'83.##8.78.176':139
'83.##8.148.50':139
'83.##8.169.108':139
'83.##8.2.152':139
'83.##8.168.102':139
'83.##8.103.16':139
'83.##8.251.173':139
'83.##8.250.148':139
'83.##8.42.222':139
'83.##8.198.35':445
'83.##8.137.73':445
'83.##8.40.186':139
'83.##8.92.80':139
'83.##8.75.149':139
'83.##8.79.11':139
'83.##8.126.46':139
'83.##8.166.57':139
'83.##8.119.204':139
'83.##8.158.84':139
'83.##8.136.14':139
'83.##8.69.129':139
'83.##8.175.243':139
'83.##8.244.5':139
'83.##8.18.203':139
'83.##8.129.133':139
'83.##8.126.90':139
'83.#08.5.70':139
'83.##8.37.141':139
'83.##8.137.73':139
'83.##8.198.35':139
'83.##8.69.157':139
'83.#08.3.76':139
'83.##8.197.251':139
'83.##8.243.71':139
'83.##8.108.145':139
'83.##8.180.216':139
'83.#08.70.7':139
'83.##8.220.34':139
'83.##8.137.145':139
'83.##8.216.157':139
'83.##8.58.30':139
'83.##8.79.123':139
'83.##8.122.235':139
'83.##8.125.83':139
'83.##8.190.155':139
'83.##8.125.28':139
'83.#08.3.76':445
'83.##8.171.100':445
'83.##8.100.198':445
'83.##8.106.103':445
'83.##8.75.149':445
'83.##8.79.11':445
'83.##8.126.46':445
'83.##8.99.64':445
'83.##8.2.152':445
'83.##8.168.102':445
'83.##8.103.16':445
'83.##8.162.126':445
'83.##8.126.71':445
'83.##8.0.194':445
'83.##8.137.73':9988
'83.##8.0.194':9988
'83.##8.40.186':445
'83.##8.69.157':9988
'83.##8.122.235':9988
'83.#08.5.70':9988
'83.##8.251.173':445
'83.##8.166.57':445
'83.##8.119.204':445
'83.##8.158.84':445
'83.##8.250.148':445
'83.##8.42.222':445
'83.##8.92.80':445
'83.##8.78.176':445
'83.##8.18.203':445
'83.##8.129.133':445
'83.##8.126.90':445
'83.##8.58.30':445
'83.##8.79.123':445
'83.##8.122.235':445
'83.##8.69.129':445
'83.##8.37.141':445
'83.##8.69.157':445
'83.##8.197.251':445
'83.##8.175.243':445
'83.##8.244.5':445
'83.#08.5.70':445
'83.#08.70.7':445
'83.##8.220.34':445
'83.##8.137.145':445
'83.##8.148.50':445
'83.##8.169.108':445
'83.##8.136.14':445
'83.##8.243.71':445
'83.##8.125.83':445
'83.##8.190.155':445
'83.##8.125.28':445
'83.##8.108.145':445
'83.##8.180.216':445
'83.##8.216.157':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней