Trojan.Starman.6330

Trojan.Starman.6330

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERd3ed.dir00\svchost.exe.mdmp 16325836412029028

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WERd3ed.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'21#.#6.74.151':445
'21#.#6.33.38':445
'21#.#6.215.147':445
'21#.#6.239.215':445
'21#.#6.110.248':445
'21#.#6.72.246':445
'21#.#6.78.193':445
'21#.#6.50.223':445
'21#.#6.205.125':445
'21#.#6.81.217':445
'21#.#6.34.205':445
'21#.#6.81.57':445
'21#.#6.93.91':445
'21#.#6.181.175':445
'21#.#6.146.66':445
'21#.#6.123.231':445
'21#.#6.47.15':445
'21#.#6.120.221':445
'21#.#6.187.97':445
'21#.#6.41.183':445
'21#.#6.174.248':445
'21#.#6.194.76':445
'21#.#6.159.85':445
'21#.#6.169.199':445
'21#.#6.206.12':445
'21#.#6.11.107':445
'21#.#6.130.185':445
'21#.#6.182.240':445
'21#.#6.143.129':445
'21#.#6.211.41':445
'21#.#6.219.13':445
'21#.#6.136.206':445
'21#.#6.115.127':445
'21#.#6.159.85':139
'21#.#6.8.173':139
'21#.#6.41.183':139
'21#.#6.120.221':139
'21#.#6.130.194':139
'21#.#6.248.130':139
'21#.#6.173.165':139
'21#.#6.194.76':139
'21#.#6.136.206':139
'21#.#6.219.13':139
'21#.#6.11.107':139
'21#.#6.206.12':139
'21#.#6.187.97':139
'21#.#6.47.15':139
'21#.#6.143.129':139
'21#.#6.211.41':139
'21#.#6.78.42':139
'21#.#6.201.77':139
'21#.#6.237.86':139
'21#.#6.106.158':139
'21#.#6.217.80':445
'21#.#6.171.23':445
'21#.#6.72.168':445
'21#.#6.33.153':445
'21#.#6.12.56':139
'21#.#6.169.199':139
'21#.#6.174.248':139
'21#.#6.1.191':139
'21#.#6.176.205':139
'21#.#6.120.157':139
'21#.#6.83.62':139
'21#.#6.134.174':139
'21#.#6.166.101':139
'21#.#6.135.166':139
'21#.#6.10.75':139
'21#.#6.101.186':139
'21#.#6.178.222':139
'21#.#6.82.178':139
'21#.#6.190.14':139
'21#.#6.222.159':139
'21#.#6.211.157':139
'21#.#6.133.45':139
'21#.#6.249.191':139
'21#.#6.157.249':139
'21#.#6.56.178':139
'21#.#6.234.193':139
'21#.#6.28.22':139
'21#.#6.178.20':139
'21#.26.4.72':139
'21#.#6.67.28':139
'21#.#6.220.253':139
'21#.#6.29.208':139
'21#.#6.166.63':139
'21#.#6.117.166':139
'21#.#6.12.241':139
'21#.#6.63.221':139
'21#.#6.30.236':139
'21#.#6.35.194':139
'21#.#6.130.187':139
'21#.#6.90.111':139
'21#.#6.144.11':139
'21#.#6.190.50':139
'21#.#6.214.116':139
'21#.#6.187.116':139
'21#.#6.121.179':139
'21#.#6.237.86':445
'21#.#6.78.42':445
'21#.#6.176.205':445
'21#.#6.134.174':445
'21#.#6.195.216':139
'21#.#6.21.16':139
'21#.#6.201.77':445
'21#.#6.106.158':445
'21#.#6.248.130':445
'21#.#6.12.56':445
'21#.#6.1.191':445
'21#.#6.130.194':445
'21#.#6.83.62':445
'21#.#6.120.157':445
'21#.#6.8.173':445
'21#.#6.173.165':445
'21#.#6.133.248':139
'21#.#6.55.160':139
'21#.#6.29.13':139
'21#.#6.46.21':139
'21#.#6.16.194':139
'21#.#6.221.41':139
'21#.#6.254.239':139
'21#.#6.28.204':139
'21#.#6.132.235':139
'21#.#6.181.53':139
'21#.26.23.5':139
'21#.#6.93.219':139
'21#.#6.134.3':139
'21#.#6.255.90':139
'21#.#6.141.125':139
'21#.#6.177.140':139
'21#.#6.128.135':139
'21#.#6.59.13':139
'21#.#6.20.229':139
'21#.#6.62.44':139
'21#.#6.1.100':139
'21#.#6.195.106':139
'21#.#6.135.154':139
'21#.#6.247.118':139
'21#.#6.56.149':139
'21#.#6.204.105':139
'21#.#6.74.204':139
'21#.#6.110.74':139
'21#.#6.5.240':139
'21#.#6.104.217':139
'21#.#6.41.40':139
'21#.#6.101.51':139
'21#.26.1.82':445
'21#.#6.0.212':445
'21#.#6.167.159':445
'21#.#6.28.63':445
'21#.#6.12.46':445
'21#.#6.222.12':445
'21#.#6.213.64':445
'21#.#6.108.39':445
'21#.#6.89.158':445
'21#.#6.51.88':445
'21#.#6.97.70':139
'21#.#6.73.37':139
'21#.#6.107.127':445
'21#.#6.104.16':445
'21#.#6.158.101':445
'21#.#6.101.133':445
'21#.#6.55.110':139
'21#.#6.213.64':139
'21#.#6.108.39':139
'21#.26.1.82':139
'21#.#6.0.212':139
'21#.#6.157.252':139
'21#.#6.67.122':139
'21#.#6.12.46':139
'21#.#6.222.12':139
'21#.#6.89.158':139
'21#.#6.101.133':139
'21#.#6.158.101':139
'21#.#6.107.127':139
'21#.#6.167.159':139
'21#.#6.28.63':139
'21#.#6.104.16':139
'21#.#6.51.88':139
'21#.26.0.87':139
'21#.#6.238.127':139
'21#.#6.15.72':139
'21#.#6.165.46':139
'21#.#6.141.39':139
'21#.#6.72.174':139
'21#.#6.219.74':139
'21#.#6.250.60':139
'21#.#6.16.65':139
'21#.#6.204.63':139
'21#.#6.172.62':139
'21#.#6.106.230':139
'21#.#6.226.105':139
'21#.26.3.76':139
'21#.#6.11.241':139
'21#.#6.228.118':139
'21#.#6.205.125':139
'21#.#6.34.205':139
'21#.#6.195.106':9988
'21#.#6.171.23':139
'21#.#6.217.80':139
'21#.#6.81.217':139
'21#.#6.72.168':139
'21#.#6.81.57':139
'21#.#6.97.70':445
'21#.#6.73.37':445
'21#.#6.1.100':445
'21#.#6.195.106':445
'21#.#6.250.60':9988
'21#.#6.59.13':9988
'21#.#6.107.127':9988
'21#.#6.167.159':9988
'21#.#6.110.248':139
'21#.#6.78.193':139
'21#.#6.74.151':139
'21#.#6.33.38':139
'21#.#6.50.223':139
'21#.#6.182.240':139
'21#.#6.130.185':139
'21#.#6.72.246':139
'21#.#6.146.66':139
'21#.#6.123.231':139
'21#.#6.115.127':139
'21#.#6.33.153':139
'21#.#6.215.147':139
'21#.#6.239.215':139
'21#.#6.93.91':139
'21#.#6.181.175':139
'21#.#6.247.118':445
'21#.#6.15.72':445
'21#.#6.165.46':445
'21#.#6.226.105':445
'21#.26.3.76':445
'21#.#6.219.74':445
'21#.#6.250.60':445
'21#.26.0.87':445
'21#.#6.238.127':445
'21#.#6.172.62':445
'21#.#6.106.230':445
'21#.#6.157.252':445
'21#.#6.67.122':445
'21#.#6.11.241':445
'21#.#6.228.118':445
'21#.#6.16.65':445
'21#.#6.204.63':445
'21#.#6.104.217':445
'21#.#6.20.229':445
'21#.#6.101.51':445
'21#.#6.5.240':445
'21#.#6.59.13':445
'21#.#6.135.154':445
'21#.#6.62.44':445
'21#.#6.128.135':445
'21#.#6.55.110':445
'21#.#6.74.204':445
'21#.#6.141.39':445
'21#.#6.72.174':445
'21#.#6.204.105':445
'21#.#6.41.40':445
'21#.#6.110.74':445
'21#.#6.56.149':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней