Trojan.Starman.6592

Trojan.Starman.6592

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'83.##.60.213':445
'83.#9.47.6':445
'83.##.23.155':445
'83.##.120.164':445
'83.#9.86.98':445
'83.#9.8.245':445
'83.#9.19.55':445
'83.#9.48.20':445
'83.##.245.47':445
'83.#9.86.91':139
'83.##.161.201':139
'83.#9.66.65':139
'83.##.188.88':139
'83.##.45.111':139
'83.##.54.250':445
'83.##.76.185':445
'83.##.71.177':139
'83.##.109.251':445
'83.##.196.54':445
'83.##.90.124':445
'83.##.185.195':445
'83.##.131.117':445
'83.##.29.181':445
'83.#9.86.91':445
'83.##.161.201':445
'83.#9.66.65':445
'83.##.188.88':445
'83.##.136.176':445
'83.##.115.53':445
'83.##.237.27':445
'83.##.52.237':445
'83.##.96.189':445
'83.##.135.182':445
'83.##.195.116':445
'83.##.108.129':445
'83.##.16.166':445
'83.##.54.250':139
'83.##.76.185':139
'83.##.18.165':445
'83.##.109.251':139
'83.##.23.155':139
'83.#9.47.6':139
'83.#9.86.98':139
'83.##.120.164':139
'83.##.60.213':139
'83.##.250.45':445
'83.##.155.23':445
'83.##.173.203':445
'83.##.17.173':445
'83.##.76.114':445
'83.##.74.235':445
'83.##.248.68':445
'83.##.110.21':445
'83.##.124.133':445
'83.##.135.182':139
'83.##.195.116':139
'83.##.108.129':139
'83.##.16.166':139
'83.##.185.195':139
'83.##.90.124':139
'83.##.29.181':139
'83.##.131.117':139
'83.##.196.54':139
'83.#9.8.245':139
'83.#9.19.55':139
'83.#9.48.20':139
'83.##.245.47':139
'83.##.237.27':139
'83.##.115.53':139
'83.##.96.189':139
'83.##.52.237':139
'83.##.136.176':139
'83.#9.95.93':139
'83.#9.7.163':139
'83.##.243.114':139
'83.##.239.124':139
'83.##.191.160':139
'83.##.166.104':139
'83.#9.194.3':139
'83.##.153.206':139
'83.##.252.153':139
'83.##.198.203':445
'83.##.153.114':445
'83.##.195.86':445
'83.##.95.131':445
'83.##.108.153':139
'83.##.161.232':139
'83.##.147.239':139
'83.##.152.112':139
'83.##.79.236':139
'83.##.223.235':139
'83.##.213.248':139
'83.##.14.110':139
'83.##.121.132':139
'83.##.99.209':139
'83.##.78.144':139
'83.##.95.208':139
'83.#9.7.60':139
'83.##.144.242':139
'83.##.221.172':139
'83.##.35.248':139
'83.##.104.119':139
'83.##.82.104':139
'83.##.254.207':139
'83.##.202.64':139
'83.##.11.147':139
'83.##.43.135':139
'83.##.14.244':139
'83.##.151.17':139
'83.##.157.150':139
'83.##.47.169':139
'83.#9.85.52':139
'83.##.94.208':139
'83.##.47.171':139
'83.##.195.86':139
'83.##.55.106':139
'83.#9.14.55':139
'83.##.65.140':139
'83.##.141.82':139
'83.##.45.111':445
'83.##.71.177':445
'83.#9.2.205':139
'83.#9.133.5':139
'83.##.93.133':139
'83.##.248.56':139
'83.#9.4.248':139
'83.#9.85.52':445
'83.##.151.17':445
'83.##.93.133':445
'83.##.47.169':445
'83.##.157.150':445
'83.#9.14.55':445
'83.##.47.171':445
'83.##.94.208':445
'83.##.55.106':445
'83.##.153.114':139
'83.##.65.140':445
'83.##.95.131':139
'83.##.198.203':139
'83.##.141.82':445
'83.#9.4.248':445
'83.#9.133.5':445
'83.#9.2.205':445
'83.##.248.56':445
'83.##.52.115':445
'83.##.25.174':139
'83.##.198.24':139
'83.##.72.135':139
'83.##.173.72':139
'83.##.124.168':139
'83.##.101.106':445
'83.##.226.178':445
'83.##.225.12':139
'83.##.11.102':445
'83.##.22.171':139
'83.##.24.185':139
'83.#9.27.61':139
'83.##.137.115':139
'83.##.129.16':139
'83.##.115.167':139
'83.##.135.226':139
'83.##.179.222':139
'83.##.196.179':139
'83.##.49.146':445
'83.##.126.149':445
'83.#9.51.33':445
'83.##.145.251':445
'83.##.19.141':445
'83.##.110.16':445
'83.##.221.183':445
'83.##.120.218':445
'83.##.54.193':445
'83.##.84.174':445
'83.#9.80.47':445
'83.#9.39.11':445
'83.##.41.116':445
'83.##.43.206':445
'83.##.159.232':445
'83.##.251.50':445
'83.##.179.157':445
'83.##.167.57':445
'83.##.251.50':139
'83.#9.51.33':139
'83.##.167.57':139
'83.##.159.232':139
'83.##.145.251':139
'83.##.19.141':139
'83.##.120.218':139
'83.##.49.146':139
'83.##.126.149':139
'83.#9.39.11':139
'83.##.11.102':139
'83.##.226.178':139
'83.##.101.106':139
'83.##.41.116':139
'83.##.43.206':139
'83.##.179.157':139
'83.##.84.174':139
'83.#9.80.47':139
'83.##.238.177':139
'83.#9.0.239':139
'83.#9.62.45':139
'83.##.177.57':139
'83.##.13.181':139
'83.#9.34.13':139
'83.##.125.223':139
'83.##.119.199':139
'83.##.136.119':139
'83.##.221.183':139
'83.##.154.216':139
'83.##.54.193':139
'83.##.110.16':139
'83.##.157.86':139
'83.##.102.59':139
'83.##.44.171':139
'83.##.16.120':139
'83.#9.39.27':139
'83.##.103.15':139
'83.##.60.137':139
'83.##.194.164':139
'83.##.115.232':139
'83.##.58.112':139
'83.##.17.240':139
'83.##.52.115':139
'83.#9.56.66':139
'83.##.219.70':139
'83.##.154.216':9988
'83.##.13.181':9988
'83.##.110.16':9988
'83.##.221.183':9988
'83.##.119.199':9988
'83.##.115.167':9988
'83.##.135.226':9988
'83.##.137.115':9988
'83.#9.27.61':9988
'83.##.115.232':445
'83.##.103.15':445
'83.##.18.165':139
'83.##.194.164':445
'83.##.60.137':445
'83.##.219.70':445
'83.##.17.240':445
'83.##.58.112':445
'83.#9.56.66':445
'83.##.250.45':139
'83.##.155.23':139
'83.##.173.203':139
'83.##.17.173':139
'83.##.76.114':139
'83.##.74.235':139
'83.##.248.68':139
'83.##.110.21':139
'83.##.124.133':139
'83.##.119.199':445
'83.##.136.119':445
'83.#9.0.239':445
'83.##.13.181':445
'83.#9.34.13':445
'83.##.137.115':445
'83.##.22.171':445
'83.##.125.223':445
'83.#9.27.61':445
'83.##.16.120':445
'83.#9.39.27':445
'83.##.154.216':445
'83.##.157.86':445
'83.##.102.59':445
'83.##.177.57':445
'83.##.238.177':445
'83.##.44.171':445
'83.#9.62.45':445
'83.##.225.12':445
'83.##.120.218':9988
'83.##.198.24':445
'83.##.124.168':445
'83.##.19.141':9988
'83.##.159.232':9988
'83.##.54.193':9988
'83.##.251.50':9988
'83.#9.51.33':9988
'83.##.179.222':445
'83.##.196.179':445
'83.##.24.185':445
'83.##.129.16':445
'83.##.115.167':445
'83.##.173.72':445
'83.##.25.174':445
'83.##.135.226':445
'83.##.72.135':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней