Trojan.Starman.6119

Trojan.Starman.6119

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER5722.dir00\svchost.exe.mdmp 16325836412032124

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5722.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'81.##.89.167':445
'81.##.216.145':445
'81.##.90.117':445
'81.#3.25.90':445
'81.##.221.176':445
'81.##.109.173':445
'81.##.49.193':445
'81.##.238.97':445
'81.##.71.212':445
'81.##.221.56':139
'81.##.247.199':139
'81.##.126.206':139
'81.##.57.126':139
'81.##.39.220':139
'81.##.205.107':445
'81.##.33.163':445
'81.#3.88.10':139
'81.#3.33.39':139
'81.##.247.199':445
'81.##.39.220':445
'81.##.57.126':445
'81.##.221.56':445
'81.#3.88.10':445
'81.##.101.78':139
'81.##.205.32':139
'81.#3.33.39':445
'81.##.186.32':139
'81.##.122.128':445
'81.##.178.173':445
'81.##.210.161':445
'81.##.249.225':445
'81.##.244.179':445
'81.##.206.176':445
'81.##.126.206':445
'81.#3.45.0':445
'81.##.188.38':445
'81.##.70.200':445
'81.#3.0.29':445
'81.#3.4.175':445
'81.#3.133.8':445
'81.##.184.87':445
'81.##.223.91':445
'81.##.205.107':139
'81.#3.20.24':445
'81.##.112.151':445
'81.##.217.149':445
'81.#3.241.4':445
'81.#3.20.84':445
'81.##.126.113':445
'81.##.98.167':445
'81.##.87.156':445
'81.##.53.252':445
'81.#3.20.99':445
'81.#3.89.20':445
'81.##.249.225':139
'81.##.122.128':139
'81.##.49.193':139
'81.##.210.161':139
'81.##.178.173':139
'81.##.188.38':139
'81.##.206.176':139
'81.##.244.179':139
'81.#3.45.0':139
'81.#3.25.90':139
'81.##.89.167':139
'81.##.33.163':139
'81.##.90.117':139
'81.##.216.145':139
'81.##.71.212':139
'81.##.109.173':139
'81.##.221.176':139
'81.##.238.97':139
'81.##.254.53':139
'81.#3.46.89':139
'81.##.195.46':139
'81.##.28.229':445
'81.##.135.131':139
'81.##.63.195':139
'81.##.210.151':139
'81.##.124.191':139
'81.#3.75.64':139
'81.##.18.187':139
'81.##.150.62':445
'81.##.232.15':445
'81.#3.0.108':445
'81.#3.28.60':445
'81.##.29.232':445
'81.##.241.247':445
'81.##.178.241':445
'81.##.86.178':445
'81.##.16.114':445
'81.#3.80.78':139
'81.##.118.80':139
'81.#3.67.1':139
'81.#3.78.72':139
'81.#3.68.35':139
'81.#3.75.58':139
'81.##.138.169':139
'81.#3.210.4':139
'81.##.35.210':139
'81.#3.30.92':139
'81.##.150.19':139
'81.##.96.175':139
'81.##.36.212':139
'81.##.104.242':139
'81.##.111.223':139
'81.##.30.116':139
'81.#3.0.130':139
'81.##.107.190':139
'81.#3.0.108':139
'81.#3.28.60':139
'81.##.137.87':139
'81.##.136.90':139
'81.##.150.62':139
'81.##.86.178':139
'81.##.16.114':139
'81.##.232.15':139
'81.##.29.232':139
'81.##.104.226':139
'81.##.11.178':139
'81.##.109.149':139
'81.##.226.108':139
'81.##.247.220':139
'81.##.126.228':139
'81.##.206.73':139
'81.##.82.247':139
'81.##.55.193':139
'81.##.247.220':445
'81.##.82.247':445
'81.##.104.226':445
'81.##.11.178':445
'81.##.55.193':445
'81.##.137.87':445
'81.##.136.90':445
'81.##.126.228':445
'81.##.206.73':445
'81.##.28.229':139
'81.##.186.32':445
'81.##.241.247':139
'81.##.178.241':139
'81.##.101.78':445
'81.##.109.149':445
'81.##.226.108':445
'81.##.205.32':445
'81.##.254.53':445
'81.##.122.123':139
'81.#3.113.8':139
'81.##.10.178':139
'81.##.17.167':139
'81.##.56.157':139
'81.##.128.241':445
'81.##.27.187':445
'81.##.119.151':139
'81.#3.37.37':445
'81.##.210.85':139
'81.##.164.108':139
'81.##.218.202':139
'81.##.85.218':139
'81.##.152.67':139
'81.##.21.164':139
'81.##.169.39':139
'81.##.145.127':139
'81.##.28.183':139
'81.##.76.199':445
'81.##.41.181':445
'81.#3.4.165':445
'81.##.142.209':445
'81.##.201.38':445
'81.##.45.250':445
'81.#3.49.98':445
'81.##.165.135':445
'81.##.148.165':445
'81.##.18.113':445
'81.##.150.18':445
'81.##.46.206':445
'81.##.113.92':445
'81.##.25.213':445
'81.##.252.219':445
'81.##.48.253':445
'81.##.198.173':445
'81.##.112.88':445
'81.##.48.253':139
'81.#3.4.165':139
'81.##.112.88':139
'81.##.252.219':139
'81.##.142.209':139
'81.##.201.38':139
'81.##.165.135':139
'81.##.76.199':139
'81.##.41.181':139
'81.##.27.187':139
'81.##.46.206':139
'81.#3.37.37':139
'81.##.128.241':139
'81.##.113.92':139
'81.##.25.213':139
'81.##.198.173':139
'81.##.18.113':139
'81.##.150.18':139
'81.##.165.251':139
'81.##.49.166':139
'81.##.117.190':139
'81.#3.89.60':139
'81.##.161.137':139
'81.##.121.86':139
'81.##.86.140':139
'81.#3.6.165':139
'81.##.162.36':139
'81.#3.49.98':139
'81.##.249.114':139
'81.##.148.165':139
'81.##.45.250':139
'81.##.195.227':139
'81.##.124.167':139
'81.##.75.144':139
'81.##.58.231':139
'81.##.147.144':139
'81.##.249.114':445
'81.##.188.200':139
'81.##.18.180':139
'81.#3.6.207':139
'81.##.128.38':139
'81.#3.20.84':139
'81.#3.241.4':139
'81.##.98.167':139
'81.##.126.113':139
'81.##.217.149':139
'81.##.165.135':9988
'81.##.148.165':9988
'81.#3.4.165':9988
'81.##.201.38':9988
'81.##.45.250':9988
'81.##.126.183':139
'81.#3.3.164':139
'81.#3.49.98':9988
'81.##.49.166':9988
'81.##.223.91':139
'81.##.126.183':445
'81.#3.20.24':139
'81.##.112.151':139
'81.#3.3.164':445
'81.##.188.200':445
'81.##.18.180':445
'81.#3.6.207':445
'81.##.128.38':445
'81.##.87.156':139
'81.##.53.252':139
'81.#3.20.99':139
'81.#3.89.20':139
'81.#3.4.175':139
'81.#3.0.29':139
'81.##.184.87':139
'81.#3.133.8':139
'81.##.70.200':139
'81.##.162.36':445
'81.##.121.86':445
'81.##.161.137':445
'81.#3.6.165':445
'81.##.86.140':445
'81.##.210.85':445
'81.##.164.108':445
'81.##.218.202':445
'81.##.85.218':445
'81.##.147.144':445
'81.##.124.167':445
'81.##.195.227':445
'81.##.58.231':445
'81.##.75.144':445
'81.##.165.251':445
'81.##.49.166':445
'81.##.117.190':445
'81.#3.89.60':445
'81.##.128.241':9988
'81.#3.37.37':9988
'81.##.56.157':445
'81.##.119.151':445
'81.##.27.187':9988
'81.##.18.113':9988
'81.##.150.18':9988
'81.##.46.206':9988
'81.##.113.92':9988
'81.##.28.183':445
'81.##.21.164':445
'81.##.152.67':445
'81.##.145.127':445
'81.##.169.39':445
'81.##.122.123':445
'81.#3.113.8':445
'81.##.10.178':445
'81.##.17.167':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней