Trojan.Starman.6681

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER0b22.dir00\svchost.exe.mdmp 16325836412032136

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER0b22.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'21#.#3.109.247':9988
'21#.#3.131.185':9988
'21#.#3.255.74':9988
'21#.#3.185.246':9988
'21#.#3.108.21':9988
'21#.#3.15.246':9988
'21#.#3.124.37':9988
'21#.#3.33.98':9988
'21#.#3.35.58':9988
'21#.#3.139.6':9988
'21#.#3.30.146':9988
'21#.#3.104.159':9988
'21#.#3.34.11':9988
'21#.#3.45.176':9988
'21#.#3.103.174':9988
'21#.#3.185.105':9988
'21#.#3.2.215':9988
'21#.#3.163.70':9988
'21#.#3.116.183':9988
'21#.#3.47.168':9988
'21#.#3.58.63':9988
'21#.#3.197.108':9988
'21#.#3.228.78':9988
'21#.#3.137.55':9988
'21#.#3.140.28':9988
'21#.#3.75.70':9988
'21#.#3.11.180':9988
'21#.#3.214.131':9988
'21#.#3.248.81':9988
'21#.#3.171.87':9988
'21#.#3.173.157':9988
'21#.#3.155.228':9988
'21#.#3.187.168':9988
'21#.#3.221.123':9988
'21#.#3.212.60':9988
'21#.#3.94.40':9988
'21#.#3.19.81':9988
'21#.#3.230.155':9988
'21#.#3.33.153':9988
'21#.#3.77.248':9988
'21#.#3.64.48':9988
'21#.#3.92.234':9988
'21#.#3.219.76':9988
'21#.#3.95.58':9988
'21#.33.49.7':9988
'21#.#3.91.131':9988
'21#.#3.55.55':9988
'21#.#3.186.247':9988
'21#.#3.125.186':9988
'21#.#3.10.228':9988
'21#.#3.157.33':9988
'21#.#3.253.52':139
'21#.#3.53.192':139
'21#.#3.191.135':139
'21#.#3.143.155':139
'21#.33.1.33':139
'21#.#3.103.56':139
'21#.#3.117.78':139
'21#.#3.225.242':139
'21#.#3.116.113':139
'21#.#3.117.115':139
'21#.#3.33.48':139
'21#.#3.51.31':139
'21#.#3.25.56':139
'21#.#3.36.226':139
'21#.#3.208.52':139
'21#.#3.29.159':139
'21#.#3.113.116':139
'21#.#3.177.88':139
'21#.#3.240.63':139
'21#.#3.25.48':139
'21#.#3.149.43':139
'21#.#3.97.50':139
'21#.#3.114.43':139
'21#.#3.225.120':139
'21#.#3.125.155':139
'21#.#3.0.236':139
'21#.#3.158.248':139
'21#.#3.57.61':139
'21#.#3.3.200':139
'21#.#3.216.58':139
'21#.#3.224.53':139
'21#.#3.56.95':139
'21#.#3.87.120':139
'21#.#3.129.190':139
'21#.#3.131.174':139
'21#.#3.23.67':139
'21#.#3.154.178':139
'21#.33.9.58':139
'21#.#3.23.253':139
'21#.#3.199.224':139
'21#.#3.7.147':139
'21#.#3.64.145':139
'21#.#3.137.56':139
'21#.#3.105.17':139
'21#.#3.59.221':139
'21#.#3.200.146':139
'21#.#3.45.48':139
'21#.#3.230.232':139
'21#.#3.145.5':139
'21#.33.5.72':139
'21#.#3.71.233':139
'21#.#3.10.228':139
'21#.#3.34.11':139
'21#.#3.11.180':139
'21#.#3.116.183':139
'21#.#3.163.70':139
'21#.#3.58.63':139
'21#.#3.2.215':139
'21#.#3.45.176':139
'21#.#3.95.58':139
'21#.#3.228.78':139
'21#.#3.75.70':139
'21#.#3.124.37':139
'21#.#3.155.228':139
'21#.#3.55.55':139
'21#.#3.108.21':139
'21#.#3.139.6':139
'21#.#3.64.48':139
'21#.#3.91.131':139
'21#.#3.137.55':139
'21#.#3.103.174':139
'21#.#3.173.157':139
'21#.#3.157.33':139
'21#.#3.171.87':139
'21#.#3.219.76':139
'21#.#3.255.74':139
'21#.#3.104.159':139
'21#.#3.33.98':139
'21#.#3.187.168':139
'21#.#3.94.40':139
'21#.#3.140.28':139
'21#.#3.77.248':139
'21#.#3.35.58':139
'21#.#3.33.153':139
'21#.#3.19.81':139
'21#.#3.15.246':139
'21#.#3.109.247':139
'21#.#3.221.123':139
'21#.#3.230.155':139
'21#.33.49.7':139
'21#.#3.185.105':139
'21#.#3.47.168':139
'21#.#3.30.146':139
'21#.#3.185.246':139
'21#.#3.214.131':139
'21#.#3.131.185':139
'21#.#3.212.60':139
'21#.#3.197.108':139
'21#.#3.92.234':139
'21#.#3.125.186':139
'21#.#3.186.247':139
'21#.#3.248.81':139
'21#.#3.11.180':445
'21#.#3.34.11':445
'21#.#3.228.78':445
'21#.#3.157.33':445
'21#.#3.163.70':445
'21#.#3.58.63':445
'21#.#3.2.215':445
'21#.#3.45.176':445
'21#.#3.95.58':445
'21#.#3.10.228':445
'21#.#3.75.70':445
'21#.#3.124.37':445
'21#.#3.116.183':445
'21#.#3.255.74':445
'21#.#3.171.87':445
'21#.#3.91.131':445
'21#.#3.137.55':445
'21#.#3.219.76':445
'21#.#3.139.6':445
'21#.#3.103.174':445
'21#.#3.173.157':445
'21#.#3.155.228':445
'21#.#3.55.55':445
'21#.#3.64.48':445
'21#.#3.108.21':445
'21#.#3.104.159':445
'21#.#3.187.168':445
'21#.#3.35.58':445
'21#.#3.19.81':445
'21#.#3.15.246':445
'21#.#3.140.28':445
'21#.#3.92.234':445
'21#.#3.94.40':445
'21#.#3.230.155':445
'21#.#3.77.248':445
'21#.#3.109.247':445
'21#.33.49.7':445
'21#.#3.33.153':445
'21#.#3.33.98':445
'21#.#3.185.105':445
'21#.#3.47.168':445
'21#.#3.30.146':445
'21#.#3.185.246':445
'21#.#3.214.131':445
'21#.#3.131.185':445
'21#.#3.248.81':445
'21#.#3.197.108':445
'21#.#3.221.123':445
'21#.#3.125.186':445
'21#.#3.186.247':445
'21#.#3.212.60':445

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Поздравляем! Обменяйте их на скидку до 50% на покупку Dr.Web.

Получить скидку

Скачайте
Dr.Web для Android

Бесплатно на 3 месяца
Все компоненты защиты
Продление демо через
AppGallery/Google Pay

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней