Trojan.Starman.5344

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'58.##0.11.40':139
'58.##0.34.102':139
'58.##0.81.64':139
'58.##0.44.186':139
'58.##0.68.124':139
'58.##0.127.12':139
'58.##0.22.133':139
'58.##0.166.36':139
'58.##0.18.35':139
'58.##0.176.18':139
'58.##0.29.70':139
'58.##0.36.216':139
'58.##0.185.36':139
'58.##0.216.226':139
'58.##0.191.193':445
'58.##0.227.191':139
'58.##0.192.244':139
'58.##0.221.237':139
'58.##0.244.235':139
'58.##0.21.119':139
'58.##0.235.203':139
'58.##0.68.124':445
'58.##0.81.64':445
'58.##0.44.186':445
'58.##0.221.237':445
'58.##0.29.70':445
'58.##0.176.18':445
'58.##0.166.36':445
'58.##0.18.35':445
'58.##0.11.40':445
'58.##0.34.102':445
'58.##0.192.244':445
'58.##0.227.191':445
'58.##0.216.226':445
'58.##0.32.77':139
'58.##0.10.202':139
'58.##0.90.65':139
'58.##0.235.203':445
'58.##0.244.235':445
'58.##0.21.119':445
'58.##0.36.216':445
'58.##0.185.36':445
'58.##0.191.193':139
'58.##0.110.66':445
'58.##0.10.180':139
'58.#10.41.7':139
'58.##0.180.163':139
'58.##0.79.136':445
'58.##0.140.175':445
'58.##0.48.201':445
'58.##0.16.234':445
'58.##0.136.7':445
'58.##0.120.200':139
'58.##0.120.7':139
'58.##0.186.2':139
'58.##0.212.0':139
'58.##0.115.89':139
'58.##0.121.114':139
'58.##0.209.86':139
'58.##0.74.13':139
'58.##0.156.121':139
'58.##0.42.61':139
'58.##0.121.90':139
'58.##0.156.121':445
'58.##0.209.86':445
'58.##0.121.90':445
'58.##0.186.2':445
'58.##0.42.61':445
'58.##0.180.163':445
'58.##0.10.180':445
'58.#10.41.7':445
'58.##0.74.13':445
'58.##0.120.200':445
'58.##0.120.7':445
'58.##0.83.192':445
'58.##0.210.85':445
'58.##0.219.93':445
'58.##0.3.143':445
'58.#10.4.4':445
'58.##0.121.114':445
'58.##0.212.0':445
'58.##0.115.89':445
'58.##0.21.181':445
'58.##0.178.200':445
'58.##0.84.143':445
'58.##0.92.181':445
'58.##0.54.145':445
'58.##0.47.187':445
'58.##0.26.165':445
'58.##0.248.128':139
'58.##0.234.72':139
'58.##0.87.235':445
'58.#10.9.22':445
'58.##0.238.44':445
'58.##0.161.127':445
'58.##0.135.164':445
'58.##0.51.166':445
'58.##0.191.143':445
'58.##0.60.98':445
'58.##0.144.60':445
'58.##0.123.69':445
'58.##0.4.179':445
'58.##0.68.182':445
'58.##0.27.166':445
'58.##0.181.164':445
'58.##0.106.100':139
'58.##0.159.184':139
'58.##0.156.157':139
'58.##0.223.235':139
'58.##0.54.223':139
'58.##0.178.234':139
'58.##0.12.59':139
'58.##0.235.79':139
'58.##0.121.183':139
'58.##0.19.178':139
'58.##0.128.23':139
'58.##0.68.217':139
'58.##0.45.51':139
'58.##0.71.160':139
'58.##0.86.193':139
'58.##0.155.178':139
'58.##0.216.88':139
'58.##0.149.207':139
'58.##0.146.54':139
'58.##0.47.23':139
'58.#10.76.3':139
'58.##0.60.98':139
'58.##0.144.60':139
'58.##0.98.36':139
'58.##0.58.221':139
'58.##0.115.98':139
'58.##0.27.166':139
'58.##0.181.164':139
'58.##0.51.166':139
'58.##0.191.143':139
'58.##0.135.164':139
'58.##0.234.64':139
'58.##0.90.65':445
'58.##0.32.77':445
'58.##0.10.202':445
'58.##0.127.12':445
'58.##0.22.133':445
'58.##0.70.250':139
'58.##0.103.121':139
'58.##0.169.249':139
'58.##0.95.200':139
'58.##0.249.129':139
'58.##0.169.249':445
'58.##0.70.250':445
'58.##0.249.129':445
'58.##0.87.235':139
'58.##0.95.200':445
'58.##0.115.98':445
'58.##0.98.36':445
'58.##0.58.221':445
'58.##0.103.121':445
'58.##0.234.64':445
'58.##0.238.44':139
'58.##0.161.127':139
'58.##0.47.187':139
'58.##0.4.179':139
'58.##0.68.182':139
'58.##0.123.69':139
'58.##0.92.181':139
'58.#10.9.22':139
'58.##0.84.143':139
'58.##0.26.165':139
'58.##0.54.145':139
'58.##0.178.200':139
'58.##0.117.157':445
'58.##0.232.116':445
'58.##0.157.152':445
'58.##0.208.145':445
'58.##0.81.132':445
'58.##0.193.73':445
'58.##0.147.240':445
'58.##0.157.149':445
'58.##0.112.232':445
'58.##0.237.112':445
'58.##0.149.248':445
'58.##0.118.55':139
'58.##0.203.30':139
'58.##0.55.192':139
'58.##0.146.219':139
'58.##0.192.47':139
'58.##0.180.19':139
'58.##0.45.101':445
'58.##0.158.152':139
'58.##0.154.87':139
'58.##0.11.106':139
'58.##0.184.133':445
'58.##0.157.182':445
'58.##0.117.238':445
'58.##0.113.89':445
'58.##0.99.250':445
'58.##0.82.211':445
'58.##0.11.83':445
'58.##0.11.117':445
'58.##0.92.75':445
'58.##0.36.205':445
'58.##0.214.45':445
'58.##0.162.38':445
'58.##0.36.50':445
'58.##0.97.127':445
'58.##0.39.129':445
'58.##0.7.147':445
'58.##0.41.195':445
'58.##0.28.89':445
'58.##0.94.226':445
'58.##0.190.13':445
'58.##0.34.190':445
'58.##0.97.127':139
'58.##0.162.38':139
'58.##0.7.147':139
'58.##0.147.240':139
'58.##0.39.129':139
'58.##0.94.226':139
'58.##0.41.195':139
'58.##0.34.190':139
'58.##0.36.50':139
'58.##0.190.13':139
'58.##0.193.73':139
'58.##0.81.132':139
'58.##0.157.152':139
'58.##0.208.145':139
'58.##0.45.101':139
'58.##0.149.248':139
'58.##0.237.112':139
'58.##0.157.149':139
'58.##0.112.232':139
'58.##0.117.157':139
'58.##0.232.116':139
'58.##0.28.147':139
'58.##0.108.223':139
'58.##0.51.53':139
'58.##0.11.83':139
'58.##0.21.159':139
'58.##0.212.126':139
'58.##0.11.214':139
'58.##0.127.148':139
'58.##0.67.127':139
'58.##0.148.163':139
'58.##0.82.211':139
'58.##0.99.250':139
'58.##0.117.238':139
'58.##0.113.89':139
'58.##0.28.89':139
'58.##0.214.45':139
'58.##0.36.205':139
'58.##0.11.117':139
'58.##0.92.75':139
'58.##0.184.133':139
'58.##0.157.182':139
'58.##0.39.115':445
'58.##0.102.91':445
'58.##0.115.230':445
'58.##0.115.224':445
'58.#10.59.9':445
'58.##0.51.204':445
'58.##0.66.242':445
'58.##0.203.143':445
'58.##0.145.232':445
'58.##0.143.143':445
'58.##0.191.109':139
'58.##0.80.91':139
'58.##0.130.215':139
'58.##0.122.92':139
'58.##0.51.204':139
'58.##0.66.242':139
'58.##0.179.140':139
'58.##0.68.85':139
'58.##0.191.180':139
'58.##0.232.235':139
'58.##0.102.171':139
'58.##0.140.175':139
'58.##0.3.143':139
'58.##0.79.136':139
'58.##0.136.7':139
'58.##0.48.201':139
'58.##0.210.85':139
'58.##0.21.181':139
'58.##0.83.192':139
'58.#10.4.4':139
'58.##0.219.93':139
'58.##0.16.234':139
'58.##0.232.235':445
'58.##0.102.171':445
'58.##0.130.215':445
'58.##0.122.92':445
'58.##0.80.91':445
'58.##0.191.109':445
'58.##0.110.66':139
'58.##0.68.85':445
'58.##0.191.180':445
'58.##0.179.140':445
'58.##0.154.87':445
'58.##0.11.106':445
'58.##0.203.30':445
'58.##0.55.192':445
'58.##0.118.55':445
'58.##0.208.145':9988
'58.##0.149.248':9988
'58.##0.81.132':9988
'58.##0.158.152':445
'58.##0.180.19':445
'58.##0.192.47':445
'58.##0.108.223':445
'58.##0.67.127':445
'58.##0.28.147':445
'58.##0.21.159':445
'58.##0.51.53':445
'58.##0.11.214':445
'58.##0.146.219':445
'58.##0.212.126':445
'58.##0.148.163':445
'58.##0.127.148':445
'58.#10.59.9':139
'58.##0.115.230':139
'58.##0.115.224':139
'58.##0.21.159':9988
'58.##0.11.214':9988
'58.##0.143.143':139
'58.##0.203.143':139
'58.##0.145.232':139
'58.##0.39.115':139
'58.##0.102.91':139
'58.##0.99.250':9988
'58.##0.157.149':9988
'58.##0.193.73':9988
'58.##0.237.112':9988
'58.##0.45.101':9988
'58.##0.112.232':9988
'58.##0.41.195':9988
'58.##0.28.89':9988
'58.##0.94.226':9988
'58.##0.147.240':9988
'58.##0.39.129':9988

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial