Trojan.Starman.4992

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'19#.#4.170.155':445
'19#.#4.150.188':445
'19#.#4.151.19':445
'19#.#4.218.199':445
'19#.#4.28.28':445
'19#.#4.118.28':445
'19#.#4.4.187':445
'19#.#4.152.62':445
'19#.#4.230.151':445
'19#.#4.45.173':445
'19#.#4.204.231':445
'19#.#4.251.86':445
'19#.#4.167.208':445
'19#.#4.118.187':445
'19#.#4.82.18':445
'19#.#4.102.185':445
'19#.#4.34.17':139
'19#.#4.88.210':445
'19#.#4.249.110':445
'19#.#4.154.18':445
'19#.#4.123.153':445
'19#.#4.208.122':445
'19#.#4.71.129':445
'19#.#4.132.108':445
'19#.#4.218.70':445
'19#.#4.74.231':445
'19#.#4.153.195':445
'19#.#4.16.127':445
'19#.#4.41.69':445
'19#.#4.78.92':445
'19#.#4.118.23':445
'19#.#4.245.118':445
'19#.#4.83.161':139
'19#.#4.101.118':139
'19#.#4.141.245':139
'19#.#4.34.17':445
'19#.#4.184.162':139
'19#.#4.178.184':139
'19#.#4.13.145':445
'19#.#4.254.252':445
'19#.#4.189.254':445
'19#.#4.35.168':445
'19#.#4.172.98':445
'19#.#4.47.49':445
'19#.#4.240.236':445
'19#.#4.13.216':445
'19#.#4.50.13':445
'19#.#4.28.106':445
'19#.#4.72.123':445
'19#.#4.149.103':445
'19#.#4.216.141':445
'19#.#4.123.153':139
'19#.#4.208.122':139
'19#.#4.167.208':139
'19#.#4.132.108':139
'19#.#4.218.70':139
'19#.#4.154.18':139
'19#.#4.170.155':139
'19#.#4.150.188':139
'19#.#4.151.19':139
'19#.#4.218.199':139
'19#.#4.28.28':139
'19#.#4.118.28':139
'19#.#4.71.129':139
'19#.#4.212.7':445
'19#.#4.167.105':445
'19#.#4.34.173':445
'19#.#4.210.208':139
'19#.#4.141.239':445
'19#.#4.119.157':445
'19#.#4.118.187':139
'19#.#4.82.18':139
'19#.#4.102.185':139
'19#.#4.210.208':445
'19#.#4.88.210':139
'19#.#4.249.110':139
'19#.#4.45.173':139
'19#.#4.50.13':139
'19#.#4.28.106':139
'19#.#4.13.145':139
'19#.#4.149.103':139
'19#.#4.216.141':139
'19#.#4.13.216':139
'19#.#4.153.195':139
'19#.#4.16.127':139
'19#.#4.41.69':139
'19#.#4.78.92':139
'19#.#4.118.23':139
'19#.#4.245.118':139
'19#.#4.72.123':139
'19#.#4.152.62':139
'19#.#4.230.151':139
'19#.#4.74.231':139
'19#.#4.204.231':139
'19#.#4.251.86':139
'19#.#4.4.187':139
'19#.#4.254.252':139
'19#.#4.189.254':139
'19#.#4.35.168':139
'19#.#4.172.98':139
'19#.#4.47.49':139
'19#.#4.240.236':139
'19#.#4.183.71':139
'19#.#4.155.248':445
'19#.#4.51.247':445
'19#.#4.90.67':445
'19#.#4.94.112':445
'19#.#4.44.239':445
'19#.#4.141.252':445
'19#.#4.28.51':445
'19#.#4.83.28':445
'19#.#4.47.83':445
'19#.#4.74.31':445
'19#.#4.100.164':445
'19#.#4.129.3':445
'19#.#4.15.200':445
'19#.#4.105.57':445
'19#.#4.33.67':445
'19#.#4.57.45':445
'19#.#4.20.125':445
'19#.#4.1.246':445
'19#.#4.227.166':445
'19#.#4.112.71':445
'19#.#4.14.197':445
'19#.#4.91.251':445
'19#.#4.165.234':445
'19#.#4.192.45':445
'19#.#4.140.78':445
'19#.#4.49.131':445
'19#.#4.106.73':445
'19#.#4.125.105':445
'19#.#4.194.169':445
'19#.#4.85.12':445
'19#.#4.129.84':445
'19#.#4.73.129':445
'19#.#4.133.77':139
'19#.#4.123.230':139
'19#.#4.33.86':139
'19#.#4.210.249':139
'19#.#4.113.236':139
'19#.#4.0.106':139
'19#.#4.207.220':445
'19#.#4.102.227':445
'19#.#4.52.199':445
'19#.#4.226.53':445
'19#.#4.5.217':445
'19#.#4.29.217':445
'19#.#4.79.130':445
'19#.#4.206.75':445
'19#.#4.105.187':445
'19#.#4.41.153':445
'19#.#4.255.163':445
'19#.24.3.23':445
'19#.24.3.63':445
'19#.#4.14.197':139
'19#.#4.91.251':139
'19#.#4.15.200':139
'19#.#4.192.45':139
'19#.#4.140.78':139
'19#.#4.112.71':139
'19#.#4.155.248':139
'19#.#4.51.247':139
'19#.#4.90.67':139
'19#.#4.94.112':139
'19#.#4.44.239':139
'19#.#4.141.252':139
'19#.#4.165.234':139
'19#.#4.101.118':445
'19#.#4.141.245':445
'19#.#4.183.71':445
'19#.#4.184.162':445
'19#.#4.178.184':445
'19#.#4.83.161':445
'19#.#4.105.57':139
'19#.#4.33.67':139
'19#.#4.57.45':139
'19#.#4.20.125':139
'19#.#4.1.246':139
'19#.#4.227.166':139
'19#.#4.74.31':139
'19#.#4.105.187':139
'19#.#4.41.153':139
'19#.#4.207.220':139
'19#.24.3.23':139
'19#.24.3.63':139
'19#.#4.206.75':139
'19#.#4.106.73':139
'19#.#4.125.105':139
'19#.#4.194.169':139
'19#.#4.85.12':139
'19#.#4.129.84':139
'19#.#4.73.129':139
'19#.#4.255.163':139
'19#.#4.83.28':139
'19#.#4.47.83':139
'19#.#4.49.131':139
'19#.#4.100.164':139
'19#.#4.129.3':139
'19#.#4.28.51':139
'19#.#4.102.227':139
'19#.#4.52.199':139
'19#.#4.226.53':139
'19#.#4.5.217':139
'19#.#4.29.217':139
'19#.#4.79.130':139
'19#.#4.34.173':139
'19#.#4.71.123':445
'19#.#4.50.71':445
'19#.#4.246.50':445
'19#.#4.71.212':445
'19#.#4.77.200':445
'19#.#4.213.32':445
'19#.#4.238.135':445
'19#.#4.7.143':445
'19#.#4.172.104':445
'19#.#4.59.230':445
'19#.#4.47.98':445
'19#.#4.136.29':445
'19#.24.7.88':445
'19#.#4.171.89':445
'19#.#4.51.171':445
'19#.#4.179.81':445
'19#.#4.195.191':445
'19#.#4.139.1':445
'19#.#4.45.237':445
'19#.#4.144.177':445
'19#.#4.70.18':445
'19#.#4.157.176':445
'19#.#4.80.230':445
'19#.#4.23.156':445
'19#.#4.45.120':445
'19#.#4.99.172':445
'19#.#4.5.142':445
'19#.24.85.6':445
'19#.#4.166.85':445
'19#.#4.103.160':445
'19#.#4.141.173':445
'19#.#4.173.44':445
'19#.#4.126.58':445
'19#.#4.106.28':445
'19#.#4.154.87':445
'19#.#4.71.204':445
'19#.#4.48.245':445
'19#.#4.209.144':445
'19#.#4.120.137':445
'19#.#4.74.160':445
'19#.#4.78.150':445
'19#.#4.110.124':445
'19#.#4.106.99':445
'19#.#4.118.106':445
'19#.#4.226.108':445
'19#.#4.64.253':445
'19#.#4.172.49':445
'19#.#4.172.121':445
'19#.#4.8.105':445
'19#.#4.141.107':445
'19#.#4.41.107':445
'19#.#4.71.123':139
'19#.#4.50.71':139
'19#.#4.246.50':139
'19#.#4.71.212':139
'19#.#4.77.200':139
'19#.#4.213.32':139
'19#.#4.238.135':139
'19#.#4.7.143':139
'19#.#4.172.104':139
'19#.#4.59.230':139
'19#.#4.47.98':139
'19#.#4.136.29':139
'19#.24.7.88':139
'19#.#4.45.237':139
'19#.#4.51.171':139
'19#.#4.179.81':139
'19#.#4.195.191':139
'19#.#4.139.1':139
'19#.#4.171.89':139
'19#.#4.144.177':139
'19#.#4.70.18':139
'19#.#4.157.176':139
'19#.#4.80.230':139
'19#.#4.23.156':139
'19#.#4.45.120':139
'19#.#4.99.172':139
'19#.#4.5.142':139
'19#.24.85.6':139
'19#.#4.166.85':139
'19#.#4.103.160':139
'19#.#4.173.44':139
'19#.#4.141.173':139
'19#.#4.126.58':139
'19#.#4.106.28':139
'19#.#4.154.87':139
'19#.#4.71.204':139
'19#.#4.48.245':139
'19#.#4.209.144':139
'19#.#4.120.137':139
'19#.#4.226.108':139
'19#.#4.78.150':139
'19#.#4.110.124':139
'19#.#4.106.99':139
'19#.#4.118.106':139
'19#.#4.74.160':139
'19#.#4.64.253':139
'19#.#4.172.49':139
'19#.#4.172.121':139
'19#.#4.8.105':139
'19#.#4.141.107':139
'19#.#4.41.107':139
'19#.#4.171.89':9988
'19#.#4.67.133':445
'19#.#4.72.192':445
'19#.#4.127.153':445
'19#.#4.89.158':445
'19#.#4.90.89':445
'19#.#4.165.120':445
'19#.#4.107.81':445
'19#.#4.56.39':445
'19#.24.4.0':445
'19#.#4.154.182':445
'19#.#4.121.97':445
'19#.#4.178.247':445
'19#.#4.40.215':445
'19#.#4.211.142':445
'19#.#4.31.14':445
'19#.#4.66.178':445
'19#.#4.13.254':139
'19#.#4.239.131':139
'19#.#4.204.154':445
'19#.#4.131.196':445
'19#.#4.101.131':445
'19#.#4.51.101':445
'19#.#4.245.203':445
'19#.#4.30.67':445
'19#.#4.40.111':445
'19#.#4.63.211':445
'19#.#4.90.129':445
'19#.#4.29.68':445
'19#.#4.143.146':445
'19#.#4.182.1':445
'19#.#4.217.93':445
'19#.#4.103.174':445
'19#.#4.119.157':139
'19#.#4.212.7':139
'19#.#4.167.105':139
'19#.#4.13.254':445
'19#.#4.239.131':445
'19#.#4.141.239':139
'19#.#4.14.198':445
'19#.#4.163.12':445
'19#.#4.180.157':445
'19#.#4.17.42':445
'19#.24.5.71':445
'19#.#4.165.200':445
'19#.24.12.9':445
'19#.#4.152.136':445
'19#.#4.73.32':445
'19#.#4.58.56':445
'19#.#4.137.31':445
'19#.#4.201.183':445
'19#.#4.40.245':445
'19#.#4.101.131':139
'19#.#4.51.101':139
'19#.#4.40.215':139
'19#.#4.30.67':139
'19#.#4.40.111':139
'19#.#4.131.196':139
'19#.#4.67.133':139
'19#.#4.72.192':139
'19#.#4.127.153':139
'19#.#4.89.158':139
'19#.#4.90.89':139
'19#.#4.165.120':139
'19#.#4.245.203':139
'19#.#4.59.230':9988
'19#.#4.110.124':9988
'19#.#4.8.105':9988
'19#.#4.139.1':9988
'19#.#4.179.81':9988
'19#.#4.77.200':9988
'19#.#4.211.142':139
'19#.#4.31.14':139
'19#.#4.66.178':139
'19#.#4.172.49':9988
'19#.#4.141.173':9988
'19#.#4.204.154':139
'19#.#4.154.182':139
'19#.#4.73.32':139
'19#.#4.58.56':139
'19#.#4.14.198':139
'19#.#4.201.183':139
'19#.#4.40.245':139
'19#.#4.152.136':139
'19#.#4.90.129':139
'19#.#4.29.68':139
'19#.#4.143.146':139
'19#.#4.182.1':139
'19#.#4.217.93':139
'19#.#4.103.174':139
'19#.#4.137.31':139
'19#.#4.56.39':139
'19#.24.4.0':139
'19#.#4.63.211':139
'19#.#4.121.97':139
'19#.#4.178.247':139
'19#.#4.107.81':139
'19#.#4.163.12':139
'19#.#4.180.157':139
'19#.#4.17.42':139
'19#.24.5.71':139
'19#.#4.165.200':139
'19#.24.12.9':139

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial