Trojan.Starman.4993

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'82.##8.72.39':139
'82.##8.134.76':139
'82.##8.128.104':139
'82.##8.194.29':139
'82.##8.206.182':139
'82.##8.47.157':139
'82.##8.11.240':139
'82.##8.218.185':139
'82.##8.181.80':139
'82.##8.111.206':139
'82.##8.124.121':139
'82.##8.74.152':445
'82.##8.156.192':445
'82.##8.22.207':445
'82.##8.144.213':445
'82.##8.180.152':445
'82.##8.253.76':139
'82.##8.24.110':139
'82.##8.108.37':139
'82.##8.185.188':139
'82.##8.56.248':139
'82.##8.72.39':445
'82.##8.134.76':445
'82.##8.128.104':445
'82.##8.194.29':445
'82.##8.206.182':445
'82.##8.47.157':445
'82.##8.11.240':445
'82.##8.218.185':445
'82.##8.181.80':445
'82.##8.111.206':445
'82.##8.124.121':445
'82.##8.40.63':139
'82.##8.146.90':139
'82.##8.50.129':139
'82.##8.160.99':139
'82.##8.113.122':139
'82.##8.253.76':445
'82.##8.24.110':445
'82.##8.108.37':445
'82.##8.185.188':445
'82.##8.56.248':445
'82.##8.47.77':445
'82.##8.180.152':139
'82.##8.22.207':139
'82.##8.144.213':139
'82.##8.168.143':139
'82.##8.47.77':139
'82.##8.118.69':445
'82.##8.118.63':445
'82.##8.109.92':445
'82.##8.74.152':139
'82.##8.156.192':139
'82.##8.47.133':139
'82.##8.36.252':139
'82.##8.231.230':139
'82.##8.40.234':139
'82.##8.33.201':139
'82.##8.202.135':139
'82.##8.71.77':139
'82.##8.21.166':139
'82.##8.77.77':139
'82.##8.126.18':139
'82.##8.86.92':139
'82.##8.126.18':445
'82.##8.86.92':445
'82.##8.231.230':445
'82.##8.40.234':445
'82.##8.36.252':445
'82.##8.47.133':445
'82.##8.168.143':445
'82.##8.21.166':445
'82.##8.77.77':445
'82.##8.71.77':445
'82.##8.202.135':445
'82.##8.136.146':445
'82.##8.216.199':445
'82.##8.129.132':445
'82.##8.37.118':445
'82.##8.117.214':445
'82.##8.130.158':445
'82.##8.33.201':445
'82.##8.26.217':445
'82.##8.202.216':445
'82.##8.208.202':445
'82.##8.160.99':445
'82.##8.31.35':445
'82.##8.67.197':445
'82.##8.204.21':445
'82.##8.46.122':445
'82.##8.88.105':445
'82.##8.129.20':445
'82.##8.198.196':445
'82.##8.54.233':445
'82.##8.90.39':445
'82.##8.129.3':445
'82.##8.22.21':445
'82.##8.208.204':445
'82.##8.173.173':445
'82.##8.173.122':445
'82.##8.69.190':445
'82.##8.189.216':445
'82.##8.37.49':445
'82.##8.68.55':445
'82.##8.215.232':445
'82.##8.148.232':445
'82.##8.64.203':445
'82.##8.130.209':139
'82.##8.49.158':139
'82.#48.51.9':139
'82.#48.70.4':139
'82.#48.8.70':139
'82.##8.54.111':139
'82.##8.171.184':139
'82.##8.185.19':139
'82.##8.120.211':139
'82.##8.107.162':139
'82.##8.63.115':139
'82.##8.14.214':139
'82.##8.108.40':139
'82.##8.161.198':139
'82.##8.68.145':139
'82.##8.187.90':139
'82.##8.181.90':139
'82.##8.209.80':139
'82.##8.242.158':139
'82.##8.231.107':139
'82.##8.217.230':139
'82.##8.145.205':445
'82.##8.189.216':139
'82.##8.173.122':139
'82.##8.69.190':139
'82.##8.235.237':139
'82.##8.145.205':139
'82.##8.64.203':139
'82.##8.215.232':139
'82.##8.148.232':139
'82.##8.208.204':139
'82.##8.173.173':139
'82.##8.205.97':139
'82.##8.146.90':445
'82.##8.188.134':139
'82.##8.40.63':445
'82.##8.113.122':445
'82.##8.50.129':445
'82.##8.71.22':139
'82.##8.22.58':139
'82.##8.125.62':139
'82.##8.207.183':139
'82.##8.96.98':139
'82.##8.207.183':445
'82.##8.96.98':445
'82.##8.188.134':445
'82.##8.129.20':139
'82.##8.198.196':139
'82.##8.205.97':445
'82.##8.235.237':445
'82.##8.22.58':445
'82.##8.125.62':445
'82.##8.71.22':445
'82.##8.54.233':139
'82.##8.46.122':139
'82.##8.88.105':139
'82.##8.22.21':139
'82.##8.37.49':139
'82.##8.68.55':139
'82.##8.90.39':139
'82.##8.129.3':139
'82.##8.67.197':139
'82.##8.204.21':139
'82.##8.31.35':139
'82.##8.58.91':445
'82.##8.199.238':445
'82.##8.81.57':445
'82.##8.55.23':445
'82.##8.133.171':445
'82.##8.44.245':445
'82.##8.177.91':445
'82.##8.212.195':445
'82.##8.68.124':445
'82.##8.208.103':445
'82.##8.89.151':445
'82.##8.201.230':139
'82.##8.191.201':139
'82.##8.34.169':139
'82.##8.80.239':139
'82.##8.243.253':139
'82.##8.64.160':445
'82.##8.48.193':445
'82.##8.232.51':139
'82.##8.126.93':139
'82.##8.143.20':139
'82.##8.138.204':445
'82.##8.221.148':445
'82.##8.175.39':445
'82.##8.189.154':445
'82.##8.203.216':445
'82.##8.204.39':445
'82.##8.63.24':445
'82.##8.96.203':445
'82.##8.213.221':445
'82.##8.175.113':445
'82.##8.88.170':445
'82.##8.162.88':445
'82.##8.229.243':445
'82.##8.113.86':445
'82.##8.50.151':445
'82.##8.86.50':445
'82.##8.147.9':445
'82.##8.170.147':445
'82.##8.125.81':445
'82.##8.46.13':445
'82.##8.200.181':445
'82.##8.131.48':139
'82.##8.86.50':139
'82.##8.113.86':139
'82.##8.50.151':139
'82.##8.44.245':139
'82.##8.177.91':139
'82.##8.200.181':139
'82.##8.125.81':139
'82.##8.229.243':139
'82.##8.162.88':139
'82.##8.46.13':139
'82.##8.212.195':139
'82.##8.64.160':139
'82.##8.55.23':139
'82.##8.48.193':139
'82.##8.89.151':139
'82.##8.133.171':139
'82.##8.68.124':139
'82.##8.208.103':139
'82.##8.199.238':139
'82.##8.81.57':139
'82.##8.58.91':139
'82.##8.21.47':139
'82.##8.21.81':139
'82.##8.205.17':139
'82.##8.204.39':139
'82.##8.63.24':139
'82.##8.40.220':139
'82.##8.39.252':139
'82.#48.1.24':139
'82.##8.164.63':139
'82.##8.54.132':139
'82.##8.96.203':139
'82.##8.189.154':139
'82.##8.175.39':139
'82.##8.88.170':139
'82.##8.147.9':139
'82.##8.170.147':139
'82.##8.213.221':139
'82.##8.175.113':139
'82.##8.221.148':139
'82.##8.203.216':139
'82.##8.138.204':139
'82.##8.205.17':445
'82.##8.208.12':445
'82.##8.38.58':445
'82.##8.14.68':445
'82.##8.184.26':445
'82.##8.205.121':445
'82.##8.129.203':445
'82.#48.74.8':445
'82.##8.60.166':445
'82.##8.27.183':445
'82.##8.114.60':445
'82.##8.209.211':445
'82.##8.84.228':139
'82.##8.46.172':139
'82.##8.228.41':139
'82.##8.19.141':139
'82.##8.106.53':139
'82.##8.185.207':139
'82.##8.151.9':445
'82.##8.195.209':139
'82.##8.3.206':139
'82.##8.159.4':139
'82.##8.129.132':139
'82.##8.136.146':139
'82.##8.117.214':139
'82.##8.118.63':139
'82.##8.37.118':139
'82.##8.26.217':139
'82.##8.130.158':139
'82.##8.208.202':139
'82.##8.216.199':139
'82.##8.202.216':139
'82.##8.118.69':139
'82.##8.84.228':445
'82.##8.46.172':445
'82.##8.228.41':445
'82.##8.19.141':445
'82.##8.106.53':445
'82.##8.185.207':445
'82.##8.109.92':139
'82.##8.195.209':445
'82.##8.3.206':445
'82.##8.159.4':445
'82.#48.74.8':139
'82.##8.143.20':445
'82.##8.232.51':445
'82.##8.126.93':445
'82.##8.201.230':445
'82.##8.191.201':445
'82.##8.177.91':9988
'82.##8.86.50':9988
'82.##8.208.103':9988
'82.##8.48.193':9988
'82.##8.64.160':9988
'82.##8.34.169':445
'82.##8.54.132':445
'82.#48.1.24':445
'82.##8.164.63':445
'82.##8.21.47':445
'82.##8.21.81':445
'82.##8.80.239':445
'82.##8.243.253':445
'82.##8.131.48':445
'82.##8.40.220':445
'82.##8.39.252':445
'82.##8.14.68':139
'82.##8.208.12':139
'82.##8.205.121':139
'82.##8.209.211':139
'82.##8.184.26':139
'82.##8.60.166':139
'82.##8.129.203':139
'82.##8.114.60':139
'82.##8.38.58':139
'82.##8.27.183':139
'82.##8.151.9':139
'82.##8.147.9':9988
'82.##8.189.154':9988
'82.##8.200.181':9988
'82.##8.113.86':9988
'82.##8.229.243':9988
'82.##8.96.203':9988
'82.##8.204.39':9988
'82.##8.213.221':9988
'82.##8.203.216':9988
'82.##8.221.148':9988

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial