Trojan.Starman.5075

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'14#.#06.165.72':445
'14#.#06.36.80':445
'14#.#06.44.212':445
'14#.#06.11.151':445
'14#.#06.164.127':445
'14#.#06.108.103':445
'14#.#06.190.111':445
'14#.#06.202.205':445
'14#.#06.43.203':445
'14#.#06.239.205':139
'14#.#06.73.67':139
'14#.#06.214.81':139
'14#.#06.136.65':139
'14#.#06.197.208':139
'14#.#06.77.205':445
'14#.#06.166.20':445
'14#.#06.119.35':139
'14#.#06.54.153':139
'14#.#06.11.143':445
'14#.#06.82.12':445
'14#.#06.28.191':445
'14#.#06.72.246':445
'14#.#06.150.97':445
'14#.#06.181.138':445
'14#.#06.139.61':445
'14#.#06.186.25':445
'14#.#06.185.186':445
'14#.#06.103.230':445
'14#.#06.183.188':445
'14#.#06.63.67':445
'14#.#06.56.220':445
'14#.#06.115.252':445
'14#.#06.239.43':445
'14#.#06.242.162':445
'14#.#06.100.115':445
'14#.#06.12.36':445
'14#.#06.118.123':139
'14#.#06.100.115':139
'14#.#06.12.36':139
'14#.#06.183.188':139
'14#.#06.115.252':139
'14#.#06.239.43':139
'14#.#06.72.246':139
'14#.#06.11.143':139
'14#.#06.242.162':139
'14#.#06.28.191':139
'14#.#06.202.205':139
'14#.#06.43.203':139
'14#.#06.36.80':139
'14#.#06.164.127':139
'14#.#06.108.103':139
'14#.#06.56.220':139
'14#.#06.103.230':139
'14#.#06.190.111':139
'14#.#06.63.67':139
'14#.#06.205.83':139
'14#.#06.126.205':139
'14#.#06.149.42':139
'14#.#06.230.243':139
'14#.#06.249.123':139
'14#.#06.126.32':139
'14#.#06.122.165':139
'14#.#06.115.167':139
'14#.#06.154.220':139
'14#.#06.186.25':139
'14#.#06.185.186':139
'14#.#06.82.12':139
'14#.#06.150.97':139
'14#.#06.181.138':139
'14#.#06.117.86':139
'14#.#06.28.159':139
'14#.#06.139.61':139
'14#.#06.211.243':139
'14#.#06.231.153':139
'14#.#06.94.212':139
'14#.#06.152.86':139
'14#.#06.58.20':139
'14#.#06.68.16':139
'14#.#06.162.17':139
'14#.#06.79.177':139
'14#.#06.109.200':139
'14#.#06.46.123':139
'14#.#06.152.171':139
'14#.#06.236.70':139
'14#.#06.22.199':139
'14#.#06.102.211':139
'14#.#06.48.217':139
'14#.#06.33.227':139
'14#.#06.183.209':139
'14#.#06.141.77':139
'14#.#06.191.216':139
'14#.#06.233.167':139
'14#.#06.67.237':139
'14#.#06.173.76':139
'14#.#06.244.43':139
'14#.#06.121.239':139
'14#.#06.37.202':139
'14#.#06.200.19':139
'14#.#06.134.36':139
'14#.#06.34.150':139
'14#.#06.161.89':139
'14#.#06.133.27':139
'14#.#06.105.200':139
'14#.#06.14.73':139
'14#.#06.112.239':139
'14#.#06.138.248':139
'14#.#06.76.108':139
'14#.#06.16.40':139
'14#.#06.157.13':139
'14#.#06.84.184':139
'14#.#06.122.165':445
'14#.#06.118.123':445
'14#.#06.154.220':445
'14#.#06.126.32':445
'14#.#06.214.81':445
'14#.#06.73.67':445
'14#.#06.197.208':445
'14#.#06.136.65':445
'14#.#06.239.205':445
'14#.#06.28.159':445
'14#.#06.149.42':445
'14#.#06.211.243':445
'14#.#06.117.86':445
'14#.#06.230.243':445
'14#.#06.249.123':445
'14#.#06.115.167':445
'14#.#06.205.83':445
'14#.#06.126.205':445
'14#.#06.255.242':139
'14#.#06.89.0':139
'14#.#06.200.44':139
'14#.#06.212.222':139
'14#.#06.9.206':139
'14#.#06.34.54':139
'14#.#06.56.34':139
'14#.#06.11.11':139
'14#.#06.3.40':139
'14#.#06.68.54':139
'14#.#06.111.68':139
'14#.#06.119.35':445
'14#.#06.54.153':445
'14#.#06.68.54':445
'14#.#06.8.114':139
'14#.#06.14.136':139
'14#.#06.111.68':445
'14#.#06.114.110':139
'14#.#06.154.65':139
'14#.#06.2.75':139
'14#.#06.197.99':139
'14#.#06.222.140':139
'14#.#06.67.182':139
'14#.#06.4.59':445
'14#.#06.182.19':445
'14#.206.7.1':445
'14#.#06.240.80':445
'14#.#06.18.77':139
'14#.#06.61.18':139
'14#.#06.210.223':139
'14#.#06.76.210':139
'14#.#06.247.60':139
'14#.#06.9.154':139
'14#.#06.166.9':139
'14#.#06.43.78':139
'14#.#06.218.173':139
'14#.#06.119.13':445
'14#.#06.30.94':445
'14#.#06.124.191':445
'14#.#06.250.2':445
'14#.#06.169.117':445
'14#.#06.23.49':445
'14#.#06.48.149':445
'14#.#06.19.186':445
'14#.#06.99.148':445
'14#.#06.146.41':445
'14#.#06.102.146':445
'14#.#06.188.39':445
'14#.#06.31.202':445
'14#.#06.104.103':445
'14#.#06.157.246':445
'14#.#06.191.157':445
'14#.#06.146.104':445
'14#.#06.49.206':445
'14#.#06.223.168':139
'14#.#06.157.246':139
'14#.#06.191.157':139
'14#.#06.146.104':139
'14#.#06.49.206':139
'14#.#06.124.191':139
'14#.#06.30.94':139
'14#.#06.169.117':139
'14#.#06.250.2':139
'14#.#06.119.13':139
'14#.#06.4.59':139
'14#.#06.182.19':139
'14#.#06.240.80':139
'14#.206.7.1':139
'14#.#06.188.39':139
'14#.#06.102.146':139
'14#.#06.104.103':139
'14#.#06.31.202':139
'14#.#06.146.41':139
'14#.#06.96.63':139
'14#.#06.72.39':139
'14#.#06.122.227':139
'14#.#06.251.208':139
'14#.#06.253.181':139
'14#.#06.2.84':139
'14#.#06.168.1':139
'14#.#06.82.21':139
'14#.#06.83.82':139
'14#.#06.23.49':139
'14#.#06.48.149':139
'14#.#06.19.186':139
'14#.#06.99.148':139
'14#.#06.236.91':139
'14#.#06.230.9':139
'14#.#06.57.20':139
'14#.#06.125.91':139
'14#.#06.93.234':139
'14#.#06.19.186':9988
'14#.#06.30.94':9988
'14#.#06.49.206':9988
'14#.#06.104.103':9988
'14#.#06.120.68':139
'14#.#06.94.54':139
'14#.#06.50.59':139
'14#.#06.47.95':139
'14#.#06.20.13':139
'14#.#06.31.202':9988
'14#.#06.102.146':9988
'14#.206.7.1':9988
'14#.#06.240.80':9988
'14#.#06.122.227':9988
'14#.#06.250.2':9988
'14#.#06.119.13':9988
'14#.#06.23.49':9988
'14#.#06.191.157':9988
'14#.#06.99.108':445
'14#.#06.250.30':445
'14#.#06.99.108':139
'14#.#06.250.30':139
'14#.#06.77.205':139
'14#.#06.11.151':139
'14#.#06.165.72':139
'14#.#06.166.20':139
'14#.#06.44.212':139
'14#.#06.120.68':445
'14#.#06.47.95':445
'14#.#06.84.180':139
'14#.#06.147.141':139
'14#.#06.20.13':445
'14#.#06.84.180':445
'14#.#06.147.141':445
'14#.#06.94.54':445
'14#.#06.50.59':445
'14#.#06.157.246':9988
'14#.#06.83.82':445
'14#.#06.2.84':445
'14#.#06.253.181':445
'14#.#06.82.21':445
'14#.#06.168.1':445
'14#.#06.76.210':445
'14#.#06.18.77':445
'14#.#06.223.168':445
'14#.#06.210.223':445
'14#.#06.93.234':445
'14#.#06.230.9':445
'14#.#06.236.91':445
'14#.#06.125.91':445
'14#.#06.57.20':445
'14#.#06.96.63':445
'14#.#06.72.39':445
'14#.#06.122.227':445
'14#.#06.251.208':445
'14#.#06.99.148':9988
'14#.#06.188.39':9988
'14#.#06.2.75':445
'14#.#06.67.182':445
'14#.#06.230.9':9988
'14#.#06.4.59':9988
'14#.#06.93.234':9988
'14#.#06.124.191':9988
'14#.#06.182.19':9988
'14#.#06.43.78':445
'14#.#06.218.173':445
'14#.#06.61.18':445
'14#.#06.247.60':445
'14#.#06.9.154':445
'14#.#06.222.140':445
'14#.#06.154.65':445
'14#.#06.166.9':445
'14#.#06.197.99':445

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial