Trojan.Starman.6359

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Network activity:

Connects to:

'21#.#37.11.83':445
'21#.#37.33.119':445
'21#.#37.89.58':445
'21#.#37.19.10':445
'21#.#37.191.224':445
'21#.#37.20.100':445
'21#.#37.226.30':445
'21#.#37.86.55':445
'21#.#37.61.181':445
'21#.#37.127.253':445
'21#.#37.75.66':445
'21#.#37.180.236':445
'21#.#37.203.248':445
'21#.#37.130.28':445
'21#.#37.58.35':445
'21#.#37.191.4':445
'21#.#37.230.74':445
'21#.#37.24.90':445
'21#.#37.131.254':445
'21#.#37.171.176':445
'21#.#37.7.10':445
'21#.#37.40.248':445
'21#.#37.26.210':445
'21#.#37.49.49':445
'21#.#37.240.131':445
'21#.#37.49.48':445
'21#.#37.182.210':445
'21#.#37.131.183':445
'21#.#37.226.55':445
'21#.#37.253.226':445
'21#.#37.168.47':445
'21#.#37.216.91':445
'21#.#37.90.61':445
'21#.#37.26.210':139
'21#.#37.49.49':139
'21#.#37.230.74':139
'21#.#37.24.90':139
'21#.#37.95.17':139
'21#.#37.68.195':139
'21#.#37.7.10':139
'21#.#37.40.248':139
'21#.#37.168.47':139
'21#.#37.216.91':139
'21#.#37.240.131':139
'21#.#37.49.48':139
'21#.#37.131.254':139
'21#.#37.171.176':139
'21#.#37.226.55':139
'21#.#37.253.226':139
'21#.#37.35.213':139
'21#.#37.140.162':139
'21#.#37.222.209':139
'21#.#37.58.95':139
'21#.#37.132.116':445
'21#.#37.51.132':445
'21#.#37.90.221':445
'21#.#37.117.37':445
'21#.#37.242.35':139
'21#.#37.12.195':139
'21#.#37.20.60':139
'21#.#37.36.111':139
'21#.#37.226.200':139
'21#.#37.127.226':139
'21#.#37.181.245':139
'21#.#37.7.143':139
'21#.#37.163.120':139
'21#.#37.157.241':139
'21#.#37.216.131':139
'21#.#37.65.9':139
'21#.#37.13.139':139
'21#.#37.83.108':139
'21#.#37.9.158':139
'21#.#37.124.38':139
'21#.#37.30.25':139
'21#.#37.95.201':139
'21#.#37.95.91':139
'21#.#37.106.95':139
'21#.#37.224.122':139
'21#.#37.44.175':139
'21#.#37.143.96':139
'21#.#37.239.129':139
'21#.#37.39.12':139
'21#.#37.41.178':139
'21#.#37.133.214':139
'21#.#37.217.133':139
'21#.#37.79.160':139
'21#.#37.221.52':139
'21#.#37.85.70':139
'21#.#37.67.125':139
'21#.#37.17.106':139
'21#.#37.64.147':139
'21#.#37.81.3':139
'21#.#37.93.160':139
'21#.#37.19.120':139
'21#.#37.215.19':139
'21#.#37.42.166':139
'21#.#37.120.42':139
'21#.#37.91.130':139
'21#.#37.222.209':445
'21#.#37.58.95':445
'21#.#37.226.200':445
'21#.#37.127.226':445
'21#.#37.239.139':139
'21#.#37.138.112':139
'21#.#37.35.213':445
'21#.#37.140.162':445
'21#.#37.242.35':445
'21#.#37.36.111':445
'21#.#37.95.17':445
'21#.#37.68.195':445
'21#.#37.181.245':445
'21#.#37.7.143':445
'21#.#37.20.60':445
'21#.#37.12.195':445
'21#.#37.33.91':139
'21#.#37.229.79':139
'21#.#37.191.89':139
'21#.#37.69.21':139
'21#.#37.114.165':139
'21#.#37.206.9':139
'21#.#37.8.221':139
'21#.#37.129.177':139
'21#.#37.223.201':139
'21#.#37.179.70':139
'21#.#37.108.49':139
'21#.#37.7.137':139
'21#.#37.55.37':139
'21#.#37.74.250':139
'21#.#37.43.242':139
'21#.#37.250.224':139
'21#.#37.233.116':139
'21#.#37.232.51':139
'21#.#37.76.136':139
'21#.#37.87.76':139
'21#.#37.14.90':139
'21#.#37.11.241':139
'21#.#37.231.72':139
'21#.#37.159.146':139
'21#.#37.66.76':139
'21#.#37.37.66':139
'21#.#37.98.193':139
'21#.#37.108.191':139
'21#.#37.70.158':139
'21#.#37.136.70':139
'21#.#37.23.113':139
'21#.#37.122.210':139
'21#.#37.172.155':445
'21#.#37.10.226':445
'21#.#37.110.88':445
'21#.#37.181.235':445
'21#.#37.187.254':445
'21#.#37.192.144':445
'21#.#37.11.25':445
'21#.#37.118.44':445
'21#.137.6.1':445
'21#.#37.176.126':445
'21#.#37.232.3':139
'21#.#37.141.56':139
'21#.#37.237.15':445
'21#.#37.60.118':445
'21#.#37.159.117':445
'21#.#37.16.89':445
'21#.#37.201.96':139
'21#.#37.11.25':139
'21#.#37.118.44':139
'21#.#37.172.155':139
'21#.#37.10.226':139
'21#.#37.146.132':139
'21#.#37.12.250':139
'21#.#37.187.254':139
'21#.#37.192.144':139
'21#.137.6.1':139
'21#.#37.16.89':139
'21#.#37.176.126':139
'21#.#37.181.235':139
'21#.#37.60.118':139
'21#.#37.110.88':139
'21#.#37.237.15':139
'21#.#37.159.117':139
'21#.#37.27.38':139
'21#.#37.115.27':139
'21#.#37.40.191':139
'21#.#37.34.107':139
'21#.#37.110.165':139
'21#.#37.160.98':139
'21#.#37.189.72':139
'21#.#37.184.60':139
'21#.#37.161.14':139
'21#.#37.120.160':139
'21#.#37.48.21':139
'21#.#37.178.240':139
'21#.#37.222.168':139
'21#.#37.73.222':139
'21#.#37.241.112':139
'21#.#37.168.240':139
'21#.#37.117.37':139
'21#.#37.132.116':139
'21#.#37.141.56':9988
'21#.#37.90.221':139
'21#.#37.75.66':139
'21#.#37.180.236':139
'21#.#37.51.132':139
'21#.#37.90.61':139
'21#.#37.232.3':445
'21#.#37.141.56':445
'21#.#37.14.90':445
'21#.#37.11.241':445
'21#.#37.241.112':9988
'21#.#37.184.60':9988
'21#.137.6.1':9988
'21#.#37.146.132':9988
'21#.#37.226.30':139
'21#.#37.86.55':139
'21#.#37.11.83':139
'21#.#37.33.119':139
'21#.#37.182.210':139
'21#.#37.131.183':139
'21#.#37.191.224':139
'21#.#37.20.100':139
'21#.#37.58.35':139
'21#.#37.191.4':139
'21#.#37.61.181':139
'21#.#37.127.253':139
'21#.#37.89.58':139
'21#.#37.19.10':139
'21#.#37.203.248':139
'21#.#37.130.28':139
'21#.#37.159.146':445
'21#.#37.40.191':445
'21#.#37.34.107':445
'21#.#37.222.168':445
'21#.#37.73.222':445
'21#.#37.189.72':445
'21#.#37.184.60':445
'21#.#37.27.38':445
'21#.#37.115.27':445
'21#.#37.48.21':445
'21#.#37.178.240':445
'21#.#37.146.132':445
'21#.#37.12.250':445
'21#.#37.168.240':445
'21#.#37.241.112':445
'21#.#37.161.14':445
'21#.#37.120.160':445
'21#.#37.136.70':445
'21#.#37.76.136':445
'21#.#37.122.210':445
'21#.#37.70.158':445
'21#.#37.232.51':445
'21#.#37.231.72':445
'21#.#37.87.76':445
'21#.#37.233.116':445
'21#.#37.201.96':445
'21#.#37.98.193':445
'21#.#37.110.165':445
'21#.#37.160.98':445
'21#.#37.37.66':445
'21#.#37.23.113':445
'21#.#37.108.191':445
'21#.#37.66.76':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial