Trojan.Starman.5624

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'68.#.126.54':445
'68.#.37.92':445
'68.#.93.115':445
'68.#.132.85':445
'68.#.80.193':445
'68.#.93.141':445
'68.#.11.28':445
'68.#.141.69':445
'68.#.1.79':445
'68.#.136.235':445
'68.#.69.85':445
'68.#.76.13':445
'68.#.245.125':445
'68.#.180.120':445
'68.#.119.148':445
'68.#.120.39':445
'68.#.6.247':445
'68.#.81.225':445
'68.#.44.216':445
'68.#.49.245':445
'68.#.5.89':445
'68.#.94.180':445
'68.#.8.226':139
'68.#.185.233':139
'68.#.216.96':139
'68.#.252.1':445
'68.#.9.64':445
'68.#.50.95':139
'68.#.34.184':139
'68.#.75.244':139
'68.#.129.109':139
'68.#.93.204':139
'68.#.98.135':445
'68.#.5.160':139
'68.#.98.135':139
'68.#.98.103':139
'68.#.240.92':445
'68.#.155.142':139
'68.#.98.103':445
'68.#.5.160':445
'68.#.155.142':445
'68.#.252.1':139
'68.#.9.64':139
'68.#.100.145':445
'68.#.37.92':139
'68.#.1.79':139
'68.#.126.54':139
'68.#.80.193':139
'68.#.93.115':139
'68.#.11.28':139
'68.#.94.180':139
'68.#.93.141':139
'68.#.136.235':139
'68.#.141.69':139
'68.#.132.85':139
'68.#.245.125':139
'68.#.49.245':139
'68.#.76.13':139
'68.#.120.39':139
'68.#.180.120':139
'68.#.81.225':139
'68.#.69.85':139
'68.#.6.247':139
'68.#.5.89':139
'68.#.44.216':139
'68.#.240.92':139
'68.#.102.77':445
'68.#.94.28':445
'68.#.8.103':445
'68.#.104.29':445
'68.#.141.150':445
'68.#.21.62':445
'68.#.158.236':445
'68.#.52.129':445
'68.#.116.83':445
'68.#.3.70':445
'68.#.17.71':445
'68.#.95.22':445
'68.#.14.231':445
'68.#.51.98':445
'68.#.79.240':445
'68.#.97.161':445
'68.#.223.102':445
'68.#.70.197':445
'68.#.43.142':445
'68.#.140.177':445
'68.#.0.239':445
'68.#.32.114':139
'68.#.207.4':445
'68.#.208.206':445
'68.#.192.251':445
'68.#.154.134':445
'68.#.201.247':445
'68.#.1.96':445
'68.#.41.252':445
'68.#.55.191':445
'68.#.122.209':445
'68.#.185.174':445
'68.#.125.150':445
'68.#.68.201':445
'68.#.43.122':445
'68.#.218.86':445
'68.#.32.114':445
'68.#.111.84':445
'68.#.128.170':445
'68.#.125.188':445
'68.#.69.50':445
'68.#.63.168':445
'68.#.139.94':445
'68.#.81.194':445
'68.#.243.30':445
'68.#.104.178':139
'68.#.184.104':445
'68.#.135.235':445
'68.#.108.65':445
'68.#.251.190':139
'68.#.90.226':139
'68.#.245.223':139
'68.#.151.9':139
'68.#.23.37':139
'68.#.52.2':445
'68.#.164.101':445
'68.#.22.30':445
'68.#.32.30':445
'68.#.143.155':445
'68.#.161.63':445
'68.#.16.164':445
'68.#.38.87':445
'68.#.164.73':445
'68.#.254.231':445
'68.#.59.249':445
'68.#.34.184':445
'68.#.208.206':139
'68.#.122.209':139
'68.#.207.4':139
'68.#.201.247':139
'68.#.192.251':139
'68.#.41.252':139
'68.#.81.194':139
'68.#.1.96':139
'68.#.185.174':139
'68.#.55.191':139
'68.#.154.134':139
'68.#.43.122':139
'68.#.63.168':139
'68.#.68.201':139
'68.#.111.84':139
'68.#.218.86':139
'68.#.125.188':139
'68.#.125.150':139
'68.#.128.170':139
'68.#.139.94':139
'68.#.69.50':139
'68.#.143.155':139
'68.#.216.96':445
'68.#.8.226':445
'68.#.243.30':139
'68.#.108.65':139
'68.#.184.104':139
'68.#.75.244':445
'68.#.50.95':445
'68.#.93.204':445
'68.#.185.233':445
'68.#.129.109':445
'68.#.135.235':139
'68.#.22.30':139
'68.#.254.231':139
'68.#.164.101':139
'68.#.161.63':139
'68.#.32.30':139
'68.#.38.87':139
'68.#.52.2':139
'68.#.16.164':139
'68.#.59.249':139
'68.#.164.73':139
'68.#.119.148':139
'68.#.119.138':445
'68.#.13.131':445
'68.#.12.174':445
'68.#.85.60':445
'68.#.123.20':445
'68.#.109.189':445
'68.#.101.99':445
'68.#.49.167':445
'68.#.110.236':445
'68.#.80.110':445
'68.#.17.10':445
'68.#.243.159':139
'68.#.0.202':139
'68.#.113.197':139
'68.#.22.189':139
'68.#.173.128':139
'68.#.217.117':445
'68.#.221.7':445
'68.#.111.199':445
'68.#.119.189':139
'68.#.201.196':139
'68.#.42.61':445
'68.#.53.4':445
'68.#.109.217':445
'68.#.163.234':445
'68.#.128.194':445
'68.#.56.195':445
'68.#.182.106':445
'68.#.34.206':445
'68.#.106.73':445
'68.#.148.190':445
'68.#.122.76':445
'68.#.199.142':445
'68.#.127.10':445
'68.#.59.136':445
'68.#.44.90':445
'68.#.21.24':445
'68.#.202.177':445
'68.#.74.7':445
'68.#.72.158':445
'68.#.7.198':445
'68.#.16.98':445
'68.#.172.215':445
'68.#.93.99':139
'68.#.42.61':139
'68.#.21.24':139
'68.#.101.99':139
'68.#.49.167':139
'68.#.109.189':139
'68.#.59.136':139
'68.#.16.98':139
'68.#.127.10':139
'68.#.202.177':139
'68.#.44.90':139
'68.#.80.110':139
'68.#.111.199':139
'68.#.85.60':139
'68.#.221.7':139
'68.#.217.117':139
'68.#.17.10':139
'68.#.13.131':139
'68.#.110.236':139
'68.#.119.138':139
'68.#.123.20':139
'68.#.12.174':139
'68.#.172.215':139
'68.#.169.200':139
'68.#.49.92':139
'68.#.34.206':139
'68.#.106.73':139
'68.#.182.106':139
'68.#.10.129':139
'68.#.85.185':139
'68.#.7.4':139
'68.#.148.106':139
'68.#.100.11':139
'68.#.122.76':139
'68.#.199.142':139
'68.#.128.194':139
'68.#.72.158':139
'68.#.7.198':139
'68.#.74.7':139
'68.#.109.217':139
'68.#.148.190':139
'68.#.53.4':139
'68.#.56.195':139
'68.#.163.234':139
'68.#.169.200':445
'68.#.157.148':139
'68.#.139.177':445
'68.#.84.223':139
'68.#.3.20':139
'68.#.211.61':139
'68.#.84.223':445
'68.#.157.148':445
'68.#.211.61':445
'68.#.241.193':445
'68.#.3.20':445
'68.#.241.193':139
'68.#.42.242':445
'68.#.121.73':445
'68.#.5.44':445
'68.#.215.229':445
'68.#.32.216':445
'68.#.114.22':445
'68.#.139.177':139
'68.#.22.78':445
'68.#.66.47':445
'68.#.116.93':445
'68.#.79.240':139
'68.#.94.28':139
'68.#.116.83':139
'68.#.102.77':139
'68.#.141.150':139
'68.#.8.103':139
'68.#.158.236':139
'68.#.100.145':139
'68.#.21.62':139
'68.#.3.70':139
'68.#.52.129':139
'68.#.104.29':139
'68.#.14.231':139
'68.#.140.177':139
'68.#.95.22':139
'68.#.97.161':139
'68.#.51.98':139
'68.#.70.197':139
'68.#.17.71':139
'68.#.223.102':139
'68.#.0.239':139
'68.#.43.142':139
'68.#.230.77':445
'68.#.202.177':9988
'68.#.221.7':9988
'68.#.201.196':445
'68.#.0.202':445
'68.#.119.189':445
'68.#.127.10':9988
'68.#.16.98':9988
'68.#.44.90':9988
'68.#.101.99':9988
'68.#.110.236':9988
'68.#.243.159':445
'68.#.7.4':445
'68.#.10.129':445
'68.#.100.11':445
'68.#.49.92':445
'68.#.148.106':445
'68.#.173.128':445
'68.#.113.197':445
'68.#.22.189':445
'68.#.85.185':445
'68.#.93.99':445
'68.#.49.167':9988
'68.#.42.242':139
'68.#.121.73':139
'68.#.5.44':139
'68.#.215.229':139
'68.#.32.216':139
'68.#.114.22':139
'68.#.149.11':445
'68.#.22.78':139
'68.#.66.47':139
'68.#.116.93':139
'68.#.230.77':139
'68.#.217.117':9988
'68.#.119.138':9988
'68.#.111.199':9988
'68.#.21.24':9988
'68.#.123.20':9988
'68.#.7.198':9988
'68.#.149.11':139
'68.#.109.189':9988
'68.#.42.61':9988
'68.#.12.174':9988

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial