Trojan.Starman.4948

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Network activity:

Connects to:

'12.##.209.186':445
'12.##.231.171':445
'12.##.198.210':445
'12.#7.42.72':445
'12.##.166.168':445
'12.#7.49.48':445
'12.##.193.59':445
'12.##.227.37':445
'12.##.43.231':445
'12.##.90.223':445
'12.##.41.223':445
'12.##.99.149':139
'12.#7.0.135':139
'12.#7.2.186':445
'12.##.68.203':445
'12.##.237.144':445
'12.##.169.168':445
'12.##.171.12':445
'12.#7.93.45':445
'12.##.71.132':445
'12.#7.51.67':445
'12.##.24.218':445
'12.##.88.161':445
'12.##.62.155':445
'12.##.176.187':445
'12.##.52.157':445
'12.##.23.107':445
'12.##.150.251':445
'12.##.244.48':445
'12.#7.42.27':445
'12.##.198.100':445
'12.##.203.197':445
'12.#7.8.186':445
'12.##.89.215':445
'12.##.88.161':139
'12.#7.42.72':139
'12.##.209.186':139
'12.##.43.231':139
'12.##.198.210':139
'12.##.227.37':139
'12.##.166.168':139
'12.##.231.171':139
'12.##.193.59':139
'12.##.68.203':139
'12.##.89.226':445
'12.##.90.223':139
'12.##.154.88':445
'12.#7.56.66':445
'12.##.169.168':139
'12.#7.2.186':139
'12.##.41.223':139
'12.##.237.144':139
'12.#7.51.67':139
'12.##.171.12':139
'12.##.52.157':139
'12.##.71.132':139
'12.##.176.187':139
'12.##.24.218':139
'12.#7.93.45':139
'12.##.62.155':139
'12.##.203.197':139
'12.#7.42.27':139
'12.##.23.107':139
'12.#7.49.48':139
'12.##.244.48':139
'12.##.89.215':139
'12.##.198.100':139
'12.##.150.251':139
'12.#7.8.186':139
'12.##.99.149':445
'12.##.34.217':139
'12.#7.56.67':139
'12.##.74.210':139
'12.#7.1.146':139
'12.##.169.109':139
'12.##.146.54':139
'12.##.16.133':139
'12.##.74.146':139
'12.##.65.191':139
'12.##.99.213':139
'12.##.212.185':139
'12.#7.26.54':139
'12.##.12.243':139
'12.##.252.146':139
'12.##.216.137':139
'12.##.113.20':139
'12.##.56.141':139
'12.##.124.233':139
'12.##.146.45':139
'12.##.84.192':139
'12.##.51.164':139
'12.##.56.152':139
'12.##.238.213':139
'12.##.149.191':139
'12.#7.7.155':139
'12.##.118.64':139
'12.#7.86.95':139
'12.##.180.85':139
'12.#7.61.36':139
'12.#7.95.61':139
'12.##.162.180':139
'12.##.145.103':139
'12.##.204.124':139
'12.##.115.212':139
'12.#7.18.47':445
'12.##.141.31':139
'12.##.248.86':139
'12.##.124.123':139
'12.#7.3.35':139
'12.##.217.219':139
'12.##.170.153':139
'12.##.192.116':139
'12.#7.26.95':139
'12.##.164.38':139
'12.#7.43.52':139
'12.##.62.105':139
'12.#7.0.135':445
'12.#7.52.0':139
'12.##.64.211':139
'12.##.138.202':139
'12.##.207.49':139
'12.##.101.165':139
'12.##.141.31':445
'12.##.248.86':445
'12.##.124.123':445
'12.#7.3.35':445
'12.##.217.219':445
'12.##.170.153':445
'12.##.192.116':445
'12.#7.26.95':445
'12.##.164.38':445
'12.#7.43.52':445
'12.##.62.105':445
'12.#7.18.47':139
'12.#7.52.0':445
'12.##.64.211':445
'12.##.138.202':445
'12.##.207.49':445
'12.##.101.165':445
'12.#7.169.7':139
'12.##.162.139':139
'12.#7.24.90':139
'12.##.35.234':139
'12.##.65.157':139
'12.#7.19.64':445
'12.#7.26.13':139
'12.#7.43.11':139
'12.##.68.154':139
'12.##.25.180':139
'12.#7.97.16':139
'12.##.208.90':139
'12.##.179.208':139
'12.##.151.194':139
'12.##.168.132':139
'12.#7.18.56':139
'12.##.44.109':139
'12.##.115.127':445
'12.#7.8.79':445
'12.#7.199.0':445
'12.##.31.144':445
'12.#7.200.3':445
'12.##.136.226':445
'12.##.215.137':445
'12.##.146.69':445
'12.#7.1.4':445
'12.#7.27.38':445
'12.##.90.213':445
'12.##.171.124':445
'12.##.99.170':445
'12.##.80.121':445
'12.##.193.95':445
'12.#7.39.62':445
'12.##.122.39':445
'12.##.184.95':139
'12.##.31.144':139
'12.##.115.127':139
'12.#7.1.4':139
'12.#7.199.0':139
'12.##.146.69':139
'12.#7.200.3':139
'12.#7.8.79':139
'12.##.215.137':139
'12.##.193.95':139
'12.#7.19.64':139
'12.##.99.170':139
'12.##.90.213':139
'12.#7.27.38':139
'12.##.122.39':139
'12.##.80.121':139
'12.##.171.124':139
'12.#7.39.62':139
'12.##.218.228':139
'12.##.119.154':139
'12.##.90.146':139
'12.##.129.74':139
'12.##.130.83':139
'12.##.148.70':139
'12.##.26.227':139
'12.##.63.240':139
'12.##.102.58':139
'12.##.55.100':139
'12.##.75.223':139
'12.##.136.226':139
'12.##.96.192':139
'12.##.210.200':139
'12.##.167.210':139
'12.#7.3.230':139
'12.#7.19.28':139
'12.##.96.192':445
'12.##.106.233':139
'12.##.207.106':139
'12.##.127.30':139
'12.##.189.227':139
'12.#7.42.36':139
'12.##.155.254':139
'12.##.16.138':139
'12.##.52.223':139
'12.#7.51.41':139
'12.#7.43.11':9988
'12.##.140.78':139
'12.##.210.200':9988
'12.##.162.139':9988
'12.##.164.216':139
'12.##.229.109':139
'12.##.237.17':139
'12.#7.0.215':139
'12.##.106.233':445
'12.##.207.106':445
'12.##.127.30':445
'12.##.189.227':445
'12.#7.42.36':445
'12.##.155.254':445
'12.##.16.138':445
'12.##.52.223':445
'12.#7.51.41':445
'12.##.89.226':139
'12.##.140.78':445
'12.##.154.88':139
'12.#7.56.66':139
'12.##.164.216':445
'12.##.229.109':445
'12.##.237.17':445
'12.#7.0.215':445
'12.##.55.100':9988
'12.##.26.227':445
'12.##.63.240':445
'12.##.218.228':445
'12.##.119.154':445
'12.##.184.95':445
'12.##.208.90':445
'12.##.130.83':445
'12.##.148.70':445
'12.##.129.74':445
'12.#7.3.230':445
'12.#7.19.28':445
'12.##.55.100':445
'12.##.75.223':445
'12.##.167.210':445
'12.##.90.146':445
'12.##.210.200':445
'12.##.102.58':445
'12.##.162.139':445
'12.#7.26.13':445
'12.##.35.234':445
'12.#7.169.7':445
'12.#7.1.4':9988
'12.##.193.95':9988
'12.#7.43.11':445
'12.##.65.157':445
'12.#7.24.90':445
'12.#7.97.16':445
'12.#7.18.56':445
'12.##.179.208':445
'12.##.25.180':445
'12.##.168.132':445
'12.##.68.154':445
'12.##.44.109':445
'12.##.151.194':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial