Trojan.Starman.4740

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERae51.dir00\svchost.exe.mdmp 16325836412030260

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'83.##8.152.162':445
'83.##8.92.152':445
'83.##8.37.169':139
'83.##8.130.72':445
'83.##8.108.9':445
'83.##8.169.48':445
'83.##8.37.169':445
'83.##8.64.17':445
'83.##8.72.87':445
'83.##8.130.72':139
'83.##8.152.162':139
'83.##8.202.250':445
'83.##8.18.105':445
'83.##8.92.152':139
'83.##8.72.87':139
'83.##8.169.48':139
'83.##8.108.9':139
'83.##8.64.17':139
'83.##8.80.58':139
'83.##8.105.204':139
'83.##8.78.209':139
'83.##8.72.235':139
'83.##8.49.15':139
'83.##8.25.186':139
'83.##8.158.42':139
'83.##8.71.176':139
'83.##8.141.237':139
'83.##8.40.172':139
'83.##8.243.77':139
'83.##8.22.65':139
'83.#08.65.1':139
'83.##8.78.94':139
'83.##8.13.117':139
'83.##8.135.120':139
'83.##8.162.40':139
'83.##8.53.232':139
'83.##8.66.37':139
'83.##8.99.177':445
'83.##8.6.174':445
'83.##8.241.144':445
'83.##8.86.229':445
'83.##8.154.66':445
'83.##8.63.47':445
'83.##8.141.57':445
'83.##8.12.163':445
'83.##8.98.141':445
'83.##8.78.83':445
'83.##8.123.105':445
'83.##8.54.139':445
'83.##8.209.100':445
'83.##8.33.72':445
'83.##8.115.152':445
'83.##8.23.60':445
'83.##8.71.30':445
'83.##8.19.105':445
'83.##8.32.142':445
'83.##8.49.163':445
'83.##8.174.71':445
'83.##8.22.35':445
'83.##8.134.193':445
'83.##8.158.69':445
'83.##8.196.115':445
'83.##8.102.122':445
'83.##8.173.203':445
'83.##8.207.13':445
'83.##8.127.12':445
'83.##8.37.131':445
'83.##8.155.87':445
'83.##8.35.69':445
'83.##8.170.18':445
'83.##8.23.189':445
'83.##8.135.105':445
'83.##8.62.170':445
'83.##8.62.35':445
'83.##8.201.27':139
'83.##8.239.117':445
'83.##8.218.58':445
'83.##8.239.140':445
'83.##8.7.194':445
'83.##8.149.91':445
'83.##8.96.124':445
'83.##8.90.129':445
'83.##8.167.160':445
'83.##8.177.136':445
'83.##8.40.172':445
'83.##8.158.42':445
'83.##8.25.186':445
'83.##8.141.237':445
'83.##8.71.176':445
'83.##8.144.104':445
'83.##8.140.144':445
'83.##8.201.27':445
'83.##8.69.242':445
'83.#08.5.37':445
'83.##8.247.254':139
'83.##8.59.248':139
'83.##8.162.129':445
'83.##8.171.117':139
'83.##8.17.15':139
'83.##8.170.73':139
'83.##8.129.197':139
'83.##8.112.110':139
'83.##8.97.101':139
'83.##8.228.253':445
'83.##8.16.200':445
'83.##8.242.65':445
'83.##8.222.121':445
'83.#08.5.50':445
'83.##8.91.231':445
'83.##8.130.91':445
'83.#08.64.5':445
'83.##8.221.224':445
'83.##8.90.129':139
'83.#08.5.37':139
'83.##8.177.136':139
'83.##8.96.124':139
'83.##8.242.65':139
'83.##8.16.200':139
'83.#08.5.50':139
'83.##8.222.121':139
'83.##8.228.253':139
'83.##8.140.144':139
'83.##8.239.140':139
'83.##8.69.242':139
'83.##8.144.104':139
'83.##8.7.194':139
'83.##8.149.91':139
'83.##8.167.160':139
'83.##8.239.117':139
'83.##8.218.58':139
'83.#08.64.5':139
'83.##8.66.37':445
'83.##8.135.120':445
'83.##8.13.117':445
'83.##8.53.232':445
'83.##8.162.40':445
'83.##8.105.204':445
'83.##8.78.209':445
'83.##8.72.235':445
'83.##8.49.15':445
'83.##8.130.91':139
'83.##8.162.129':139
'83.##8.221.224':139
'83.##8.91.231':139
'83.##8.80.58':445
'83.##8.243.77':445
'83.##8.22.65':445
'83.#08.65.1':445
'83.##8.78.94':445
'83.##8.30.140':445
'83.##8.171.195':139
'83.##8.221.151':139
'83.##8.29.252':139
'83.##8.212.137':139
'83.##8.176.88':139
'83.##8.57.146':445
'83.##8.51.18':445
'83.##8.72.41':445
'83.##8.41.131':445
'83.##8.20.133':139
'83.##8.209.213':139
'83.##8.235.135':139
'83.##8.80.108':139
'83.##8.234.120':139
'83.##8.133.216':139
'83.##8.243.87':139
'83.##8.180.9':139
'83.##8.136.59':139
'83.##8.162.180':445
'83.#08.4.13':445
'83.##8.254.224':445
'83.##8.240.223':445
'83.##8.182.12':445
'83.##8.173.149':445
'83.##8.151.220':445
'83.##8.108.19':445
'83.##8.31.38':445
'83.##8.87.141':445
'83.##8.37.186':445
'83.##8.100.21':445
'83.##8.93.181':445
'83.##8.197.242':445
'83.##8.50.126':445
'83.##8.41.11':445
'83.##8.118.211':445
'83.##8.166.63':445
'83.##8.97.68':445
'83.##8.50.126':139
'83.##8.41.11':139
'83.##8.97.68':139
'83.##8.166.63':139
'83.##8.118.211':139
'83.##8.182.12':139
'83.#08.4.13':139
'83.##8.254.224':139
'83.##8.240.223':139
'83.##8.57.146':139
'83.##8.51.18':139
'83.##8.72.41':139
'83.##8.41.131':139
'83.##8.162.180':139
'83.##8.197.242':139
'83.##8.37.186':139
'83.##8.93.181':139
'83.##8.100.21':139
'83.##8.31.38':139
'83.##8.55.56':139
'83.##8.149.95':139
'83.##8.173.86':139
'83.##8.194.150':139
'83.##8.150.79':139
'83.##8.140.231':139
'83.##8.59.162':139
'83.##8.220.129':139
'83.##8.212.107':139
'83.##8.108.19':139
'83.##8.151.220':139
'83.##8.173.149':139
'83.##8.87.141':139
'83.##8.94.197':139
'83.##8.151.185':139
'83.##8.18.124':139
'83.##8.163.99':139
'83.##8.127.231':139
'83.##8.163.99':445
'83.##8.12.163':139
'83.##8.98.141':139
'83.##8.6.174':139
'83.##8.154.66':139
'83.##8.63.47':139
'83.##8.155.87':139
'83.##8.35.69':139
'83.##8.141.57':139
'83.##8.32.142':139
'83.##8.71.30':139
'83.##8.19.105':139
'83.##8.123.105':139
'83.##8.33.72':139
'83.##8.115.152':139
'83.##8.86.229':139
'83.##8.99.177':139
'83.##8.23.60':139
'83.##8.241.144':139
'83.##8.127.12':139
'83.##8.173.203':139
'83.##8.207.13':139
'83.##8.174.71':139
'83.##8.158.69':139
'83.##8.196.115':139
'83.##8.18.105':139
'83.##8.35.38':445
'83.##8.102.122':139
'83.##8.202.250':139
'83.##8.62.170':139
'83.##8.62.35':139
'83.##8.37.131':139
'83.##8.170.18':139
'83.##8.23.189':139
'83.##8.134.193':139
'83.##8.49.163':139
'83.##8.135.105':139
'83.##8.22.35':139
'83.##8.55.56':445
'83.##8.235.135':445
'83.##8.194.150':445
'83.##8.151.185':445
'83.##8.234.120':445
'83.##8.20.133':445
'83.##8.133.216':445
'83.##8.136.59':445
'83.##8.80.108':445
'83.##8.150.79':445
'83.##8.127.231':445
'83.##8.18.124':445
'83.##8.94.197':445
'83.##8.173.86':445
'83.##8.212.107':445
'83.##8.59.162':445
'83.##8.149.95':445
'83.##8.220.129':445
'83.##8.221.151':445
'83.##8.51.18':9988
'83.##8.162.180':9988
'83.##8.41.131':9988
'83.##8.57.146':9988
'83.##8.35.38':139
'83.##8.209.100':139
'83.##8.78.83':139
'83.##8.30.140':139
'83.##8.54.139':139
'83.##8.243.87':445
'83.##8.180.9':445
'83.##8.29.252':445
'83.##8.171.195':445
'83.##8.212.137':445
'83.##8.29.252':9988
'83.##8.209.213':9988
'83.##8.209.213':445
'83.##8.176.88':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial