Trojan.Starman.4964

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Network activity:

Connects to:

'20#.#14.86.246':445
'20#.#14.138.246':445
'20#.#14.171.243':445
'20#.#14.81.13':445
'20#.#14.48.40':445
'20#.#14.50.130':445
'20#.#14.105.121':445
'20#.#14.131.41':445
'20#.#14.16.68':445
'20#.#14.204.134':445
'20#.#14.136.40':445
'20#.#14.84.172':445
'20#.#14.8.121':445
'20#.#14.209.224':445
'20#.#14.148.115':445
'20#.#14.104.220':445
'20#.#14.26.94':445
'20#.#14.32.209':445
'20#.#14.87.237':445
'20#.#14.79.1':445
'20#.#14.24.133':445
'20#.#14.39.248':445
'20#.#14.6.187':445
'20#.#14.80.75':445
'20#.#14.206.33':445
'20#.#14.183.203':445
'20#.#14.195.7':445
'20#.#14.10.152':445
'20#.#14.54.152':445
'20#.#14.62.107':445
'20#.#14.108.112':445
'20#.#14.130.195':445
'20#.#14.107.130':445
'20#.#14.24.133':139
'20#.#14.32.209':139
'20#.#14.108.112':139
'20#.#14.79.1':139
'20#.#14.6.187':139
'20#.#14.206.33':139
'20#.#14.87.237':139
'20#.#14.80.75':139
'20#.#14.54.152':139
'20#.#14.183.203':139
'20#.#14.26.94':139
'20#.#14.10.152':139
'20#.#14.107.130':139
'20#.#14.62.107':139
'20#.#14.195.7':139
'20#.#14.130.195':139
'20#.#14.39.248':139
'20#.#14.74.63':139
'20#.#14.86.158':139
'20#.#14.134.103':139
'20#.#14.4.108':139
'20#.#14.205.67':445
'20#.#14.163.17':445
'20#.#14.165.153':139
'20#.#14.67.79':445
'20#.#14.41.9':139
'20#.#14.15.56':139
'20#.#14.237.173':139
'20#.#14.227.252':139
'20#.#14.109.32':139
'20#.#14.176.45':139
'20#.#14.25.236':139
'20#.#14.236.125':139
'20#.#14.205.176':139
'20#.#14.110.186':139
'20#.#14.14.145':139
'20#.#14.27.31':139
'20#.#14.5.10':139
'20#.#14.48.244':139
'20#.#14.111.38':139
'20#.#14.172.204':139
'20#.#14.132.106':139
'20#.#14.217.237':139
'20#.#14.100.188':139
'20#.#14.56.57':139
'20#.#14.168.252':139
'20#.#14.18.54':139
'20#.#14.113.182':139
'20#.#14.252.150':139
'20#.#14.73.90':139
'20#.#14.6.171':139
'20#.#14.130.164':139
'20#.#14.10.225':139
'20#.#14.98.202':139
'20#.#14.62.166':139
'20#.#14.248.155':139
'20#.#14.90.193':139
'20#.#14.73.65':139
'20#.#14.161.38':139
'20#.#14.58.102':139
'20#.#14.7.74':139
'20#.#14.52.97':139
'20#.#14.169.42':139
'20#.#14.31.32':139
'20#.#14.51.58':139
'20#.#14.13.101':139
'20#.#14.176.45':445
'20#.#14.134.103':445
'20#.#14.86.158':445
'20#.#14.74.63':445
'20#.#14.188.84':139
'20#.#14.24.148':445
'20#.#14.165.153':445
'20#.#14.24.148':139
'20#.#14.236.125':445
'20#.#14.25.236':445
'20#.#14.237.173':445
'20#.#14.227.252':445
'20#.#14.41.9':445
'20#.#14.4.108':445
'20#.#14.109.32':445
'20#.#14.15.56':445
'20#.#14.188.84':445
'20#.#14.194.195':139
'20#.#14.250.46':139
'20#.#14.140.228':139
'20#.#14.111.196':139
'20#.#14.44.190':139
'20#.#14.110.244':139
'20#.#14.27.102':139
'20#.#14.42.169':139
'20#.#14.235.111':139
'20#.#14.108.243':139
'20#.#14.160.188':139
'20#.#14.62.245':139
'20#.#14.247.198':139
'20#.#14.87.23':139
'20#.#14.194.108':139
'20#.#14.20.40':139
'20#.#14.48.40':139
'20#.#14.188.201':139
'20#.#14.190.150':139
'20#.#14.209.82':139
'20#.#14.201.209':139
'20#.#14.117.236':139
'20#.#14.119.117':139
'20#.#14.20.19':139
'20#.#14.99.204':139
'20#.#14.2.192':139
'20#.#14.97.181':139
'20#.#14.98.137':139
'20#.#14.175.159':139
'20#.#14.235.121':139
'20#.#14.50.140':139
'20#.#14.221.96':139
'20#.#14.121.220':139
'20#.#14.42.232':139
'20#.#14.26.79':445
'20#.#14.195.216':445
'20#.#14.216.191':445
'20#.#14.226.194':445
'20#.#14.125.47':445
'20#.#14.57.155':445
'20#.#14.199.65':445
'20#.#14.127.124':445
'20#.#14.13.34':445
'20#.#14.234.42':445
'20#.#14.33.104':139
'20#.#14.40.91':445
'20#.#14.10.47':445
'20#.#14.252.49':445
'20#.#14.248.197':445
'20#.#14.160.144':445
'20#.#14.195.216':139
'20#.#14.199.65':139
'20#.#14.226.194':139
'20#.#14.26.79':139
'20#.#14.57.155':139
'20#.#14.87.191':139
'20#.#14.127.124':139
'20#.#14.125.47':139
'20#.#14.234.42':139
'20#.#14.248.197':139
'20#.#14.40.91':139
'20#.#14.13.34':139
'20#.#14.252.49':139
'20#.#14.216.191':139
'20#.#14.160.144':139
'20#.#14.10.47':139
'20#.#14.201.51':139
'20#.#14.27.61':139
'20#.#14.85.218':139
'20#.#14.56.164':139
'20#.#14.226.155':139
'20#.#14.223.235':139
'20#.#14.142.15':139
'20#.#14.95.41':139
'20#.#14.193.148':139
'20#.#14.78.216':139
'20#.#14.226.240':139
'20#.#14.103.250':139
'20#.#14.143.71':139
'20#.#14.86.132':139
'20#.#14.190.46':139
'20#.#14.239.233':139
'20#.#14.174.75':139
'20#.#14.27.61':9988
'20#.#14.193.148':9988
'20#.#14.226.240':9988
'20#.#14.143.71':9988
'20#.#14.33.104':9988
'20#.#14.67.79':139
'20#.#14.235.121':9988
'20#.#14.50.140':9988
'20#.#14.33.104':445
'20#.#14.125.47':9988
'20#.#14.119.117':445
'20#.#14.42.232':445
'20#.#14.226.194':9988
'20#.#14.57.155':9988
'20#.#14.252.49':9988
'20#.#14.160.144':9988
'20#.#14.205.67':139
'20#.#14.171.243':139
'20#.#14.86.246':139
'20#.#14.209.224':139
'20#.#14.81.13':139
'20#.#14.131.41':139
'20#.#14.50.130':139
'20#.#14.138.246':139
'20#.#14.105.121':139
'20#.#14.84.172':139
'20#.#14.16.68':139
'20#.#14.163.17':139
'20#.#14.136.40':139
'20#.#14.104.220':139
'20#.#14.8.121':139
'20#.#14.204.134':139
'20#.#14.148.115':139
'20#.#14.56.164':445
'20#.#14.226.155':445
'20#.#14.86.132':445
'20#.#14.190.46':445
'20#.#14.95.41':445
'20#.#14.193.148':445
'20#.#14.27.61':445
'20#.#14.85.218':445
'20#.#14.103.250':445
'20#.#14.143.71':445
'20#.#14.87.191':445
'20#.#14.201.51':445
'20#.#14.239.233':445
'20#.#14.174.75':445
'20#.#14.78.216':445
'20#.#14.226.240':445
'20#.#14.223.235':445
'20#.#14.201.209':445
'20#.#14.188.201':445
'20#.#14.50.140':445
'20#.#14.209.82':445
'20#.#14.99.204':445
'20#.#14.117.236':445
'20#.#14.190.150':445
'20#.#14.20.19':445
'20#.#14.175.159':445
'20#.#14.2.192':445
'20#.#14.142.15':445
'20#.#14.98.137':445
'20#.#14.121.220':445
'20#.#14.235.121':445
'20#.#14.97.181':445
'20#.#14.221.96':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial