Trojan.Starman.4988

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'20#.#25.28.250':139
'20#.125.5.5':139
'20#.#25.34.230':139
'20#.#25.109.115':139
'20#.#25.75.86':139
'20#.#25.167.245':139
'20#.#25.74.13':139
'20#.#25.24.164':139
'20#.#25.95.196':139
'20#.#25.115.236':139
'20#.#25.238.51':139
'20#.#25.216.174':139
'20#.#25.249.238':139
'20#.#25.39.140':139
'20#.#25.14.56':139
'20#.#25.18.141':139
'20#.#25.62.194':139
'20#.#25.43.63':139
'20#.#25.170.203':139
'20#.#25.13.104':139
'20#.#25.67.27':139
'20#.#25.62.194':445
'20#.#25.43.63':445
'20#.#25.170.203':445
'20#.#25.13.104':445
'20#.#25.67.27':445
'20#.#25.28.250':445
'20#.#25.34.230':445
'20#.#25.75.86':445
'20#.#25.238.51':445
'20#.#25.109.115':445
'20#.#25.249.238':445
'20#.#25.60.97':139
'20#.#25.244.5':445
'20#.#25.35.39':139
'20#.#25.52.205':139
'20#.#25.68.211':139
'20#.#25.39.140':445
'20#.#25.216.174':445
'20#.#25.18.141':445
'20#.#25.108.47':445
'20#.#25.14.56':445
'20#.#25.213.194':139
'20#.#25.119.77':139
'20#.#25.195.71':139
'20#.#25.126.159':139
'20#.#25.72.126':139
'20#.#25.35.46':445
'20#.#25.35.196':445
'20#.#25.108.161':445
'20#.#25.56.200':445
'20#.#25.38.77':445
'20#.#25.159.54':139
'20#.#25.135.245':139
'20#.#25.15.30':139
'20#.#25.65.124':139
'20#.#25.39.112':139
'20#.#25.109.3':139
'20#.#25.204.102':139
'20#.#25.182.178':139
'20#.#25.102.30':139
'20#.#25.207.165':139
'20#.#25.216.95':139
'20#.#25.126.159':445
'20#.#25.72.126':445
'20#.#25.159.54':445
'20#.#25.204.102':445
'20#.#25.182.178':445
'20#.#25.244.5':139
'20#.#25.108.47':139
'20#.#25.119.77':445
'20#.#25.195.71':445
'20#.#25.213.194':445
'20#.#25.102.30':445
'20#.#25.39.112':445
'20#.#25.109.3':445
'20#.#25.200.76':445
'20#.#25.144.193':445
'20#.#25.237.144':445
'20#.#25.207.165':445
'20#.#25.216.95':445
'20#.#25.15.30':445
'20#.#25.65.124':445
'20#.#25.135.245':445
'20#.125.5.5':445
'20#.#25.143.49':445
'20#.#25.48.29':139
'20#.#25.97.109':445
'20#.#25.7.166':445
'20#.#25.136.46':445
'20#.#25.29.194':139
'20#.#25.9.238':139
'20#.#25.98.179':139
'20#.#25.141.156':139
'20#.#25.97.56':139
'20#.#25.110.162':445
'20#.#25.74.181':445
'20#.#25.173.136':445
'20#.#25.83.120':445
'20#.#25.193.69':445
'20#.#25.92.79':445
'20#.#25.248.212':445
'20#.#25.161.248':445
'20#.#25.151.231':445
'20#.#25.226.217':445
'20#.#25.176.62':445
'20#.#25.161.80':139
'20#.#25.12.161':139
'20#.#25.78.101':139
'20#.#25.130.216':139
'20#.#25.154.205':139
'20#.#25.211.237':139
'20#.#25.134.134':139
'20#.#25.238.16':139
'20#.#25.221.198':139
'20#.#25.17.56':139
'20#.#25.140.246':139
'20#.#25.113.27':139
'20#.#25.172.199':139
'20#.#25.75.104':139
'20#.#25.86.165':139
'20#.#25.52.3':139
'20#.#25.65.187':139
'20#.#25.12.160':139
'20#.#25.176.156':139
'20#.#25.208.172':139
'20#.#25.159.237':139
'20#.#25.113.54':139
'20#.#25.167.112':139
'20#.#25.54.139':139
'20#.#25.246.45':139
'20#.#25.7.23':139
'20#.#25.92.79':139
'20#.#25.83.120':139
'20#.#25.193.69':139
'20#.#25.197.167':139
'20#.#25.0.87':139
'20#.#25.39.86':139
'20#.#25.167.245':445
'20#.#25.74.13':445
'20#.#25.24.164':445
'20#.#25.95.196':445
'20#.#25.115.236':445
'20#.#25.60.97':445
'20#.#25.54.32':139
'20#.#25.35.39':445
'20#.#25.52.205':445
'20#.#25.68.211':445
'20#.#25.246.45':445
'20#.#25.7.23':445
'20#.#25.39.86':445
'20#.#25.143.49':139
'20#.#25.54.32':445
'20#.#25.197.167':445
'20#.#25.0.87':445
'20#.#25.167.112':445
'20#.#25.54.139':445
'20#.#25.113.54':445
'20#.#25.97.109':139
'20#.#25.176.62':139
'20#.#25.151.231':139
'20#.#25.226.217':139
'20#.#25.74.181':139
'20#.#25.173.136':139
'20#.#25.7.166':139
'20#.#25.136.46':139
'20#.#25.110.162':139
'20#.#25.248.212':139
'20#.#25.161.248':139
'20#.#25.200.76':139
'20#.#25.118.89':445
'20#.#25.136.21':445
'20#.#25.21.187':445
'20#.#25.59.25':445
'20#.#25.40.203':445
'20#.#25.28.18':445
'20#.#25.187.193':445
'20#.#25.223.53':445
'20#.#25.73.136':445
'20#.#25.88.74':445
'20#.#25.155.207':445
'20#.#25.216.229':139
'20#.#25.199.96':139
'20#.#25.195.227':139
'20#.#25.228.92':139
'20#.#25.55.166':139
'20#.#25.27.187':139
'20#.#25.18.179':445
'20#.#25.48.251':139
'20#.#25.183.91':139
'20#.#25.18.236':139
'20#.#25.242.34':445
'20#.#25.21.238':445
'20#.#25.180.247':445
'20#.#25.121.62':445
'20#.#25.241.168':445
'20#.#25.158.30':445
'20#.#25.206.103':445
'20#.#25.214.199':445
'20#.#25.147.197':445
'20#.#25.199.29':445
'20#.#25.176.25':445
'20#.#25.193.129':445
'20#.#25.99.205':445
'20#.#25.58.223':445
'20#.#25.152.45':445
'20#.#25.175.11':445
'20#.#25.72.223':445
'20#.#25.116.113':445
'20#.#25.32.67':445
'20#.#25.197.84':445
'20#.#25.111.32':445
'20#.#25.58.223':139
'20#.#25.193.129':139
'20#.#25.175.11':139
'20#.#25.187.193':139
'20#.#25.152.45':139
'20#.#25.32.67':139
'20#.#25.72.223':139
'20#.#25.111.32':139
'20#.#25.99.205':139
'20#.#25.197.84':139
'20#.#25.28.18':139
'20#.#25.40.203':139
'20#.#25.21.187':139
'20#.#25.59.25':139
'20#.#25.18.179':139
'20#.#25.155.207':139
'20#.#25.88.74':139
'20#.#25.223.53':139
'20#.#25.73.136':139
'20#.#25.118.89':139
'20#.#25.136.21':139
'20#.#25.88.168':139
'20#.#25.3.62':139
'20#.#25.198.239':139
'20#.#25.206.103':139
'20#.#25.165.221':139
'20#.#25.63.207':139
'20#.#25.177.71':139
'20#.#25.59.5':139
'20#.#25.42.156':139
'20#.#25.18.177':139
'20#.#25.158.30':139
'20#.#25.241.168':139
'20#.#25.180.247':139
'20#.#25.121.62':139
'20#.#25.116.113':139
'20#.#25.176.25':139
'20#.#25.199.29':139
'20#.#25.214.199':139
'20#.#25.147.197':139
'20#.#25.242.34':139
'20#.#25.21.238':139
'20#.#25.165.221':445
'20#.#25.149.149':445
'20#.#25.153.216':445
'20#.#25.59.192':445
'20#.#25.212.189':139
'20#.#25.7.78':445
'20#.#25.197.182':445
'20#.#25.34.151':445
'20#.#25.147.201':445
'20#.#25.24.227':445
'20#.#25.196.253':445
'20#.#25.212.66':139
'20#.#25.249.89':139
'20#.#25.54.213':139
'20#.#25.7.183':139
'20#.#25.139.94':139
'20#.#25.125.215':139
'20#.#25.200.131':139
'20#.#25.173.200':139
'20#.#25.132.32':139
'20#.#25.250.100':139
'20#.#25.31.250':139
'20#.#25.56.200':139
'20#.#25.38.77':139
'20#.#25.212.189':445
'20#.#25.173.200':445
'20#.#25.212.66':445
'20#.#25.144.193':139
'20#.#25.237.144':139
'20#.#25.35.196':139
'20#.#25.108.161':139
'20#.#25.35.46':139
'20#.#25.200.131':445
'20#.#25.125.215':445
'20#.#25.7.183':445
'20#.#25.139.94':445
'20#.#25.63.142':445
'20#.#25.130.63':445
'20#.#25.31.250':445
'20#.#25.132.32':445
'20#.#25.250.100':445
'20#.#25.249.89':445
'20#.#25.54.213':445
'20#.#25.18.236':445
'20#.#25.48.251':445
'20#.#25.183.91':445
'20#.#25.216.229':445
'20#.#25.199.96':445
'20#.#25.73.136':9988
'20#.#25.175.11':9988
'20#.#25.88.74':9988
'20#.#25.27.187':445
'20#.#25.40.203':9988
'20#.#25.195.227':445
'20#.#25.42.156':445
'20#.#25.18.177':445
'20#.#25.3.62':445
'20#.#25.198.239':445
'20#.#25.88.168':445
'20#.#25.228.92':445
'20#.#25.55.166':445
'20#.#25.177.71':445
'20#.#25.59.5':445
'20#.#25.63.207':445
'20#.#25.24.227':139
'20#.#25.196.253':139
'20#.#25.153.216':139
'20#.#25.59.192':139
'20#.#25.149.149':139
'20#.#25.63.142':139
'20#.#25.130.63':139
'20#.#25.34.151':139
'20#.#25.147.201':139
'20#.#25.197.182':139
'20#.#25.7.78':139
'20#.#25.197.84':9988
'20#.#25.111.32':9988
'20#.#25.99.205':9988
'20#.#25.58.223':9988
'20#.#25.193.129':9988
'20#.#25.147.197':9988
'20#.#25.206.103':9988
'20#.#25.176.25':9988
'20#.#25.32.67':9988
'20#.#25.72.223':9988

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial