Trojan.Starman.5092

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'14#.#15.163.228':139
'14#.#15.195.72':139
'14#.#15.83.201':139
'14#.#15.164.95':139
'14#.#15.159.117':139
'14#.#15.185.52':139
'14#.#15.29.120':139
'14#.215.4.6':139
'14#.#15.32.153':139
'14#.#15.103.32':139
'14#.#15.219.90':139
'14#.#15.111.37':139
'14#.#15.101.27':139
'14#.#15.0.213':139
'14#.#15.149.177':139
'14#.#15.91.197':139
'14#.#15.166.140':139
'14#.#15.190.27':139
'14#.#15.161.29':139
'14#.#15.160.186':139
'14#.#15.195.38':139
'14#.#15.183.213':139
'14#.#15.161.29':445
'14#.#15.166.140':445
'14#.#15.195.38':445
'14#.#15.101.27':445
'14#.#15.160.186':445
'14#.#15.159.117':445
'14#.#15.83.201':445
'14#.#15.164.95':445
'14#.#15.190.27':445
'14#.#15.219.90':445
'14#.#15.111.37':445
'14#.#15.104.71':139
'14#.#15.49.105':139
'14#.#15.102.169':139
'14#.#15.131.99':139
'14#.#15.229.78':139
'14#.#15.91.197':445
'14#.#15.0.213':445
'14#.#15.149.177':445
'14#.#15.254.79':139
'14#.#15.177.113':445
'14#.#15.164.32':139
'14#.#15.174.85':139
'14#.#15.236.94':139
'14#.#15.34.171':139
'14#.#15.102.201':139
'14#.#15.197.50':139
'14#.#15.191.199':445
'14#.#15.1.159':139
'14#.#15.116.207':139
'14#.#15.35.62':139
'14#.#15.141.123':139
'14#.#15.12.168':139
'14#.#15.223.190':139
'14#.#15.129.39':139
'14#.#15.153.160':139
'14#.#15.171.119':139
'14#.#15.119.192':139
'14#.#15.247.120':139
'14#.#15.137.251':139
'14#.#15.164.223':139
'14#.#15.148.207':139
'14#.#15.160.191':445
'14#.#15.164.32':445
'14#.#15.174.85':445
'14#.#15.236.94':445
'14#.#15.34.171':445
'14#.#15.102.201':445
'14#.#15.197.50':445
'14#.#15.177.113':139
'14#.#15.1.159':445
'14#.#15.116.207':445
'14#.#15.35.62':445
'14#.#15.141.123':445
'14#.#15.12.168':445
'14#.#15.223.190':445
'14#.#15.129.39':445
'14#.#15.153.160':445
'14#.#15.171.119':445
'14#.#15.119.192':445
'14#.#15.247.120':445
'14#.#15.137.251':445
'14#.#15.164.223':445
'14#.#15.148.207':445
'14#.#15.163.228':445
'14#.#15.25.109':139
'14#.#15.174.90':139
'14#.#15.182.189':445
'14#.#15.114.73':445
'14#.#15.114.150':445
'14#.#15.219.80':139
'14#.#15.210.219':139
'14#.#15.80.53':139
'14#.#15.28.144':139
'14#.#15.53.216':139
'14#.#15.201.31':445
'14#.#15.35.87':445
'14#.#15.232.226':445
'14#.#15.119.169':445
'14#.#15.85.190':445
'14#.#15.64.58':445
'14#.#15.11.151':445
'14#.#15.203.181':445
'14#.#15.220.163':445
'14#.#15.204.178':445
'14#.#15.163.242':445
'14#.#15.166.210':139
'14#.#15.250.123':139
'14#.#15.255.249':139
'14#.#15.123.253':139
'14#.#15.123.234':139
'14#.#15.205.134':139
'14#.#15.50.113':139
'14#.#15.166.186':139
'14#.#15.76.116':139
'14#.#15.19.122':139
'14#.#15.24.254':139
'14#.#15.18.144':139
'14#.#15.91.109':139
'14#.#15.26.178':139
'14#.#15.5.97':139
'14#.#15.233.157':139
'14#.#15.30.150':139
'14#.#15.231.165':139
'14#.#15.25.113':139
'14#.215.5.3':139
'14#.#15.24.118':139
'14#.#15.44.210':139
'14#.#15.86.217':139
'14#.#15.192.214':139
'14#.#15.33.91':139
'14#.#15.49.105':445
'14#.#15.254.79':445
'14#.#15.11.237':139
'14#.#15.230.99':139
'14#.#15.106.130':139
'14#.#15.118.184':139
'14#.#15.78.19':139
'14#.#15.104.71':445
'14#.215.4.6':445
'14#.#15.185.52':445
'14#.#15.103.32':445
'14#.#15.195.72':445
'14#.#15.32.153':445
'14#.#15.229.78':445
'14#.#15.102.169':445
'14#.#15.131.99':445
'14#.#15.29.120':445
'14#.#15.183.213':445
'14#.#15.85.190':139
'14#.#15.86.217':445
'14#.#15.192.214':445
'14#.#15.33.91':445
'14#.#15.114.150':139
'14#.#15.182.189':139
'14#.#15.11.237':445
'14#.#15.230.99':445
'14#.#15.106.130':445
'14#.#15.118.184':445
'14#.#15.78.19':445
'14#.#15.114.73':139
'14#.#15.232.226':139
'14#.#15.204.178':139
'14#.#15.35.87':139
'14#.#15.64.58':139
'14#.#15.119.169':139
'14#.#15.203.181':139
'14#.#15.201.31':139
'14#.#15.11.151':139
'14#.#15.163.242':139
'14#.#15.220.163':139
'14#.#15.18.242':445
'14#.#15.101.248':445
'14#.#15.84.72':445
'14#.#15.24.115':445
'14#.#15.135.137':445
'14#.#15.191.237':445
'14#.#15.26.192':445
'14#.#15.211.63':445
'14#.#15.164.253':445
'14#.#15.4.183':445
'14#.#15.49.106':445
'14#.#15.151.92':139
'14#.#15.145.112':139
'14#.#15.15.61':139
'14#.#15.123.54':139
'14#.#15.66.154':139
'14#.#15.130.220':445
'14#.#15.170.143':445
'14#.#15.146.78':139
'14#.#15.119.145':139
'14#.#15.137.119':139
'14#.#15.127.190':445
'14#.#15.131.5':445
'14#.#15.72.224':445
'14#.#15.201.188':445
'14#.#15.19.159':445
'14#.#15.5.20':445
'14#.#15.15.0':445
'14#.#15.36.56':445
'14#.#15.241.151':445
'14#.#15.105.201':445
'14#.#15.163.61':445
'14#.#15.15.144':445
'14#.#15.221.94':445
'14#.#15.9.174':445
'14#.#15.98.204':445
'14#.#15.174.78':445
'14#.#15.73.174':445
'14#.#15.191.86':445
'14#.#15.186.232':445
'14#.#15.92.79':445
'14#.#15.27.136':445
'14#.#15.247.117':445
'14#.#15.174.78':139
'14#.#15.73.174':139
'14#.#15.127.190':139
'14#.#15.191.237':139
'14#.#15.26.192':139
'14#.#15.27.136':139
'14#.#15.247.117':139
'14#.#15.9.174':139
'14#.#15.98.204':139
'14#.#15.221.94':139
'14#.#15.211.63':139
'14#.#15.84.72':139
'14#.#15.24.115':139
'14#.#15.170.143':139
'14#.#15.130.220':139
'14#.#15.101.248':139
'14#.#15.18.242':139
'14#.#15.4.183':139
'14#.#15.164.253':139
'14#.#15.135.137':139
'14#.#15.49.106':139
'14#.#15.92.79':139
'14#.#15.80.29':139
'14#.#15.144.58':139
'14#.#15.56.22':139
'14#.#15.15.0':139
'14#.#15.36.56':139
'14#.#15.179.163':139
'14#.#15.57.194':139
'14#.#15.244.69':139
'14#.#15.75.217':139
'14#.#15.86.46':139
'14#.#15.241.151':139
'14#.#15.19.159':139
'14#.#15.5.20':139
'14#.#15.15.144':139
'14#.#15.191.86':139
'14#.#15.186.232':139
'14#.#15.105.201':139
'14#.#15.163.61':139
'14#.#15.72.224':139
'14#.#15.201.188':139
'14#.#15.131.5':139
'14#.#15.56.22':445
'14#.#15.115.33':445
'14#.#15.81.72':445
'14#.#15.133.54':445
'14#.#15.11.143':139
'14#.#15.55.102':445
'14#.#15.252.109':445
'14#.#15.26.252':445
'14#.#15.110.132':445
'14#.#15.8.181':445
'14#.#15.124.156':445
'14#.#15.54.74':139
'14#.#15.230.47':139
'14#.#15.156.224':139
'14#.#15.99.189':139
'14#.#15.68.62':139
'14#.#15.96.128':139
'14#.#15.76.13':139
'14#.#15.190.172':139
'14#.#15.108.55':139
'14#.#15.126.15':139
'14#.#15.35.104':139
'14#.#15.58.165':445
'14#.#15.108.55':445
'14#.#15.76.13':445
'14#.#15.35.104':445
'14#.#15.156.224':445
'14#.#15.126.15':445
'14#.#15.191.199':139
'14#.#15.160.191':139
'14#.#15.11.143':445
'14#.#15.190.172':445
'14#.#15.54.74':445
'14#.#15.230.47':445
'14#.#15.122.6':445
'14#.#15.94.121':445
'14#.#15.23.51':445
'14#.#15.0.101':445
'14#.#15.140.110':445
'14#.#15.96.128':445
'14#.#15.99.189':445
'14#.#15.68.62':445
'14#.#15.140.219':445
'14#.#15.101.3':445
'14#.#15.146.78':445
'14#.#15.18.242':9988
'14#.#15.119.145':445
'14#.#15.145.112':445
'14#.#15.137.119':445
'14#.#15.98.204':9988
'14#.#15.15.144':9988
'14#.#15.211.63':9988
'14#.#15.130.220':9988
'14#.#15.4.183':9988
'14#.#15.151.92':445
'14#.#15.86.46':445
'14#.#15.244.69':445
'14#.#15.75.217':445
'14#.#15.80.29':445
'14#.#15.144.58':445
'14#.#15.66.154':445
'14#.#15.15.61':445
'14#.#15.123.54':445
'14#.#15.179.163':445
'14#.#15.57.194':445
'14#.#15.131.5':9988
'14#.#15.0.101':139
'14#.#15.140.110':139
'14#.#15.58.165':139
'14#.#15.252.109':139
'14#.#15.26.252':139
'14#.#15.140.219':139
'14#.#15.101.3':139
'14#.#15.94.121':139
'14#.#15.23.51':139
'14#.#15.122.6':139
'14#.#15.110.132':139
'14#.#15.80.29':9988
'14#.#15.55.102':139
'14#.#15.56.22':9988
'14#.#15.163.61':9988
'14#.#15.15.0':9988
'14#.#15.8.181':139
'14#.#15.124.156':139
'14#.#15.81.72':139
'14#.#15.133.54':139
'14#.#15.115.33':139

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial