Trojan.Starman.5794

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'21#.#5.235.46':445
'21#.#5.119.235':445
'21#.#5.177.75':445
'21#.#5.77.240':445
'21#.#5.217.77':445
'21#.#5.46.217':445
'21#.#5.11.103':139
'21#.#5.149.31':139
'21#.#5.79.243':139
'21#.#5.244.109':139
'21#.#5.55.244':139
'21#.#5.211.55':139
'21#.75.38.6':445
'21#.#5.169.114':445
'21#.#5.145.169':445
'21#.#5.160.34':445
'21#.#5.250.51':445
'21#.#5.21.193':445
'21#.#5.106.57':445
'21#.#5.218.247':445
'21#.#5.240.218':445
'21#.#5.108.145':445
'21#.75.25.2':445
'21#.#5.5.129':445
'21#.#5.78.95':139
'21#.75.8.5':139
'21#.#5.149.199':139
'21#.#5.174.243':139
'21#.#5.225.205':139
'21#.#5.227.43':139
'21#.#5.105.250':139
'21#.#5.244.109':445
'21#.#5.55.244':445
'21#.#5.211.55':445
'21#.#5.213.83':139
'21#.#5.74.232':139
'21#.#5.102.214':139
'21#.#5.79.119':139
'21#.#5.116.127':139
'21#.#5.16.144':139
'21#.#5.209.33':139
'21#.#5.4.112':139
'21#.#5.162.168':139
'21#.#5.196.104':139
'21#.#5.125.113':139
'21#.#5.87.36':139
'21#.#5.126.140':139
'21#.#5.31.219':139
'21#.#5.101.41':139
'21#.#5.69.218':445
'21#.#5.170.70':445
'21#.#5.34.65':445
'21#.#5.249.3':445
'21#.#5.37.249':445
'21#.#5.218.37':445
'21#.#5.220.63':139
'21#.#5.30.102':139
'21#.#5.47.111':139
'21#.#5.26.178':445
'21#.#5.198.121':445
'21#.#5.64.184':445
'21#.#5.33.126':445
'21#.#5.170.33':445
'21#.#5.18.30':445
'21#.#5.52.196':445
'21#.#5.114.117':445
'21#.#5.148.180':445
'21#.#5.167.17':445
'21#.#5.187.219':445
'21#.#5.249.134':445
'21#.#5.25.18':445
'21#.#5.203.104':445
'21#.#5.51.217':445
'21#.#5.77.63':139
'21#.#5.46.217':139
'21#.#5.235.46':139
'21#.#5.119.235':139
'21#.#5.240.218':139
'21#.#5.77.240':139
'21#.#5.217.77':139
'21#.#5.47.111':445
'21#.#5.77.63':445
'21#.#5.133.46':445
'21#.#5.177.75':139
'21#.#5.220.63':445
'21#.#5.30.102':445
'21#.#5.21.193':139
'21#.75.38.6':139
'21#.#5.169.114':139
'21#.#5.133.46':139
'21#.#5.160.34':139
'21#.#5.250.51':139
'21#.#5.5.129':139
'21#.#5.106.57':139
'21#.#5.218.247':139
'21#.#5.145.169':139
'21#.#5.108.145':139
'21#.75.25.2':139
'21#.#5.11.103':445
'21#.#5.15.241':445
'21#.#5.36.21':445
'21#.#5.107.190':445
'21#.#5.110.46':445
'21#.#5.3.110':445
'21#.#5.92.50':445
'21#.#5.242.75':139
'21#.#5.13.234':139
'21#.#5.135.244':139
'21#.#5.123.108':445
'21#.#5.29.88':445
'21#.#5.95.162':445
'21#.#5.21.138':445
'21#.#5.53.42':445
'21#.#5.69.29':445
'21#.#5.87.227':445
'21#.#5.154.236':445
'21#.#5.159.42':445
'21#.#5.252.236':445
'21#.#5.51.253':445
'21#.#5.46.52':445
'21#.#5.69.70':445
'21#.#5.173.141':445
'21#.#5.236.173':445
'21#.#5.20.16':139
'21#.#5.160.63':139
'21#.#5.89.58':139
'21#.#5.150.3':139
'21#.#5.43.243':139
'21#.#5.168.117':139
'21#.#5.113.206':139
'21#.#5.75.118':139
'21#.#5.184.86':139
'21#.#5.151.2':139
'21#.#5.33.96':139
'21#.#5.78.23':139
'21#.#5.75.237':139
'21#.#5.92.59':139
'21#.#5.129.117':139
'21#.#5.213.225':139
'21#.#5.56.233':139
'21#.#5.138.197':139
'21#.#5.189.115':139
'21#.#5.4.135':139
'21#.#5.141.194':139
'21#.#5.131.43':139
'21#.#5.28.192':139
'21#.#5.229.5':139
'21#.#5.41.228':139
'21#.#5.225.205':445
'21#.#5.227.43':445
'21#.#5.105.250':445
'21#.#5.196.104':445
'21#.#5.125.113':445
'21#.#5.87.36':445
'21#.#5.213.83':445
'21#.#5.74.232':445
'21#.#5.102.214':445
'21#.75.8.5':445
'21#.#5.149.199':445
'21#.#5.174.243':445
'21#.#5.209.33':445
'21#.#5.4.112':445
'21#.#5.162.168':445
'21#.#5.149.31':445
'21#.#5.79.243':445
'21#.#5.78.95':445
'21#.#5.126.140':445
'21#.#5.31.219':445
'21#.#5.101.41':445
'21#.#5.79.119':445
'21#.#5.116.127':445
'21#.#5.16.144':445
'21#.#5.165.194':139
'21#.#5.92.50':139
'21#.#5.15.241':139
'21#.#5.36.21':139
'21#.#5.46.52':139
'21#.#5.110.46':139
'21#.#5.3.110':139
'21#.#5.95.162':139
'21#.#5.165.194':445
'21#.#5.240.149':445
'21#.#5.107.190':139
'21#.#5.123.108':139
'21#.#5.29.88':139
'21#.#5.159.42':139
'21#.#5.21.138':139
'21#.#5.53.42':139
'21#.#5.240.149':139
'21#.#5.87.227':139
'21#.#5.154.236':139
'21#.#5.236.173':139
'21#.#5.252.236':139
'21#.#5.51.253':139
'21#.#5.69.29':139
'21#.#5.69.70':139
'21#.#5.173.141':139
'21#.#5.92.29':445
'21#.#5.207.91':445
'21#.#5.143.17':445
'21#.#5.193.119':445
'21#.#5.56.19':445
'21#.#5.28.252':445
'21#.#5.87.66':445
'21#.#5.204.234':445
'21#.#5.110.205':445
'21#.#5.58.192':445
'21#.#5.110.181':445
'21#.#5.20.19':445
'21#.#5.226.11':445
'21#.#5.27.190':445
'21#.#5.78.80':445
'21#.#5.181.122':139
'21#.#5.94.76':139
'21#.#5.30.97':445
'21#.#5.193.223':445
'21#.#5.22.174':445
'21#.#5.83.145':445
'21#.#5.114.230':445
'21#.#5.189.251':445
'21#.#5.16.25':445
'21#.#5.215.147':445
'21#.#5.131.194':445
'21#.#5.11.182':445
'21#.#5.90.59':445
'21#.#5.174.27':445
'21#.#5.222.96':445
'21#.#5.17.105':445
'21#.#5.150.150':445
'21#.#5.237.149':445
'21#.#5.44.234':445
'21#.#5.239.155':445
'21#.#5.50.88':445
'21#.#5.112.233':445
'21#.#5.195.83':445
'21#.#5.190.51':445
'21#.#5.40.115':445
'21#.#5.127.103':445
'21#.#5.86.127':445
'21#.#5.6.162':445
'21#.#5.209.94':445
'21#.#5.140.230':445
'21#.#5.242.123':445
'21#.#5.51.183':445
'21#.#5.25.201':445
'21#.#5.17.168':445
'21#.#5.143.17':139
'21#.#5.58.192':139
'21#.#5.110.181':139
'21#.#5.28.252':139
'21#.#5.92.29':139
'21#.#5.207.91':139
'21#.#5.110.205':139
'21#.#5.215.147':139
'21#.#5.127.103':139
'21#.#5.20.19':139
'21#.#5.87.66':139
'21#.#5.204.234':139
'21#.#5.193.223':139
'21#.#5.226.11':139
'21#.#5.189.251':139
'21#.#5.27.190':139
'21#.#5.30.97':139
'21#.#5.114.230':139
'21#.#5.83.145':139
'21#.#5.193.119':139
'21#.#5.56.19':139
'21#.#5.78.80':139
'21#.#5.16.25':139
'21#.#5.22.174':139
'21#.#5.86.127':139
'21#.#5.90.59':139
'21#.#5.239.155':139
'21#.#5.112.233':139
'21#.#5.17.105':139
'21#.#5.131.194':139
'21#.#5.11.182':139
'21#.#5.44.234':139
'21#.#5.26.86':139
'21#.#5.73.221':139
'21#.#5.50.88':139
'21#.#5.150.150':139
'21#.#5.237.149':139
'21#.#5.40.115':139
'21#.#5.51.183':139
'21#.#5.25.201':139
'21#.#5.6.162':139
'21#.#5.195.83':139
'21#.#5.190.51':139
'21#.#5.242.123':139
'21#.#5.174.27':139
'21#.#5.222.96':139
'21#.#5.17.168':139
'21#.#5.209.94':139
'21#.#5.140.230':139
'21#.#5.73.221':445
'21#.#5.113.156':139
'21#.#5.157.69':139
'21#.#5.238.156':139
'21#.#5.240.249':445
'21#.#5.208.209':445
'21#.#5.37.235':139
'21#.#5.114.117':139
'21#.#5.52.196':139
'21#.#5.148.180':139
'21#.#5.250.207':139
'21#.#5.141.253':139
'21#.#5.122.82':139
'21#.#5.79.86':445
'21#.#5.41.249':445
'21#.75.6.2':445
'21#.#5.36.213':445
'21#.#5.53.123':445
'21#.#5.161.189':445
'21#.#5.170.108':445
'21#.#5.186.106':445
'21#.#5.53.179':445
'21#.#5.197.217':445
'21#.#5.197.195':445
'21#.#5.167.253':445
'21#.#5.33.126':139
'21#.#5.198.121':139
'21#.#5.64.184':139
'21#.#5.37.235':445
'21#.#5.170.70':139
'21#.#5.34.65':139
'21#.#5.26.178':139
'21#.#5.250.207':445
'21#.#5.141.253':445
'21#.#5.122.82':445
'21#.#5.157.69':445
'21#.#5.113.156':445
'21#.#5.238.156':445
'21#.#5.203.104':139
'21#.#5.51.217':139
'21#.#5.167.17':139
'21#.#5.170.33':139
'21#.#5.18.30':139
'21#.#5.25.18':139
'21#.#5.37.249':139
'21#.#5.218.37':139
'21#.#5.69.218':139
'21#.#5.187.219':139
'21#.#5.249.134':139
'21#.#5.249.3':139
'21#.#5.51.183':9988
'21#.#5.140.230':9988
'21#.#5.193.196':139
'21#.#5.110.205':9988
'21#.#5.190.51':9988
'21#.#5.40.115':9988
'21#.#5.136.140':139
'21#.#5.136.212':139
'21#.#5.126.22':139
'21#.#5.97.35':139
'21#.#5.114.6':139
'21#.#5.82.93':139
'21#.#5.193.119':9988
'21#.#5.56.19':9988
'21#.#5.92.29':9988
'21#.#5.26.86':445
'21#.#5.181.122':445
'21#.#5.94.76':445
'21#.#5.110.181':9988
'21#.#5.20.19':9988
'21#.#5.87.66':9988
'21#.#5.207.91':9988
'21#.#5.143.17':9988
'21#.#5.58.192':9988
'21#.#5.105.178':139
'21#.#5.193.196':445
'21#.#5.97.35':445
'21#.#5.114.6':445
'21#.#5.53.179':139
'21#.#5.240.249':139
'21#.#5.208.209':139
'21#.#5.126.22':445
'21#.#5.105.178':445
'21#.#5.221.105':445
'21#.#5.82.93':445
'21#.#5.136.140':445
'21#.#5.136.212':445
'21#.#5.161.189':139
'21#.#5.79.86':139
'21#.#5.41.249':139
'21#.#5.221.105':139
'21#.#5.36.213':139
'21#.#5.53.123':139
'21#.#5.167.253':139
'21#.#5.170.108':139
'21#.#5.186.106':139
'21#.75.6.2':139
'21#.#5.197.217':139
'21#.#5.197.195':139

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial