Trojan.Starman.6134

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'20#.#1.11.153':139
'20#.#1.14.105':139
'20#.#1.82.95':139
'20#.#1.93.91':139
'20#.#1.139.146':139
'20#.#1.151.229':139
'20#.#1.93.89':139
'20#.#1.107.248':139
'20#.#1.176.191':139
'20#.#1.204.60':139
'20#.#1.116.34':139
'20#.#1.191.122':139
'20#.#1.39.191':139
'20#.#1.90.119':139
'20#.#1.71.84':139
'20#.#1.126.151':139
'20#.#1.171.60':139
'20#.#1.114.171':139
'20#.#1.148.116':139
'20#.#1.94.23':139
'20#.#1.71.158':139
'20#.#1.39.191':445
'20#.#1.94.23':445
'20#.#1.191.122':445
'20#.#1.126.151':445
'20#.#1.90.119':445
'20#.#1.114.171':445
'20#.#1.116.34':445
'20#.#1.171.60':445
'20#.#1.71.158':445
'20#.#1.148.116':445
'20#.#1.71.84':445
'20#.#1.96.58':139
'20#.#1.76.58':445
'20#.#1.153.125':139
'20#.#1.225.90':139
'20#.#1.39.44':139
'20#.#1.55.11':445
'20#.#1.205.115':445
'20#.#1.103.145':445
'20#.41.3.76':445
'20#.#1.145.2':445
'20#.#1.205.115':139
'20#.#1.21.19':139
'20#.#1.132.109':139
'20#.#1.34.197':139
'20#.#1.106.205':139
'20#.#1.167.40':139
'20#.#1.166.219':445
'20#.#1.23.204':445
'20#.#1.163.14':445
'20#.#1.58.101':139
'20#.#1.237.168':445
'20#.#1.156.225':139
'20#.#1.159.246':139
'20#.#1.10.177':139
'20#.#1.255.22':139
'20#.#1.165.148':139
'20#.#1.23.204':139
'20#.#1.26.96':139
'20#.#1.215.87':139
'20#.#1.33.183':139
'20#.#1.9.246':139
'20#.#1.3.131':139
'20#.#1.132.109':445
'20#.#1.58.101':445
'20#.#1.21.19':445
'20#.#1.167.40':445
'20#.#1.34.197':445
'20#.#1.103.145':139
'20#.#1.55.11':139
'20#.#1.145.2':139
'20#.#1.76.58':139
'20#.41.3.76':139
'20#.#1.106.205':445
'20#.#1.255.22':445
'20#.#1.9.246':445
'20#.#1.165.148':445
'20#.#1.10.177':445
'20#.#1.159.246':445
'20#.#1.215.87':445
'20#.#1.156.225':445
'20#.#1.26.96':445
'20#.#1.3.131':445
'20#.#1.33.183':445
'20#.#1.133.161':139
'20#.#1.146.183':139
'20#.#1.159.159':139
'20#.#1.80.20':139
'20#.#1.47.78':139
'20#.#1.23.241':139
'20#.#1.132.252':139
'20#.#1.36.202':139
'20#.41.4.36':139
'20#.#1.251.12':139
'20#.#1.196.155':445
'20#.#1.238.10':445
'20#.#1.172.92':445
'20#.#1.67.77':445
'20#.#1.132.130':445
'20#.#1.131.132':445
'20#.#1.72.124':445
'20#.#1.162.105':445
'20#.#1.22.117':445
'20#.#1.255.207':445
'20#.#1.233.37':445
'20#.#1.64.40':139
'20#.#1.39.198':139
'20#.#1.81.218':139
'20#.#1.85.134':139
'20#.#1.64.245':139
'20#.#1.72.42':139
'20#.#1.52.75':139
'20#.#1.149.147':139
'20#.#1.10.254':139
'20#.#1.147.13':139
'20#.#1.19.66':139
'20#.#1.126.184':139
'20#.#1.100.30':139
'20#.#1.37.38':139
'20#.#1.249.127':139
'20#.41.2.10':139
'20#.#1.113.130':139
'20#.#1.100.6':139
'20#.#1.149.131':139
'20#.#1.72.94':139
'20#.#1.136.181':139
'20#.#1.130.2':445
'20#.#1.113.147':139
'20#.#1.217.141':139
'20#.#1.96.58':445
'20#.#1.39.44':445
'20#.#1.153.125':445
'20#.#1.227.159':139
'20#.#1.219.2':139
'20#.#1.175.240':139
'20#.41.7.44':139
'20#.#1.226.220':139
'20#.#1.225.90':445
'20#.#1.11.153':445
'20#.#1.14.105':445
'20#.#1.82.95':445
'20#.#1.93.91':445
'20#.#1.139.146':445
'20#.#1.151.229':445
'20#.#1.93.89':445
'20#.#1.107.248':445
'20#.#1.176.191':445
'20#.#1.204.60':445
'20#.#1.217.141':445
'20#.41.7.44':445
'20#.#1.113.147':445
'20#.#1.162.105':139
'20#.#1.196.155':139
'20#.#1.219.2':445
'20#.#1.176.246':445
'20#.#1.227.159':445
'20#.#1.226.220':445
'20#.#1.175.240':445
'20#.#1.72.124':139
'20#.#1.131.132':139
'20#.#1.67.77':139
'20#.#1.132.130':139
'20#.#1.176.246':139
'20#.#1.130.2':139
'20#.#1.233.37':139
'20#.#1.22.117':139
'20#.#1.255.207':139
'20#.#1.238.10':139
'20#.#1.172.92':139
'20#.#1.166.219':139
'20#.#1.234.4':445
'20#.#1.127.19':445
'20#.#1.166.65':445
'20#.#1.214.143':445
'20#.#1.65.196':445
'20#.#1.26.35':445
'20#.#1.35.32':445
'20#.#1.34.250':445
'20#.#1.67.176':445
'20#.#1.117.194':445
'20#.#1.83.208':445
'20#.#1.85.29':139
'20#.#1.17.83':139
'20#.#1.29.17':139
'20#.#1.212.67':139
'20#.#1.229.149':139
'20#.#1.134.242':445
'20#.#1.193.177':445
'20#.#1.11.111':139
'20#.#1.170.112':139
'20#.#1.124.159':139
'20#.#1.192.70':445
'20#.#1.68.106':445
'20#.#1.30.121':445
'20#.#1.166.238':445
'20#.#1.163.243':445
'20#.#1.48.176':445
'20#.#1.146.109':445
'20#.#1.32.151':445
'20#.#1.228.207':445
'20#.#1.217.6':445
'20#.#1.212.251':445
'20#.#1.38.137':445
'20#.#1.27.39':445
'20#.#1.136.149':445
'20#.#1.232.60':445
'20#.#1.156.130':445
'20#.#1.106.12':445
'20#.#1.81.128':445
'20#.#1.25.107':445
'20#.#1.16.150':445
'20#.#1.64.132':445
'20#.41.3.34':139
'20#.#1.156.130':139
'20#.#1.136.149':139
'20#.#1.232.60':139
'20#.#1.26.35':139
'20#.#1.35.32':139
'20#.#1.64.132':139
'20#.#1.25.107':139
'20#.#1.16.150':139
'20#.#1.38.137':139
'20#.#1.27.39':139
'20#.#1.34.250':139
'20#.#1.214.143':139
'20#.#1.65.196':139
'20#.#1.83.208':139
'20#.#1.193.177':139
'20#.#1.134.242':139
'20#.#1.67.176':139
'20#.#1.117.194':139
'20#.#1.127.19':139
'20#.#1.166.65':139
'20#.#1.234.4':139
'20#.#1.79.182':139
'20#.#1.147.96':139
'20#.#1.99.146':139
'20#.#1.48.176':139
'20#.#1.146.109':139
'20#.#1.228.253':139
'20#.#1.68.138':139
'20#.#1.94.220':139
'20#.#1.137.224':139
'20#.#1.220.157':139
'20#.#1.32.151':139
'20#.#1.166.238':139
'20#.#1.163.243':139
'20#.#1.212.251':139
'20#.#1.106.12':139
'20#.#1.81.128':139
'20#.#1.228.207':139
'20#.#1.217.6':139
'20#.#1.68.106':139
'20#.#1.30.121':139
'20#.#1.192.70':139
'20#.#1.121.231':445
'20#.#1.172.16':445
'20#.#1.29.161':445
'20#.#1.217.237':139
'20#.#1.26.102':139
'20#.#1.141.143':445
'20#.#1.232.47':445
'20#.#1.66.63':445
'20#.#1.123.210':445
'20#.#1.141.239':445
'20#.#1.15.217':139
'20#.#1.192.207':139
'20#.#1.54.207':139
'20#.#1.16.189':139
'20#.#1.11.64':139
'20#.#1.160.11':139
'20#.#1.116.185':139
'20#.41.9.2':139
'20#.#1.185.11':139
'20#.#1.239.111':139
'20#.#1.12.68':139
'20#.#1.116.185':445
'20#.41.9.2':445
'20#.#1.185.11':445
'20#.#1.239.111':445
'20#.#1.12.68':445
'20#.#1.237.168':139
'20#.#1.163.14':139
'20#.#1.26.102':445
'20#.#1.15.217':445
'20#.#1.217.237':445
'20#.#1.54.207':445
'20#.#1.8.253':445
'20#.#1.25.29':445
'20#.#1.90.225':445
'20#.#1.3.115':445
'20#.#1.139.3':445
'20#.#1.16.189':445
'20#.#1.192.207':445
'20#.#1.160.11':445
'20#.#1.64.129':445
'20#.#1.11.64':445
'20#.#1.64.129':139
'20#.#1.170.112':445
'20#.#1.124.159':445
'20#.#1.17.83':445
'20#.#1.29.17':445
'20#.#1.85.29':445
'20#.#1.166.65':9988
'20#.#1.34.250':9988
'20#.#1.134.242':9988
'20#.#1.11.111':445
'20#.#1.65.196':9988
'20#.#1.229.149':445
'20#.#1.137.224':445
'20#.#1.220.157':445
'20#.#1.147.96':445
'20#.#1.99.146':445
'20#.#1.79.182':445
'20#.41.3.34':445
'20#.#1.212.67':445
'20#.#1.68.138':445
'20#.#1.94.220':445
'20#.#1.228.253':445
'20#.#1.141.143':139
'20#.#1.232.47':139
'20#.#1.66.63':139
'20#.#1.123.210':139
'20#.#1.141.239':139
'20#.#1.8.253':139
'20#.#1.25.29':139
'20#.#1.90.225':139
'20#.#1.3.115':139
'20#.#1.139.3':139
'20#.#1.172.16':139
'20#.#1.136.149':9988
'20#.#1.81.128':9988
'20#.#1.232.60':9988
'20#.#1.26.35':9988
'20#.#1.35.32':9988
'20#.#1.29.161':139
'20#.#1.121.231':139
'20#.#1.228.207':9988
'20#.#1.166.238':9988
'20#.#1.192.70':9988

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial