Trojan.Starman.6690

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'69.##0.116.140':139
'69.##0.153.184':139
'69.##0.235.247':139
'69.##0.25.42':139
'69.##0.20.229':139
'69.##0.127.108':139
'69.##0.211.174':139
'69.##0.7.205':139
'69.##0.52.102':139
'69.##0.57.52':139
'69.##0.160.112':139
'69.##0.40.217':139
'69.##0.14.243':139
'69.##0.217.133':139
'69.##0.233.205':139
'69.##0.133.233':139
'69.##0.193.43':139
'69.##0.126.192':139
'69.##0.50.186':139
'69.##0.91.16':139
'69.##0.108.0':139
'69.##0.193.43':445
'69.##0.126.192':445
'69.##0.50.186':445
'69.##0.91.16':445
'69.##0.108.0':445
'69.##0.235.247':445
'69.##0.116.140':445
'69.##0.20.229':445
'69.##0.160.112':445
'69.##0.25.42':445
'69.##0.14.243':445
'69.##0.175.28':139
'69.#60.19.9':139
'69.##0.29.29':139
'69.##0.110.162':139
'69.##0.194.67':139
'69.##0.217.133':445
'69.##0.40.217':445
'69.##0.133.233':445
'69.##0.181.47':445
'69.##0.233.205':445
'69.##0.181.47':139
'69.##0.17.212':139
'69.##0.131.174':139
'69.##0.44.191':139
'69.##0.35.228':139
'69.##0.80.155':139
'69.##0.198.77':445
'69.##0.196.40':445
'69.##0.65.209':445
'69.##0.9.131':139
'69.##0.112.219':139
'69.##0.213.114':139
'69.#60.7.68':139
'69.##0.21.148':139
'69.##0.54.88':139
'69.##0.72.174':139
'69.##0.110.92':139
'69.##0.183.51':139
'69.##0.24.185':139
'69.##0.51.209':139
'69.##0.25.246':139
'69.##0.128.235':139
'69.##0.35.228':445
'69.##0.80.155':445
'69.##0.213.114':445
'69.##0.183.51':445
'69.##0.24.185':445
'69.##0.9.131':445
'69.##0.112.219':445
'69.##0.131.174':445
'69.##0.44.191':445
'69.##0.17.212':445
'69.##0.51.209':445
'69.##0.72.174':445
'69.##0.110.92':445
'69.##0.174.78':445
'69.#60.3.27':445
'69.##0.32.13':445
'69.##0.25.246':445
'69.##0.128.235':445
'69.##0.21.148':445
'69.##0.54.88':445
'69.#60.7.68':445
'69.##0.153.184':445
'69.##0.106.137':445
'69.##0.107.110':139
'69.##0.136.231':445
'69.##0.103.67':445
'69.##0.23.65':445
'69.##0.160.20':139
'69.##0.107.145':139
'69.##0.168.224':139
'69.##0.237.143':139
'69.##0.98.78':139
'69.##0.67.152':445
'69.##0.176.58':445
'69.##0.5.209':445
'69.##0.73.157':445
'69.##0.56.21':445
'69.##0.150.187':445
'69.##0.131.132':445
'69.#60.5.28':445
'69.##0.41.32':445
'69.##0.30.225':445
'69.##0.91.141':445
'69.##0.203.193':139
'69.##0.86.204':139
'69.##0.200.33':139
'69.##0.68.240':139
'69.##0.16.107':139
'69.##0.114.161':139
'69.##0.103.114':139
'69.##0.122.3':139
'69.##0.55.87':139
'69.##0.196.55':139
'69.##0.53.29':139
'69.#60.6.27':139
'69.##0.18.229':139
'69.##0.221.16':139
'69.##0.34.142':139
'69.##0.16.123':139
'69.##0.36.250':139
'69.##0.95.206':139
'69.##0.250.39':139
'69.##0.141.100':139
'69.##0.241.189':139
'69.##0.183.186':445
'69.#60.72.8':139
'69.##0.38.160':139
'69.##0.220.35':139
'69.##0.124.146':139
'69.##0.142.164':139
'69.##0.56.21':139
'69.##0.150.187':139
'69.##0.183.186':139
'69.##0.62.249':139
'69.##0.7.241':139
'69.##0.110.75':139
'69.##0.127.108':445
'69.##0.211.174':445
'69.##0.7.205':445
'69.##0.52.102':445
'69.##0.57.52':445
'69.##0.175.28':445
'69.#60.19.9':445
'69.##0.29.29':445
'69.##0.110.162':445
'69.##0.194.67':445
'69.##0.124.146':445
'69.##0.142.164':445
'69.##0.110.75':445
'69.##0.136.231':139
'69.##0.106.137':139
'69.##0.62.249':445
'69.##0.7.241':445
'69.##0.38.160':445
'69.##0.220.35':445
'69.#60.72.8':445
'69.##0.23.65':139
'69.##0.30.225':139
'69.##0.91.141':139
'69.##0.5.209':139
'69.##0.73.157':139
'69.##0.176.58':139
'69.##0.67.152':139
'69.##0.103.67':139
'69.#60.5.28':139
'69.##0.41.32':139
'69.##0.131.132':139
'69.##0.125.2':445
'69.#60.79.2':445
'69.##0.42.117':445
'69.##0.168.26':445
'69.##0.34.44':445
'69.##0.110.139':445
'69.##0.49.199':445
'69.##0.84.189':445
'69.##0.117.207':445
'69.##0.1.182':445
'69.##0.114.39':445
'69.##0.227.63':139
'69.##0.3.227':139
'69.##0.41.79':139
'69.#60.54.6':139
'69.##0.56.251':139
'69.##0.151.178':445
'69.##0.226.149':445
'69.##0.151.169':139
'69.##0.133.4':139
'69.##0.196.232':139
'69.##0.174.94':445
'69.##0.26.39':445
'69.##0.85.189':445
'69.#60.7.37':445
'69.##0.63.160':445
'69.##0.239.198':445
'69.##0.216.158':445
'69.##0.6.181':445
'69.##0.90.253':445
'69.##0.79.91':445
'69.##0.25.137':445
'69.##0.101.248':445
'69.##0.170.34':445
'69.##0.122.99':445
'69.##0.177.15':445
'69.##0.113.130':445
'69.##0.54.121':445
'69.##0.199.212':445
'69.##0.131.80':445
'69.##0.98.154':445
'69.##0.11.77':445
'69.##0.136.52':139
'69.##0.113.130':139
'69.##0.122.99':139
'69.##0.177.15':139
'69.##0.110.139':139
'69.##0.49.199':139
'69.##0.11.77':139
'69.##0.131.80':139
'69.##0.98.154':139
'69.##0.101.248':139
'69.##0.170.34':139
'69.##0.84.189':139
'69.##0.168.26':139
'69.##0.34.44':139
'69.##0.114.39':139
'69.##0.226.149':139
'69.##0.151.178':139
'69.##0.117.207':139
'69.##0.1.182':139
'69.#60.79.2':139
'69.##0.42.117':139
'69.##0.125.2':139
'69.##0.162.107':139
'69.##0.166.162':139
'69.##0.107.2':139
'69.##0.239.198':139
'69.##0.216.158':139
'69.##0.219.196':139
'69.##0.165.85':139
'69.#60.1.62':139
'69.##0.172.166':139
'69.##0.9.173':139
'69.##0.6.181':139
'69.#60.7.37':139
'69.##0.63.160':139
'69.##0.25.137':139
'69.##0.54.121':139
'69.##0.199.212':139
'69.##0.90.253':139
'69.##0.79.91':139
'69.##0.26.39':139
'69.##0.85.189':139
'69.##0.174.94':139
'69.##0.107.2':445
'69.##0.52.69':445
'69.##0.62.92':445
'69.##0.5.136':445
'69.##0.35.42':445
'69.##0.121.103':445
'69.##0.21.247':445
'69.##0.54.188':445
'69.##0.117.193':445
'69.##0.66.23':445
'69.##0.193.166':445
'69.##0.163.203':139
'69.##0.44.113':139
'69.##0.122.112':139
'69.##0.112.162':139
'69.##0.86.64':139
'69.##0.117.66':139
'69.##0.25.183':139
'69.##0.163.6':139
'69.##0.203.248':139
'69.##0.144.122':139
'69.##0.52.191':139
'69.##0.163.203':445
'69.##0.65.209':139
'69.##0.163.6':445
'69.##0.203.248':445
'69.##0.25.183':445
'69.##0.32.13':139
'69.##0.174.78':139
'69.#60.3.27':139
'69.##0.198.77':139
'69.##0.196.40':139
'69.##0.52.191':445
'69.##0.163.193':445
'69.##0.86.64':445
'69.##0.78.129':445
'69.##0.241.117':445
'69.##0.75.244':445
'69.##0.122.112':445
'69.##0.144.122':445
'69.##0.44.113':445
'69.##0.117.66':445
'69.##0.112.162':445
'69.##0.163.193':139
'69.##0.196.232':445
'69.##0.151.169':445
'69.##0.133.4':445
'69.##0.227.63':445
'69.##0.3.227':445
'69.##0.1.182':9988
'69.##0.113.130':9988
'69.##0.125.2':9988
'69.##0.168.26':9988
'69.##0.42.117':9988
'69.##0.41.79':445
'69.##0.9.173':445
'69.#60.1.62':445
'69.##0.172.166':445
'69.##0.162.107':445
'69.##0.166.162':445
'69.#60.54.6':445
'69.##0.56.251':445
'69.##0.136.52':445
'69.##0.219.196':445
'69.##0.165.85':445
'69.##0.193.166':139
'69.##0.117.193':139
'69.##0.66.23':139
'69.##0.52.69':139
'69.##0.62.92':139
'69.##0.75.244':139
'69.##0.78.129':139
'69.##0.241.117':139
'69.##0.21.247':139
'69.##0.54.188':139
'69.##0.5.136':139
'69.##0.79.91':9988
'69.##0.6.181':9988
'69.##0.26.39':9988
'69.##0.11.77':9988
'69.##0.25.137':9988
'69.##0.35.42':139
'69.##0.121.103':139
'69.##0.166.162':9988
'69.##0.239.198':9988
'69.##0.216.158':9988

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial