Trojan.Starman.5581

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'20#.#16.56.55':445
'20#.#16.183.56':445
'20#.#16.88.117':445
'20#.#16.64.139':445
'20#.#16.162.54':445
'20#.#16.236.182':445
'20#.#16.139.243':445
'20#.#16.237.139':445
'20#.#16.243.72':445
'20#.#16.106.237':445
'20#.#16.73.106':445
'20#.#16.124.61':445
'20#.#16.54.50':445
'20#.#16.215.177':445
'20#.#16.99.205':445
'20#.#16.233.109':445
'20#.#16.96.86':445
'20#.#16.225.84':445
'20#.#16.231.10':445
'20#.#16.36.125':445
'20#.#16.153.241':445
'20#.#16.48.225':445
'20#.#16.18.49':445
'20#.#16.171.55':445
'20#.#16.70.5':445
'20#.#16.27.34':445
'20#.#16.27.34':139
'20#.#16.70.5':139
'20#.#16.123.223':445
'20#.#16.143.58':139
'20#.#16.197.55':139
'20#.#16.28.160':139
'20#.#16.131.218':445
'20#.#16.0.99':445
'20#.#16.123.223':139
'20#.#16.102.51':445
'20#.#16.89.146':445
'20#.#16.113.41':445
'20#.#16.16.58':445
'20#.#16.69.145':445
'20#.#16.73.45':445
'20#.#16.131.218':139
'20#.#16.171.55':139
'20#.#16.0.99':139
'20#.#16.199.106':445
'20#.#16.213.200':445
'20#.#16.110.104':445
'20#.#16.162.54':139
'20#.#16.88.117':139
'20#.#16.64.139':139
'20#.#16.36.125':139
'20#.#16.124.61':139
'20#.#16.56.55':139
'20#.#16.73.106':139
'20#.#16.243.72':139
'20#.#16.106.237':139
'20#.#16.183.56':139
'20#.#16.236.182':139
'20#.#16.231.10':139
'20#.#16.99.205':139
'20#.#16.96.86':139
'20#.#16.233.109':139
'20#.#16.104.135':139
'20#.#16.110.104':139
'20#.#16.54.50':139
'20#.#16.18.49':139
'20#.#16.153.241':139
'20#.#16.48.225':139
'20#.#16.215.177':139
'20#.#16.225.84':139
'20#.#16.83.198':445
'20#.#16.171.173':445
'20#.#16.51.29':445
'20#.#16.133.209':445
'20#.#16.181.134':445
'20#.#16.74.171':445
'20#.#16.102.0':445
'20#.#16.104.135':445
'20#.#16.102.224':445
'20#.#16.20.144':445
'20#.#16.19.203':445
'20#.#16.189.133':445
'20#.#16.69.145':139
'20#.#16.113.41':139
'20#.#16.16.58':139
'20#.#16.139.243':139
'20#.#16.237.139':139
'20#.#16.102.51':139
'20#.#16.213.200':139
'20#.#16.183.146':445
'20#.#16.199.106':139
'20#.#16.89.146':139
'20#.#16.73.45':139
'20#.#16.8.189':445
'20#.#16.0.158':445
'20#.#16.239.208':445
'20#.#16.8.69':445
'20#.#16.44.160':445
'20#.#16.91.68':445
'20#.#16.226.109':445
'20#.#16.211.119':445
'20#.#16.144.220':445
'20#.#16.208.167':445
'20#.#16.26.12':445
'20#.#16.72.93':445
'20#.#16.13.223':445
'20#.#16.22.37':445
'20#.#16.160.191':445
'20#.#16.25.194':445
'20#.#16.204.77':445
'20#.#16.149.5':445
'20#.#16.78.240':445
'20#.#16.229.134':445
'20#.#16.134.142':445
'20#.#16.217.67':445
'20#.#16.241.37':445
'20#.#16.74.166':445
'20#.#16.100.123':445
'20#.#16.134.58':445
'20#.#16.243.112':445
'20#.#16.179.235':445
'20#.#16.250.151':139
'20#.#16.237.105':139
'20#.#16.158.110':139
'20#.#16.181.28':139
'20#.#16.169.108':139
'20#.#16.5.128':139
'20#.#16.15.116':445
'20#.#16.13.22':445
'20#.#16.124.117':445
'20#.#16.94.40':445
'20#.#16.19.3':445
'20#.#16.12.150':445
'20#.#16.148.155':445
'20#.#16.239.227':445
'20#.#16.115.238':445
'20#.#16.220.52':445
'20#.#16.106.180':445
'20#.#16.38.10':445
'20#.#16.76.141':445
'20#.#16.44.160':139
'20#.#16.239.208':139
'20#.#16.8.69':139
'20#.#16.78.240':139
'20#.#16.72.93':139
'20#.#16.8.189':139
'20#.#16.26.12':139
'20#.#16.144.220':139
'20#.#16.208.167':139
'20#.#16.0.158':139
'20#.#16.91.68':139
'20#.#16.229.134':139
'20#.#16.204.77':139
'20#.#16.160.191':139
'20#.#16.25.194':139
'20#.#16.85.197':139
'20#.#16.76.141':139
'20#.#16.13.223':139
'20#.#16.241.37':139
'20#.#16.134.142':139
'20#.#16.217.67':139
'20#.#16.22.37':139
'20#.#16.149.5':139
'20#.#16.179.235':139
'20#.#16.134.58':139
'20#.#16.243.112':139
'20#.#16.115.238':139
'20#.#16.15.116':139
'20#.#16.74.166':139
'20#.#16.197.55':445
'20#.#16.28.160':445
'20#.#16.85.197':445
'20#.#16.100.123':139
'20#.#16.143.58':445
'20#.#16.239.227':139
'20#.#16.12.150':139
'20#.#16.13.22':139
'20#.#16.19.3':139
'20#.#16.226.109':139
'20#.#16.211.119':139
'20#.#16.94.40':139
'20#.#16.38.10':139
'20#.#16.220.52':139
'20#.#16.106.180':139
'20#.#16.124.117':139
'20#.#16.148.155':139
'20#.#16.107.145':445
'20#.#16.163.60':445
'20#.#16.149.183':445
'20#.#16.162.219':445
'20#.#16.21.65':445
'20#.#16.39.73':445
'20#.#16.9.58':445
'20#.#16.150.136':445
'20#.#16.62.47':445
'20#.#16.51.39':445
'20#.#16.32.82':445
'20#.#16.17.242':445
'20#.#16.128.230':139
'20#.#16.67.186':445
'20#.#16.98.227':139
'20#.#16.41.240':139
'20#.#16.95.39':139
'20#.#16.97.212':445
'20#.#16.162.124':445
'20#.#16.219.57':445
'20#.#16.247.154':445
'20#.#16.58.62':445
'20#.#16.106.92':445
'20#.#16.110.233':445
'20#.#16.24.43':445
'20#.#16.19.249':445
'20#.#16.219.89':445
'20#.#16.30.38':445
'20#.#16.19.75':445
'20#.#16.174.29':445
'20#.#16.47.174':445
'20#.#16.44.225':445
'20#.#16.134.161':445
'20#.#16.121.128':445
'20#.#16.211.143':445
'20#.#16.229.160':445
'20#.#16.2.16':445
'20#.#16.226.66':445
'20#.#16.170.150':445
'20#.#16.102.114':445
'20#.#16.11.117':445
'20#.#16.181.254':445
'20#.#16.87.178':445
'20#.#16.1.202':445
'20#.#16.146.179':445
'20#.#16.74.21':445
'20#.#16.0.91':139
'20#.#16.32.82':139
'20#.#16.62.47':139
'20#.#16.51.39':139
'20#.#16.163.60':139
'20#.#16.39.73':139
'20#.#16.9.58':139
'20#.#16.226.66':139
'20#.#16.229.160':139
'20#.#16.102.114':139
'20#.#16.150.136':139
'20#.#16.170.150':139
'20#.#16.107.145':139
'20#.#16.17.242':139
'20#.#16.162.124':139
'20#.#16.97.212':139
'20#.#16.247.154':139
'20#.#16.58.62':139
'20#.#16.67.186':139
'20#.#16.21.65':139
'20#.#16.149.183':139
'20#.#16.162.219':139
'20#.#16.106.92':139
'20#.#16.219.57':139
'20#.#16.121.128':139
'20#.#16.44.225':139
'20#.#16.134.161':139
'20#.#16.24.43':139
'20#.#16.19.75':139
'20#.#16.174.29':139
'20#.#16.71.236':139
'20#.#16.12.246':139
'20#.#16.84.58':139
'20#.#16.47.174':139
'20#.#16.16.48':139
'20#.#16.110.233':139
'20#.#16.74.21':139
'20#.#16.1.202':139
'20#.#16.146.179':139
'20#.#16.2.16':139
'20#.#16.11.117':139
'20#.#16.181.254':139
'20#.#16.30.38':139
'20#.#16.19.249':139
'20#.#16.219.89':139
'20#.#16.87.178':139
'20#.#16.211.143':139
'20#.#16.186.204':445
'20#.#16.212.163':445
'20#.#16.8.17':445
'20#.#16.190.209':445
'20#.#16.246.152':445
'20#.#16.179.164':445
'20#.#16.213.52':445
'20#.#16.164.168':139
'20#.#16.139.113':445
'20#.#16.0.71':445
'20#.#16.56.95':445
'20#.#16.123.169':445
'20#.#16.81.209':445
'20#.#16.109.217':445
'20#.#16.24.84':445
'20#.#16.129.71':445
'20#.#16.121.123':445
'20#.#16.54.102':445
'20#.#16.183.58':445
'20#.#16.84.220':445
'20#.#16.202.198':445
'20#.#16.100.31':445
'20#.#16.198.100':445
'20#.#16.51.29':139
'20#.#16.83.198':139
'20#.#16.181.134':139
'20#.#16.189.133':139
'20#.#16.133.209':139
'20#.#16.171.173':139
'20#.#16.102.224':139
'20#.#16.102.0':139
'20#.#16.19.203':139
'20#.#16.74.171':139
'20#.#16.20.144':139
'20#.#16.183.146':139
'20#.#16.153.194':139
'20#.#16.101.8':139
'20#.#16.143.19':139
'20#.#16.185.56':139
'20#.#16.30.136':139
'20#.#16.164.168':445
'20#.#16.153.194':445
'20#.#16.101.8':445
'20#.#16.143.19':445
'20#.#16.185.56':445
'20#.#16.30.136':445
'20#.#16.177.138':445
'20#.#16.19.75':9988
'20#.#16.134.161':9988
'20#.#16.24.43':9988
'20#.#16.30.38':9988
'20#.#16.110.233':9988
'20#.#16.84.58':9988
'20#.#16.95.39':9988
'20#.#16.128.230':9988
'20#.#16.41.240':9988
'20#.#16.12.246':9988
'20#.#16.0.91':9988
'20#.#16.39.73':9988
'20#.#16.12.246':445
'20#.#16.0.91':445
'20#.#16.71.236':445
'20#.#16.16.48':445
'20#.#16.84.58':445
'20#.#16.41.240':445
'20#.#16.219.57':9988
'20#.#16.106.92':9988
'20#.#16.128.230':445
'20#.#16.95.39':445
'20#.#16.98.227':445
'20#.#16.8.17':139
'20#.#16.186.204':139
'20#.#16.246.152':139
'20#.#16.123.169':139
'20#.#16.190.209':139
'20#.#16.212.163':139
'20#.#16.139.113':139
'20#.#16.213.52':139
'20#.#16.56.95':139
'20#.#16.179.164':139
'20#.#16.0.71':139
'20#.#16.84.220':139
'20#.#16.24.84':139
'20#.#16.81.209':139
'20#.#16.121.123':139
'20#.#16.177.138':139
'20#.#16.129.71':139
'20#.#16.109.217':139
'20#.#16.202.198':139
'20#.#16.183.58':139
'20#.#16.198.100':139
'20#.#16.54.102':139
'20#.#16.100.31':139

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial