Trojan.Starman.6077

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'69.##6.238.33':445
'69.##6.112.238':445
'69.#06.0.34':445
'69.##6.111.102':445
'69.##6.48.67':445
'69.##6.16.143':445
'69.##6.74.181':445
'69.##6.44.70':445
'69.##6.250.130':445
'69.##6.55.221':445
'69.##6.48.137':445
'69.##6.61.242':445
'69.##6.127.161':445
'69.##6.221.60':445
'69.##6.250.130':139
'69.##6.55.221':139
'69.##6.115.225':139
'69.##6.61.242':139
'69.##6.127.161':139
'69.##6.44.70':139
'69.##6.0.145':139
'69.##6.22.216':139
'69.##6.251.66':139
'69.##6.245.207':139
'69.##6.41.85':139
'69.##6.118.62':139
'69.##6.219.224':139
'69.##6.115.225':445
'69.##6.39.96':139
'69.##6.144.52':139
'69.##6.205.229':139
'69.##6.48.90':139
'69.##6.67.56':139
'69.##6.136.158':139
'69.#06.6.5':139
'69.##6.157.147':139
'69.##6.56.204':139
'69.##6.195.178':139
'69.##6.102.6':139
'69.##6.167.194':139
'69.##6.147.18':139
'69.##6.234.209':139
'69.##6.219.224':445
'69.##6.22.216':445
'69.##6.251.66':445
'69.##6.0.145':445
'69.##6.41.85':445
'69.##6.118.62':445
'69.##6.245.207':445
'69.##6.22.21':139
'69.##6.149.21':139
'69.##6.66.53':139
'69.##6.205.18':139
'69.##6.156.6':139
'69.##6.181.116':139
'69.##6.106.191':445
'69.##6.37.150':445
'69.##6.191.178':445
'69.##6.66.12':139
'69.##6.254.70':139
'69.##6.50.100':139
'69.##6.105.199':445
'69.##6.95.47':445
'69.##6.22.241':445
'69.##6.47.230':445
'69.##6.64.28':445
'69.##6.101.161':445
'69.##6.18.88':445
'69.##6.214.166':139
'69.##6.217.164':139
'69.##6.198.99':139
'69.##6.227.194':139
'69.##6.252.252':139
'69.##6.10.122':139
'69.##6.200.22':139
'69.##6.232.216':139
'69.##6.80.227':139
'69.##6.84.19':139
'69.##6.68.229':139
'69.##6.29.115':139
'69.##6.251.51':139
'69.##6.203.122':139
'69.##6.70.91':445
'69.##6.50.100':445
'69.##6.221.60':139
'69.##6.111.102':139
'69.##6.214.166':445
'69.##6.66.12':445
'69.##6.254.70':445
'69.##6.48.67':139
'69.#06.0.34':139
'69.##6.74.181':139
'69.##6.48.137':139
'69.##6.16.143':139
'69.##6.238.33':139
'69.##6.112.238':139
'69.##6.68.229':445
'69.##6.200.22':445
'69.##6.217.164':445
'69.##6.198.99':445
'69.##6.43.15':445
'69.##6.252.252':445
'69.##6.10.122':445
'69.##6.227.194':445
'69.##6.203.122':445
'69.##6.80.227':445
'69.##6.84.19':445
'69.##6.232.216':445
'69.##6.29.115':445
'69.##6.251.51':445
'69.##6.112.195':139
'69.##6.86.39':445
'69.##6.225.52':445
'69.##6.2.201':445
'69.##6.143.137':445
'69.#06.1.28':445
'69.##6.38.231':445
'69.##6.20.47':445
'69.##6.244.229':445
'69.##6.26.212':445
'69.##6.39.251':139
'69.##6.207.60':445
'69.##6.28.207':445
'69.##6.230.28':445
'69.##6.42.131':445
'69.##6.26.212':139
'69.##6.5.140':445
'69.##6.177.253':445
'69.##6.28.207':139
'69.##6.230.28':139
'69.##6.244.229':139
'69.##6.67.41':445
'69.##6.27.77':445
'69.##6.98.138':445
'69.##6.218.140':445
'69.#06.9.36':445
'69.##6.105.167':445
'69.##6.13.51':445
'69.#06.66.7':139
'69.##6.84.146':139
'69.##6.193.184':139
'69.##6.153.132':139
'69.##6.22.16':139
'69.##6.122.21':139
'69.##6.120.121':139
'69.##6.128.129':139
'69.##6.155.195':139
'69.##6.19.159':139
'69.##6.69.246':139
'69.##6.93.34':139
'69.##6.1.228':139
'69.##6.216.2':139
'69.##6.16.126':139
'69.##6.223.144':139
'69.##6.14.81':139
'69.##6.166.121':139
'69.##6.140.109':139
'69.##6.169.219':139
'69.##6.225.111':139
'69.##6.170.72':139
'69.##6.169.249':139
'69.##6.173.170':139
'69.##6.125.179':139
'69.##6.83.62':139
'69.##6.166.141':139
'69.##6.104.193':139
'69.##6.136.158':445
'69.##6.39.96':445
'69.##6.144.52':445
'69.##6.234.209':445
'69.##6.48.90':445
'69.##6.67.56':445
'69.##6.205.229':445
'69.##6.147.18':445
'69.##6.157.147':445
'69.##6.56.204':445
'69.#06.6.5':445
'69.##6.102.6':445
'69.##6.167.194':445
'69.##6.66.53':445
'69.##6.45.167':139
'69.##6.94.73':139
'69.##6.86.153':139
'69.##6.172.195':139
'69.##6.30.159':139
'69.##6.229.29':139
'69.##6.112.169':139
'69.##6.181.116':445
'69.##6.22.21':445
'69.##6.149.21':445
'69.##6.166.17':139
'69.##6.205.18':445
'69.##6.156.6':445
'69.##6.195.178':445
'69.##6.218.140':139
'69.##6.42.131':139
'69.##6.143.137':139
'69.##6.13.51':139
'69.##6.27.77':139
'69.##6.98.138':139
'69.#06.1.28':139
'69.##6.2.201':139
'69.##6.20.47':139
'69.##6.207.60':139
'69.##6.38.231':139
'69.##6.86.39':139
'69.##6.225.52':139
'69.##6.105.167':139
'69.##6.229.29':445
'69.##6.45.167':445
'69.##6.94.73':445
'69.##6.112.195':445
'69.##6.172.195':445
'69.##6.30.159':445
'69.##6.86.153':445
'69.##6.67.41':139
'69.##6.177.253':139
'69.##6.5.140':139
'69.##6.112.169':445
'69.##6.166.17':445
'69.#06.9.36':139
'69.##6.158.227':445
'69.#06.60.6':445
'69.##6.228.217':445
'69.##6.146.35':445
'69.##6.151.250':445
'69.##6.227.149':445
'69.##6.133.74':445
'69.##6.157.53':445
'69.##6.21.240':445
'69.##6.174.43':445
'69.##6.89.218':445
'69.##6.48.143':445
'69.##6.69.243':445
'69.##6.113.242':445
'69.##6.52.250':445
'69.##6.108.240':445
'69.##6.96.83':445
'69.##6.19.48':445
'69.##6.95.10':445
'69.##6.8.239':445
'69.##6.176.236':445
'69.#06.6.51':445
'69.##6.49.180':445
'69.##6.35.88':445
'69.#06.1.72':445
'69.##6.15.21':445
'69.##6.229.173':445
'69.##6.137.217':445
'69.##6.172.126':445
'69.##6.210.238':445
'69.##6.120.35':9988
'69.##6.221.66':445
'69.#06.5.84':445
'69.##6.9.123':445
'69.##6.167.76':9988
'69.##6.89.218':9988
'69.##6.48.143':9988
'69.##6.157.53':9988
'69.##6.151.250':9988
'69.##6.228.217':9988
'69.##6.108.240':9988
'69.##6.245.224':445
'69.##6.43.224':445
'69.##6.198.154':445
'69.##6.45.125':445
'69.##6.208.21':445
'69.##6.34.207':445
'69.##6.235.235':445
'69.##6.85.211':445
'69.##6.47.59':445
'69.#06.6.48':445
'69.##6.225.5':445
'69.##6.142.106':445
'69.##6.12.93':445
'69.##6.185.239':445
'69.##6.113.242':139
'69.##6.146.35':139
'69.##6.151.250':139
'69.#06.6.51':139
'69.##6.49.180':139
'69.##6.35.88':139
'69.##6.227.149':139
'69.##6.133.74':139
'69.##6.89.218':139
'69.##6.48.143':139
'69.##6.158.227':139
'69.#06.60.6':139
'69.##6.228.217':139
'69.##6.229.173':139
'69.##6.20.169':139
'69.##6.120.35':139
'69.##6.19.48':139
'69.##6.167.76':139
'69.##6.127.49':139
'69.##6.52.250':139
'69.##6.95.10':139
'69.##6.176.236':139
'69.#06.1.72':139
'69.##6.15.21':139
'69.##6.8.239':139
'69.##6.108.240':139
'69.##6.96.83':139
'69.##6.69.243':139
'69.##6.245.224':139
'69.##6.221.66':139
'69.#06.5.84':139
'69.##6.47.59':139
'69.#06.6.48':139
'69.##6.225.5':139
'69.##6.9.123':139
'69.##6.167.76':445
'69.##6.20.169':445
'69.##6.120.35':445
'69.##6.172.126':139
'69.##6.210.238':139
'69.##6.127.49':445
'69.##6.185.239':139
'69.##6.137.217':139
'69.##6.208.21':139
'69.##6.34.207':139
'69.##6.157.53':139
'69.##6.21.240':139
'69.##6.174.43':139
'69.##6.235.235':139
'69.##6.85.211':139
'69.##6.142.106':139
'69.##6.12.93':139
'69.##6.43.224':139
'69.##6.198.154':139
'69.##6.45.125':139
'69.##6.21.240':9988
'69.##6.118.240':139
'69.##6.175.1':139
'69.##6.152.217':139
'69.##6.69.119':139
'69.##6.197.203':139
'69.##6.172.242':139
'69.##6.80.166':139
'69.##6.30.54':445
'69.##6.24.221':445
'69.##6.176.24':445
'69.##6.28.100':445
'69.##6.159.88':445
'69.##6.11.182':445
'69.##6.19.183':139
'69.##6.24.221':139
'69.##6.176.24':139
'69.##6.70.168':139
'69.##6.159.88':139
'69.##6.11.182':139
'69.##6.30.54':139
'69.##6.125.90':139
'69.##6.72.112':139
'69.##6.67.111':139
'69.##6.182.233':139
'69.##6.193.229':139
'69.##6.151.213':139
'69.##6.111.187':139
'69.##6.70.168':445
'69.##6.191.178':139
'69.##6.105.199':139
'69.##6.64.28':139
'69.##6.80.166':445
'69.##6.106.191':139
'69.##6.37.150':139
'69.##6.101.161':139
'69.##6.47.230':139
'69.##6.70.91':139
'69.##6.43.15':139
'69.##6.18.88':139
'69.##6.95.47':139
'69.##6.22.241':139
'69.##6.152.217':445
'69.##6.111.187':445
'69.##6.72.112':445
'69.##6.67.111':445
'69.##6.125.90':445
'69.##6.193.229':445
'69.##6.151.213':445
'69.##6.182.233':445
'69.##6.172.242':445
'69.##6.118.240':445
'69.##6.175.1':445
'69.##6.19.183':445
'69.##6.69.119':445
'69.##6.197.203':445
'69.##6.109.218':139
'69.##6.55.155':139
'69.##6.78.86':139
'69.##6.67.130':139
'69.##6.77.107':139
'69.##6.64.175':139
'69.##6.66.77':139
'69.##6.117.58':139
'69.##6.81.19':139
'69.##6.71.167':139
'69.##6.45.147':139
'69.##6.236.106':139
'69.##6.189.132':139
'69.##6.35.136':139
'69.##6.210.238':9988
'69.##6.22.114':139
'69.##6.132.164':139
'69.##6.137.217':9988
'69.##6.208.21':9988
'69.##6.172.126':9988
'69.##6.254.120':139
'69.##6.147.227':139
'69.##6.151.25':139
'69.#06.40.6':139
'69.##6.64.179':139
'69.##6.71.64':139
'69.##6.76.125':139
'69.##6.35.190':139
'69.##6.66.77':445
'69.##6.45.147':445
'69.##6.236.106':445
'69.##6.109.218':445
'69.##6.55.155':445
'69.##6.78.86':445
'69.##6.189.132':445
'69.##6.35.190':445
'69.##6.183.216':445
'69.##6.28.100':139
'69.##6.117.58':445
'69.##6.81.19':445
'69.##6.71.167':445
'69.##6.64.175':445
'69.##6.254.120':445
'69.##6.64.179':445
'69.##6.71.64':445
'69.##6.183.216':139
'69.##6.22.114':445
'69.##6.132.164':445
'69.##6.76.125':445
'69.##6.35.136':445
'69.##6.67.130':445
'69.##6.77.107':445
'69.##6.147.227':445
'69.##6.151.25':445
'69.#06.40.6':445

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial