Trojan.Starman.5046

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1a8b.dir00\svchost.exe.mdmp 16325836412032104

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1a8b.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'68.##0.56.198':445
'68.##0.251.111':445
'68.##0.56.204':445
'68.##0.75.64':445
'68.##0.107.107':445
'68.##0.97.107':445
'68.##0.169.144':445
'68.##0.85.117':445
'68.##0.244.79':445
'68.##0.98.57':445
'68.##0.119.90':445
'68.##0.65.146':445
'68.##0.123.142':139
'68.##0.69.107':139
'68.##0.196.62':139
'68.##0.43.220':139
'68.#40.1.43':139
'68.##0.90.42':139
'68.##0.180.198':139
'68.##0.21.235':139
'68.##0.10.34':445
'68.##0.87.196':139
'68.##0.152.87':139
'68.##0.198.152':139
'68.##0.130.43':445
'68.##0.19.158':445
'68.##0.49.58':445
'68.##0.213.112':445
'68.##0.81.209':445
'68.##0.232.222':445
'68.##0.43.220':445
'68.#40.1.43':445
'68.##0.90.42':445
'68.##0.161.50':445
'68.##0.205.71':445
'68.##0.183.22':445
'68.##0.238.197':445
'68.##0.115.238':445
'68.##0.76.222':445
'68.##0.195.119':445
'68.##0.205.206':445
'68.##0.186.57':445
'68.##0.181.252':445
'68.##0.218.32':445
'68.##0.108.99':445
'68.##0.106.20':445
'68.##0.115.243':445
'68.##0.206.170':445
'68.##0.183.22':139
'68.##0.10.34':139
'68.##0.75.64':139
'68.##0.107.107':139
'68.##0.129.11':445
'68.##0.149.177':445
'68.##0.66.135':445
'68.##0.56.204':139
'68.##0.98.57':139
'68.##0.119.90':139
'68.##0.97.107':139
'68.##0.56.198':139
'68.##0.251.111':139
'68.##0.76.163':139
'68.##0.223.213':139
'68.##0.55.223':139
'68.##0.183.206':445
'68.##0.223.218':445
'68.##0.70.74':445
'68.##0.76.163':445
'68.##0.223.213':445
'68.##0.55.223':445
'68.##0.129.11':139
'68.##0.149.177':139
'68.##0.66.135':139
'68.##0.108.99':139
'68.##0.213.112':139
'68.##0.81.209':139
'68.##0.206.170':139
'68.##0.181.252':139
'68.##0.218.32':139
'68.##0.49.58':139
'68.##0.161.50':139
'68.##0.205.71':139
'68.##0.232.222':139
'68.##0.130.43':139
'68.##0.19.158':139
'68.##0.244.79':139
'68.##0.195.119':139
'68.##0.205.206':139
'68.##0.65.146':139
'68.##0.169.144':139
'68.##0.85.117':139
'68.##0.76.222':139
'68.##0.106.20':139
'68.##0.115.243':139
'68.##0.186.57':139
'68.##0.238.197':139
'68.##0.115.238':139
'68.##0.123.142':445
'68.##0.94.152':445
'68.##0.159.193':445
'68.##0.93.24':445
'68.##0.31.58':139
'68.##0.154.165':139
'68.##0.65.227':139
'68.##0.77.205':445
'68.##0.87.82':445
'68.##0.13.92':445
'68.##0.177.194':445
'68.##0.180.12':445
'68.##0.205.154':445
'68.##0.22.26':139
'68.##0.115.96':139
'68.##0.47.103':139
'68.##0.156.247':139
'68.##0.48.53':139
'68.##0.246.54':139
'68.##0.167.171':139
'68.##0.216.85':139
'68.##0.239.216':139
'68.##0.132.54':139
'68.##0.120.129':139
'68.##0.20.238':139
'68.##0.18.151':445
'68.##0.46.162':445
'68.##0.38.46':445
'68.##0.187.203':445
'68.##0.182.244':445
'68.##0.211.119':445
'68.##0.156.247':445
'68.##0.48.53':445
'68.##0.246.54':445
'68.##0.202.37':445
'68.##0.14.202':445
'68.##0.251.113':445
'68.##0.220.137':445
'68.##0.242.247':445
'68.##0.21.200':445
'68.##0.55.61':445
'68.##0.105.199':445
'68.##0.138.52':445
'68.##0.60.86':445
'68.##0.227.29':445
'68.##0.53.227':445
'68.##0.249.25':445
'68.##0.160.89':445
'68.##0.191.70':445
'68.##0.251.113':139
'68.##0.141.185':445
'68.##0.240.141':445
'68.##0.102.240':445
'68.##0.171.91':139
'68.##0.83.103':445
'68.##0.20.74':445
'68.##0.93.24':139
'68.##0.177.194':139
'68.##0.180.12':139
'68.##0.171.91':445
'68.##0.94.152':139
'68.##0.159.193':139
'68.##0.152.87':445
'68.##0.198.152':445
'68.##0.180.198':445
'68.##0.69.107':445
'68.##0.196.62':445
'68.##0.87.196':445
'68.##0.141.185':139
'68.##0.240.141':139
'68.##0.102.240':139
'68.##0.21.235':445
'68.##0.83.103':139
'68.##0.20.74':139
'68.##0.53.227':139
'68.##0.187.203':139
'68.##0.182.244':139
'68.##0.191.70':139
'68.##0.60.86':139
'68.##0.227.29':139
'68.##0.38.46':139
'68.##0.202.37':139
'68.##0.14.202':139
'68.##0.211.119':139
'68.##0.18.151':139
'68.##0.46.162':139
'68.##0.13.92':139
'68.##0.55.61':139
'68.##0.105.199':139
'68.##0.205.154':139
'68.##0.77.205':139
'68.##0.87.82':139
'68.##0.21.200':139
'68.##0.249.25':139
'68.##0.160.89':139
'68.##0.138.52':139
'68.##0.220.137':139
'68.##0.242.247':139
'68.##0.65.80':445
'68.##0.105.248':445
'68.##0.44.94':445
'68.##0.152.98':445
'68.##0.150.110':445
'68.##0.156.149':445
'68.##0.221.81':445
'68.##0.100.175':445
'68.##0.216.195':445
'68.##0.55.240':445
'68.##0.217.13':445
'68.##0.246.117':445
'68.##0.188.34':445
'68.##0.153.2':445
'68.##0.33.188':445
'68.##0.44.235':139
'68.##0.105.156':139
'68.##0.234.179':445
'68.##0.35.154':445
'68.##0.168.176':445
'68.##0.234.188':445
'68.##0.95.91':445
'68.##0.91.90':445
'68.##0.67.121':445
'68.##0.31.49':445
'68.##0.76.73':445
'68.##0.79.92':445
'68.##0.210.85':445
'68.##0.41.69':445
'68.##0.77.20':445
'68.##0.117.225':445
'68.##0.110.57':445
'68.##0.67.196':445
'68.##0.65.90':445
'68.##0.154.26':445
'68.##0.72.131':445
'68.##0.62.85':445
'68.##0.251.36':445
'68.#40.88.7':445
'68.##0.86.77':445
'68.##0.198.46':445
'68.##0.23.100':445
'68.##0.61.133':445
'68.##0.106.52':445
'68.##0.149.106':445
'68.##0.1.158':445
'68.##0.61.145':445
'68.##0.210.177':445
'68.##0.140.24':139
'68.##0.44.94':139
'68.##0.55.240':139
'68.##0.217.13':139
'68.##0.156.149':139
'68.##0.65.80':139
'68.##0.105.248':139
'68.##0.216.195':139
'68.##0.86.77':139
'68.##0.198.46':139
'68.##0.246.117':139
'68.##0.221.81':139
'68.##0.100.175':139
'68.##0.91.90':139
'68.##0.234.179':139
'68.##0.153.2':139
'68.##0.234.188':139
'68.##0.95.91':139
'68.##0.67.121':139
'68.##0.35.154':139
'68.##0.152.98':139
'68.##0.150.110':139
'68.##0.168.176':139
'68.##0.188.34':139
'68.##0.33.188':139
'68.##0.79.92':139
'68.##0.65.90':139
'68.##0.154.26':139
'68.##0.77.20':139
'68.##0.31.49':139
'68.##0.76.73':139
'68.##0.67.196':139
'68.##0.24.167':139
'68.#40.4.0':139
'68.##0.117.225':139
'68.##0.72.131':139
'68.##0.110.57':139
'68.#40.88.7':139
'68.##0.1.158':139
'68.##0.61.145':139
'68.##0.23.100':139
'68.##0.62.85':139
'68.##0.251.36':139
'68.##0.149.106':139
'68.##0.210.85':139
'68.##0.41.69':139
'68.##0.210.177':139
'68.##0.61.133':139
'68.##0.106.52':139
'68.##0.24.167':445
'68.##0.25.254':445
'68.##0.138.144':445
'68.##0.26.168':445
'68.##0.128.48':445
'68.##0.170.5':445
'68.##0.109.252':445
'68.##0.92.106':445
'68.##0.60.78':445
'68.##0.95.213':445
'68.##0.56.142':445
'68.##0.107.4':445
'68.##0.225.166':445
'68.##0.183.206':139
'68.##0.223.218':139
'68.##0.70.74':139
'68.##0.172.3':139
'68.##0.152.172':139
'68.##0.82.247':139
'68.##0.213.57':445
'68.##0.142.41':445
'68.##0.190.43':445
'68.##0.156.85':445
'68.##0.56.169':445
'68.##0.74.56':445
'68.##0.240.114':445
'68.##0.9.214':445
'68.##0.85.203':445
'68.##0.138.3':445
'68.##0.69.128':445
'68.##0.64.140':445
'68.##0.172.3':445
'68.##0.152.172':445
'68.##0.82.247':445
'68.##0.95.155':445
'68.##0.6.151':445
'68.##0.254.171':445
'68.##0.121.100':445
'68.##0.156.173':445
'68.##0.27.72':445
'68.##0.59.177':445
'68.##0.211.109':445
'68.##0.198.223':445
'68.##0.81.37':445
'68.##0.15.13':445
'68.##0.3.119':445
'68.##0.242.240':445
'68.##0.174.242':445
'68.##0.9.146':445
'68.##0.254.171':139
'68.##0.190.43':139
'68.##0.128.48':139
'68.##0.170.5':139
'68.##0.74.56':139
'68.##0.213.57':139
'68.##0.142.41':139
'68.##0.26.168':139
'68.##0.56.142':139
'68.##0.107.4':139
'68.##0.109.252':139
'68.##0.25.254':139
'68.##0.138.144':139
'68.##0.105.156':445
'68.##0.153.2':9988
'68.##0.100.175':9988
'68.#40.4.0':445
'68.##0.140.24':445
'68.##0.44.235':445
'68.##0.44.235':9988
'68.##0.156.85':139
'68.##0.56.169':139
'68.##0.86.77':9988
'68.##0.140.24':9988
'68.##0.61.133':9988
'68.##0.3.119':139
'68.##0.138.3':139
'68.##0.69.128':139
'68.##0.9.146':139
'68.##0.81.37':139
'68.##0.15.13':139
'68.##0.85.203':139
'68.##0.95.155':139
'68.##0.6.151':139
'68.##0.64.140':139
'68.##0.240.114':139
'68.##0.9.214':139
'68.##0.95.213':139
'68.##0.59.177':139
'68.##0.211.109':139
'68.##0.225.166':139
'68.##0.92.106':139
'68.##0.60.78':139
'68.##0.27.72':139
'68.##0.242.240':139
'68.##0.174.242':139
'68.##0.198.223':139
'68.##0.121.100':139
'68.##0.156.173':139

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial