Trojan.Starman.5315

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERafae.dir00\svchost.exe.mdmp 16325836412032072

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERafae.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'67.##8.137.209':139
'67.##8.108.195':139
'67.##8.183.156':139
'67.##8.203.235':139
'67.##8.30.102':139
'67.##8.134.115':139
'67.##8.119.151':139
'67.##8.137.170':139
'67.##8.183.180':139
'67.##8.245.191':139
'67.##8.90.43':139
'67.##8.137.194':139
'67.##8.21.56':139
'67.##8.28.231':139
'67.##8.98.253':139
'67.##8.246.241':139
'67.#68.8.43':139
'67.##8.200.25':139
'67.##8.235.199':139
'67.##8.116.190':139
'67.##8.223.77':139
'67.##8.40.24':139
'67.##8.191.6':139
'67.##8.60.245':445
'67.##8.212.183':445
'67.##8.218.86':445
'67.##8.72.167':445
'67.##8.240.152':445
'67.##8.129.86':445
'67.##8.204.128':445
'67.##8.243.1':445
'67.#68.3.9':445
'67.##8.26.170':445
'67.##8.41.57':445
'67.##8.187.41':139
'67.##8.8.187':139
'67.##8.180.23':139
'67.##8.39.48':139
'67.##8.129.123':139
'67.##8.99.51':139
'67.##8.99.184':445
'67.##8.190.43':445
'67.##8.157.46':445
'67.##8.250.250':445
'67.##8.46.251':445
'67.##8.231.24':139
'67.##8.172.237':445
'67.##8.95.172':445
'67.##8.237.148':445
'67.##8.80.175':445
'67.##8.149.80':445
'67.##8.160.95':445
'67.##8.188.236':139
'67.##8.176.135':139
'67.##8.37.96':445
'67.##8.5.105':445
'67.##8.36.233':445
'67.##8.24.172':445
'67.##8.245.104':445
'67.##8.43.133':445
'67.##8.66.94':445
'67.##8.206.78':445
'67.##8.183.48':445
'67.##8.128.84':445
'67.##8.197.107':445
'67.##8.84.44':445
'67.##8.83.150':445
'67.##8.44.32':445
'67.##8.66.19':139
'67.##8.212.183':139
'67.##8.129.86':139
'67.##8.60.245':139
'67.##8.240.152':139
'67.##8.218.86':139
'67.##8.26.170':139
'67.##8.243.1':139
'67.##8.223.242':139
'67.##8.204.128':139
'67.##8.41.57':139
'67.#68.3.9':139
'67.##8.66.19':445
'67.##8.251.147':445
'67.##8.176.135':445
'67.##8.251.147':139
'67.##8.188.236':445
'67.##8.250.250':139
'67.##8.190.43':139
'67.##8.72.167':139
'67.##8.99.184':139
'67.##8.46.251':139
'67.##8.157.46':139
'67.##8.223.242':445
'67.##8.51.49':139
'67.##8.63.68':139
'67.##8.157.118':139
'67.##8.122.79':139
'67.##8.102.54':139
'67.##8.108.17':139
'67.##8.83.40':139
'67.#68.5.26':139
'67.##8.40.207':139
'67.##8.17.99':139
'67.##8.27.175':139
'67.##8.164.234':139
'67.##8.148.165':139
'67.##8.234.14':139
'67.##8.107.5':139
'67.##8.110.104':139
'67.##8.213.18':139
'67.##8.149.220':139
'67.##8.142.131':139
'67.#68.4.71':139
'67.##8.151.59':139
'67.##8.188.248':139
'67.##8.167.183':139
'67.##8.46.192':139
'67.##8.212.69':139
'67.##8.50.244':139
'67.##8.119.220':139
'67.#68.14.8':139
'67.##8.135.156':445
'67.##8.27.242':445
'67.##8.187.129':445
'67.##8.52.33':445
'67.##8.133.190':445
'67.##8.33.90':445
'67.##8.230.35':139
'67.##8.114.247':139
'67.##8.204.111':139
'67.##8.158.17':139
'67.##8.237.135':139
'67.##8.200.29':139
'67.##8.181.72':139
'67.##8.219.180':139
'67.#68.73.1':139
'67.#68.4.3':139
'67.##8.52.11':139
'67.##8.118.100':139
'67.##8.183.156':445
'67.##8.137.209':445
'67.##8.30.102':445
'67.##8.235.199':445
'67.##8.203.235':445
'67.##8.108.195':445
'67.##8.183.180':445
'67.##8.119.151':445
'67.##8.90.43':445
'67.##8.134.115':445
'67.##8.245.191':445
'67.##8.28.231':445
'67.##8.137.194':445
'67.##8.246.241':445
'67.##8.231.24':445
'67.##8.98.253':445
'67.##8.21.56':445
'67.##8.116.190':445
'67.##8.200.25':445
'67.##8.40.24':445
'67.#68.8.43':445
'67.##8.223.77':445
'67.##8.137.170':445
'67.##8.41.164':445
'67.##8.135.156':139
'67.##8.194.199':445
'67.##8.112.227':445
'67.##8.40.161':445
'67.##8.133.190':139
'67.##8.187.129':139
'67.##8.242.12':139
'67.##8.27.242':139
'67.##8.33.90':139
'67.##8.52.33':139
'67.##8.180.23':445
'67.##8.187.41':445
'67.##8.129.123':445
'67.##8.191.6':445
'67.##8.39.48':445
'67.##8.8.187':445
'67.##8.194.199':139
'67.##8.41.164':139
'67.##8.40.161':139
'67.##8.99.51':445
'67.##8.112.227':139
'67.##8.86.196':445
'67.##8.19.54':445
'67.#68.7.9':445
'67.##8.44.160':445
'67.##8.149.5':445
'67.##8.171.95':445
'67.##8.187.59':445
'67.##8.176.186':445
'67.##8.59.53':445
'67.##8.148.97':445
'67.##8.158.50':445
'67.##8.150.43':139
'67.##8.20.92':139
'67.##8.213.86':139
'67.##8.136.51':139
'67.##8.165.99':139
'67.##8.13.40':445
'67.##8.112.98':445
'67.##8.209.160':445
'67.##8.122.88':445
'67.##8.218.139':445
'67.##8.160.12':445
'67.##8.250.176':445
'67.##8.84.146':445
'67.##8.76.85':445
'67.##8.131.200':445
'67.##8.144.169':445
'67.##8.156.185':445
'67.##8.13.155':445
'67.##8.137.4':445
'67.##8.146.129':445
'67.##8.131.45':445
'67.##8.21.30':445
'67.#68.3.13':445
'67.##8.107.201':445
'67.##8.53.107':445
'67.##8.200.227':445
'67.##8.249.250':445
'67.##8.227.249':445
'67.##8.138.17':445
'67.##8.119.87':445
'67.##8.64.51':445
'67.##8.3.221':445
'67.##8.188.38':445
'67.##8.133.33':445
'67.##8.35.241':139
'67.##8.59.53':139
'67.##8.187.59':139
'67.##8.158.50':139
'67.##8.171.95':139
'67.##8.148.97':139
'67.##8.176.186':139
'67.##8.200.227':139
'67.##8.107.201':139
'67.##8.227.249':139
'67.##8.250.176':139
'67.##8.249.250':139
'67.##8.218.139':139
'67.##8.209.160':139
'67.##8.13.40':139
'67.##8.122.88':139
'67.##8.112.98':139
'67.##8.160.12':139
'67.##8.86.196':139
'67.##8.19.54':139
'67.#68.7.9':139
'67.##8.44.160':139
'67.##8.149.5':139
'67.##8.53.107':139
'67.##8.131.45':139
'67.##8.137.4':139
'67.#68.3.13':139
'67.##8.13.155':139
'67.##8.21.30':139
'67.##8.146.129':139
'67.##8.51.143':139
'67.##8.98.51':139
'67.##8.5.250':139
'67.##8.89.134':139
'67.##8.48.115':139
'67.##8.3.221':139
'67.##8.119.87':139
'67.##8.133.33':139
'67.##8.138.17':139
'67.##8.188.38':139
'67.##8.64.51':139
'67.##8.84.146':139
'67.##8.76.85':139
'67.##8.131.200':139
'67.##8.144.169':139
'67.##8.156.185':139
'67.##8.89.134':445
'67.##8.160.95':139
'67.##8.5.105':139
'67.##8.95.172':139
'67.##8.237.148':139
'67.##8.172.237':139
'67.##8.36.233':139
'67.##8.254.26':445
'67.##8.57.86':445
'67.##8.184.201':445
'67.##8.37.96':139
'67.##8.18.40':445
'67.##8.183.48':139
'67.##8.83.150':139
'67.##8.245.104':139
'67.##8.43.133':139
'67.##8.24.172':139
'67.##8.44.32':139
'67.##8.80.175':139
'67.##8.149.80':139
'67.##8.197.107':139
'67.##8.84.44':139
'67.##8.128.84':139
'67.##8.73.142':445
'67.##8.84.103':445
'67.##8.32.79':445
'67.##8.186.222':445
'67.##8.22.214':445
'67.##8.198.61':445
'67.##8.58.201':445
'67.##8.62.67':445
'67.##8.50.53':445
'67.##8.216.70':445
'67.##8.227.213':445
'67.##8.199.208':445
'67.##8.25.70':445
'67.##8.93.192':445
'67.##8.162.36':445
'67.##8.124.145':445
'67.##8.36.124':445
'67.##8.18.121':445
'67.##8.23.101':445
'67.##8.214.183':445
'67.##8.125.182':445
'67.#68.70.4':445
'67.##8.108.32':445
'67.##8.206.78':139
'67.##8.48.115':9988
'67.##8.5.250':9988
'67.##8.131.45':9988
'67.##8.149.5':9988
'67.##8.13.40':9988
'67.##8.20.92':9988
'67.##8.57.86':139
'67.##8.73.142':139
'67.##8.254.26':139
'67.##8.18.40':139
'67.##8.184.201':139
'67.##8.98.51':445
'67.##8.35.241':445
'67.##8.51.143':445
'67.##8.48.115':445
'67.##8.5.250':445
'67.##8.136.51':445
'67.##8.20.92':445
'67.##8.107.201':9988
'67.##8.213.86':445
'67.##8.165.99':445
'67.##8.150.43':445
'67.##8.124.145':139
'67.##8.32.79':139
'67.##8.58.201':139
'67.##8.84.103':139
'67.##8.198.61':139
'67.##8.186.222':139
'67.##8.227.213':139
'67.##8.50.53':139
'67.##8.66.94':139
'67.##8.62.67':139
'67.##8.199.208':139
'67.##8.216.70':139
'67.##8.93.192':139
'67.##8.18.121':139
'67.##8.25.70':139
'67.##8.36.124':139
'67.##8.162.36':139
'67.#68.70.4':139
'67.##8.214.183':139
'67.##8.22.214':139
'67.##8.23.101':139
'67.##8.108.32':139
'67.##8.125.182':139

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial