Trojan.Starman.6458

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WER362c.dir00\svchost.exe.mdmp 16325836412032324

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER362c.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'19#.#6.217.238':445
'19#.#6.202.149':445
'19#.#6.149.105':445
'19#.#6.51.94':445
'19#.#6.163.202':445
'19#.#6.69.73':445
'19#.#6.210.57':445
'19#.#6.169.163':445
'19#.#6.107.193':445
'19#.#6.180.144':445
'19#.#6.139.46':445
'19#.#6.160.210':445
'19#.#6.42.194':445
'19#.#6.107.42':445
'19#.#6.157.180':445
'19#.#6.16.199':445
'19#.#6.21.62':445
'19#.#6.18.187':445
'19#.#6.209.17':445
'19#.#6.75.23':445
'19#.#6.130.62':445
'19#.#6.55.226':445
'19#.66.2.18':445
'19#.#6.169.32':445
'19#.#6.30.131':445
'19#.#6.6.103':445
'19#.#6.242.214':445
'19#.#6.22.122':445
'19#.#6.8.193':445
'19#.#6.87.114':445
'19#.#6.245.6':445
'19#.#6.173.148':445
'19#.#6.167.182':445
'19#.#6.173.5':445
'19#.#6.61.39':445
'19#.#6.139.171':445
'19#.#6.49.50':445
'19#.#6.51.131':445
'19#.#6.66.66':445
'19#.#6.167.182':139
'19#.#6.87.114':139
'19#.#6.210.57':139
'19#.#6.173.148':139
'19#.#6.245.6':139
'19#.#6.51.131':139
'19#.#6.61.39':139
'19#.#6.173.5':139
'19#.#6.49.50':139
'19#.#6.69.73':139
'19#.#6.149.105':139
'19#.#6.51.94':139
'19#.#6.21.62':139
'19#.#6.180.144':139
'19#.#6.217.238':139
'19#.#6.169.163':139
'19#.#6.107.193':139
'19#.#6.202.149':139
'19#.#6.163.202':139
'19#.#6.29.174':139
'19#.#6.31.170':139
'19#.#6.6.103':139
'19#.#6.103.141':139
'19#.#6.115.186':445
'19#.#6.156.244':445
'19#.#6.107.53':445
'19#.#6.129.12':445
'19#.#6.109.83':445
'19#.#6.30.131':139
'19#.#6.55.226':139
'19#.66.2.18':139
'19#.#6.139.171':139
'19#.#6.8.193':139
'19#.#6.75.23':139
'19#.#6.242.214':139
'19#.#6.22.122':139
'19#.#6.130.62':139
'19#.#6.169.32':139
'19#.#6.103.141':445
'19#.#6.129.193':139
'19#.#6.172.129':139
'19#.#6.142.195':139
'19#.#6.193.142':139
'19#.#6.4.144':139
'19#.#6.41.217':139
'19#.#6.158.44':445
'19#.#6.60.199':139
'19#.#6.185.204':139
'19#.#6.32.74':139
'19#.#6.135.152':139
'19#.#6.10.223':139
'19#.#6.41.143':139
'19#.#6.183.220':139
'19#.#6.254.70':139
'19#.66.62.3':139
'19#.#6.27.180':139
'19#.#6.229.37':139
'19#.#6.15.156':139
'19#.#6.70.236':445
'19#.#6.170.192':445
'19#.#6.121.189':445
'19#.#6.253.127':445
'19#.#6.192.224':445
'19#.#6.38.80':445
'19#.#6.79.177':445
'19#.#6.74.225':445
'19#.#6.12.47':445
'19#.#6.78.101':445
'19#.#6.12.169':445
'19#.#6.42.107':445
'19#.#6.124.26':445
'19#.#6.185.113':445
'19#.#6.35.100':445
'19#.#6.140.233':445
'19#.#6.100.141':445
'19#.#6.191.188':445
'19#.#6.234.4':445
'19#.#6.75.162':139
'19#.#6.185.113':139
'19#.#6.12.169':139
'19#.#6.158.44':139
'19#.#6.124.26':139
'19#.#6.42.107':139
'19#.#6.234.4':139
'19#.#6.140.233':139
'19#.#6.35.100':139
'19#.#6.191.188':139
'19#.#6.13.39':445
'19#.#6.213.31':139
'19#.#6.117.117':139
'19#.#6.29.174':445
'19#.#6.31.170':445
'19#.#6.39.52':139
'19#.#6.117.117':445
'19#.#6.39.52':445
'19#.#6.13.39':139
'19#.#6.213.31':445
'19#.#6.125.95':139
'19#.#6.54.106':139
'19#.#6.79.177':139
'19#.#6.31.148':139
'19#.#6.216.139':139
'19#.#6.172.222':139
'19#.#6.163.167':139
'19#.#6.92.155':139
'19#.#6.224.128':139
'19#.#6.38.80':139
'19#.#6.121.189':139
'19#.#6.253.127':139
'19#.#6.100.141':139
'19#.#6.78.101':139
'19#.#6.70.236':139
'19#.#6.74.225':139
'19#.#6.12.47':139
'19#.#6.170.192':139
'19#.#6.192.224':139
'19#.#6.45.224':445
'19#.#6.103.22':445
'19#.#6.24.184':139
'19#.66.60.5':139
'19#.#6.73.216':445
'19#.#6.157.47':445
'19#.#6.224.228':445
'19#.#6.41.23':445
'19#.#6.61.110':445
'19#.#6.123.147':139
'19#.#6.57.76':139
'19#.#6.215.57':139
'19#.#6.231.247':139
'19#.#6.76.231':139
'19#.#6.181.30':139
'19#.#6.17.215':139
'19#.#6.41.136':139
'19#.#6.117.196':139
'19#.#6.115.120':139
'19#.#6.85.57':445
'19#.#6.97.85':445
'19#.#6.83.18':445
'19#.#6.43.223':445
'19#.#6.48.76':445
'19#.#6.186.29':445
'19#.#6.165.82':445
'19#.#6.236.169':445
'19#.#6.148.191':445
'19#.#6.120.141':445
'19#.#6.7.216':445
'19#.#6.139.252':445
'19#.#6.11.137':445
'19#.#6.43.12':445
'19#.#6.156.156':445
'19#.#6.219.158':445
'19#.#6.141.219':445
'19#.#6.173.91':445
'19#.#6.52.252':445
'19#.#6.248.99':139
'19#.#6.173.91':139
'19#.#6.52.252':139
'19#.#6.139.252':139
'19#.#6.156.156':139
'19#.#6.219.158':139
'19#.#6.83.18':139
'19#.#6.43.223':139
'19#.#6.141.219':139
'19#.#6.120.141':139
'19#.#6.7.216':139
'19#.#6.73.216':139
'19#.#6.41.23':139
'19#.#6.45.224':139
'19#.#6.103.22':139
'19#.#6.61.110':139
'19#.#6.11.137':139
'19#.#6.43.12':139
'19#.#6.157.47':139
'19#.#6.224.228':139
'19#.#6.116.33':139
'19#.#6.158.112':139
'19#.#6.235.210':139
'19#.#6.10.165':139
'19#.#6.112.102':139
'19#.#6.190.89':139
'19#.#6.82.205':139
'19#.#6.169.6':139
'19#.#6.89.153':139
'19#.#6.254.2':139
'19#.#6.48.76':139
'19#.#6.236.169':139
'19#.#6.85.57':139
'19#.#6.97.85':139
'19#.#6.148.191':139
'19#.#6.137.48':139
'19#.#6.154.112':139
'19#.#6.186.29':139
'19#.#6.165.82':139
'19#.#6.137.48':445
'19#.#6.201.140':445
'19#.#6.36.222':445
'19#.#6.224.207':139
'19#.#6.1.212':445
'19#.#6.207.251':445
'19#.#6.134.187':139
'19#.#6.78.19':139
'19#.#6.224.207':445
'19#.#6.187.225':139
'19#.#6.207.251':139
'19#.#6.137.48':9988
'19#.#6.154.112':9988
'19#.#6.148.191':9988
'19#.#6.165.82':9988
'19#.#6.112.102':9988
'19#.#6.201.140':139
'19#.#6.36.222':139
'19#.#6.231.247':9988
'19#.#6.1.212':139
'19#.#6.107.42':139
'19#.#6.139.46':139
'19#.#6.66.66':139
'19#.#6.42.194':139
'19#.#6.160.210':139
'19#.#6.209.17':139
'19#.#6.16.199':139
'19#.#6.157.180':139
'19#.#6.18.187':139
'19#.#6.107.53':139
'19#.#6.134.187':445
'19#.#6.78.19':445
'19#.#6.187.14':139
'19#.#6.187.225':445
'19#.#6.187.14':445
'19#.#6.109.83':139
'19#.#6.156.244':139
'19#.#6.115.186':139
'19#.#6.129.12':139
'19#.#6.186.29':9988
'19#.#6.231.247':445
'19#.#6.76.231':445
'19#.#6.82.205':445
'19#.#6.248.99':445
'19#.#6.57.76':445
'19#.#6.117.196':445
'19#.#6.115.120':445
'19#.#6.215.57':445
'19#.#6.181.30':445
'19#.#6.190.89':445
'19#.#6.235.210':445
'19#.#6.10.165':445
'19#.#6.154.112':445
'19#.#6.254.2':445
'19#.#6.116.33':445
'19#.#6.169.6':445
'19#.#6.89.153':445
'19#.#6.158.112':445
'19#.#6.112.102':445
'19#.#6.173.91':9988
'19#.#6.219.158':9988
'19#.#6.157.47':9988
'19#.#6.7.216':9988
'19#.#6.141.219':9988
'19#.#6.85.57':9988
'19#.#6.236.169':9988
'19#.#6.120.141':9988
'19#.#6.83.18':9988
'19#.#6.61.110':9988
'19#.#6.123.147':445
'19#.#6.24.184':445
'19#.#6.17.215':445
'19#.#6.41.136':445
'19#.66.60.5':445
'19#.#6.103.22':9988
'19#.#6.41.23':9988
'19#.#6.73.216':9988
'19#.#6.45.224':9988

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial