Trojan.Starman.6617

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER5fd2.dir00\svchost.exe.mdmp 16325836412029304

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER5fd2.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'19#.#31.52.127':139
'19#.#31.149.178':139
'19#.#31.115.205':139
'19#.#31.30.213':139
'19#.#31.252.62':139
'19#.#31.37.148':139
'19#.#31.194.209':139
'19#.#31.230.202':139
'19#.#31.101.102':139
'19#.#31.26.68':139
'19#.#31.7.129':139
'19#.#31.15.161':445
'19#.#31.228.14':445
'19#.#31.19.49':445
'19#.#31.70.60':445
'19#.#31.8.55':445
'19#.#31.4.140':139
'19#.#31.30.114':139
'19#.#31.77.50':445
'19#.#31.126.178':445
'19#.#31.172.228':445
'19#.#31.230.202':445
'19#.#31.37.148':445
'19#.#31.26.68':445
'19#.#31.149.178':445
'19#.#31.101.102':445
'19#.#31.67.191':445
'19#.#31.7.116':445
'19#.#31.50.95':445
'19#.#31.194.209':445
'19#.#31.126.194':445
'19#.#31.52.127':445
'19#.#31.7.116':139
'19#.#31.4.140':445
'19#.#31.67.191':139
'19#.#31.126.194':139
'19#.#31.50.95':139
'19#.#31.252.62':445
'19#.#31.115.205':445
'19#.#31.30.213':445
'19#.#31.30.114':445
'19#.#31.7.129':445
'19#.#31.83.90':445
'19#.#31.126.178':139
'19#.#31.172.228':139
'19#.#31.228.14':139
'19#.#31.19.49':139
'19#.#31.15.161':139
'19#.#31.103.174':445
'19#.#31.50.136':445
'19#.#31.142.151':445
'19#.#31.77.50':139
'19#.#31.151.27':445
'19#.#31.8.55':139
'19#.#31.62.66':139
'19#.#31.47.28':139
'19#.#31.206.118':139
'19#.#31.18.181':139
'19#.#31.46.222':139
'19#.#31.83.90':139
'19#.#31.70.60':139
'19#.#31.91.154':139
'19#.#31.74.249':139
'19#.#31.5.213':139
'19#.#31.46.222':445
'19#.#31.206.118':445
'19#.#31.18.181':445
'19#.#31.75.210':445
'19#.#31.208.47':445
'19#.#31.5.213':445
'19#.#31.91.154':445
'19#.#31.74.249':445
'19#.#31.62.66':445
'19#.#31.47.28':445
'19#.#31.168.78':445
'19#.#31.60.240':445
'19#.#31.160.60':445
'19#.#31.6.171':445
'19#.#31.100.171':445
'19#.#31.88.11':445
'19#.#31.156.238':445
'19#.#31.12.39':445
'19#.#31.34.227':445
'19#.#31.44.205':445
'19#.#31.12.49':445
'19#.#31.6.248':445
'19#.#31.206.148':445
'19#.#31.108.234':445
'19#.#31.44.72':445
'19#.#31.57.67':445
'19#.#31.86.246':445
'19#.#31.189.97':445
'19#.#31.181.227':445
'19#.#31.37.117':445
'19#.#31.57.134':445
'19#.#31.68.131':445
'19#.#31.87.199':445
'19#.#31.135.87':445
'19#.#31.199.163':445
'19#.#31.55.36':445
'19#.#31.198.97':445
'19#.#31.241.246':445
'19#.#31.10.225':445
'19#.#31.72.68':445
'19#.#31.83.135':445
'19#.#31.168.220':445
'19#.#31.102.23':139
'19#.#31.179.189':139
'19#.#31.29.116':139
'19#.#31.231.16':139
'19#.#31.51.101':139
'19#.#31.185.103':139
'19#.#31.223.126':139
'19#.#31.89.206':139
'19#.#31.125.98':139
'19#.#31.205.36':139
'19#.#31.117.105':139
'19#.#31.100.65':445
'19#.#31.58.215':139
'19#.#31.205.158':445
'19#.#31.15.156':445
'19#.#31.121.106':445
'19#.#31.145.159':139
'19#.#31.184.69':139
'19#.#31.77.195':139
'19#.#31.57.93':139
'19#.#31.63.129':139
'19#.#31.12.136':445
'19#.#31.83.135':139
'19#.#31.168.220':139
'19#.#31.135.87':139
'19#.#31.199.163':139
'19#.#31.87.199':139
'19#.#31.68.131':139
'19#.#31.44.72':139
'19#.#31.10.225':139
'19#.#31.72.68':139
'19#.#31.241.246':139
'19#.#31.198.97':139
'19#.#31.60.35':139
'19#.#31.26.181':139
'19#.#31.38.123':139
'19#.#31.173.72':139
'19#.#31.253.135':139
'19#.#31.12.136':139
'19#.#31.55.36':139
'19#.#31.121.163':139
'19#.#31.141.72':139
'19#.#31.15.57':139
'19#.#31.253.135':445
'19#.#31.38.123':445
'19#.#31.173.72':445
'19#.#31.205.158':139
'19#.#31.100.65':139
'19#.#31.15.57':445
'19#.#31.121.163':445
'19#.#31.141.72':445
'19#.#31.60.35':445
'19#.#31.26.181':445
'19#.#31.121.106':139
'19#.#31.206.148':139
'19#.#31.37.117':139
'19#.#31.6.248':139
'19#.#31.57.67':139
'19#.#31.108.234':139
'19#.#31.189.97':139
'19#.#31.15.156':139
'19#.#31.86.246':139
'19#.#31.57.134':139
'19#.#31.181.227':139
'19#.#31.75.107':445
'19#.#31.116.243':445
'19#.#31.50.247':445
'19#.#31.106.172':445
'19#.#31.199.74':445
'19#.#31.248.124':445
'19#.#31.165.145':445
'19#.#31.194.36':445
'19#.#31.98.98':445
'19#.#31.134.213':445
'19#.#31.52.48':445
'19#.#31.32.145':139
'19#.#31.189.210':139
'19#.#31.100.229':139
'19#.#31.254.68':139
'19#.#31.182.98':139
'19#.#31.47.182':445
'19#.#31.27.92':445
'19#.#31.71.148':139
'19#.#31.181.9':139
'19#.#31.58.160':139
'19#.#31.149.21':445
'19#.#31.50.90':445
'19#.#31.22.38':445
'19#.#31.25.237':445
'19#.#31.89.70':445
'19#.#31.133.43':445
'19#.#31.57.100':445
'19#.#31.69.234':445
'19#.#31.20.30':445
'19#.#31.50.135':445
'19#.#31.167.60':445
'19#.#31.16.145':445
'19#.#31.3.141':445
'19#.#31.240.34':445
'19#.#31.16.87':445
'19#.#31.168.239':445
'19#.#31.171.97':445
'19#.#31.73.246':445
'19#.#31.245.28':445
'19#.#31.90.207':445
'19#.#31.22.243':445
'19#.#31.68.126':139
'19#.#31.240.34':139
'19#.#31.168.239':139
'19#.#31.16.87':139
'19#.#31.248.124':139
'19#.#31.165.145':139
'19#.#31.22.243':139
'19#.#31.245.28':139
'19#.#31.90.207':139
'19#.#31.16.145':139
'19#.#31.3.141':139
'19#.#31.194.36':139
'19#.#31.75.107':139
'19#.#31.199.74':139
'19#.#31.27.92':139
'19#.#31.47.182':139
'19#.#31.52.48':139
'19#.#31.98.98':139
'19#.#31.134.213':139
'19#.#31.116.243':139
'19#.#31.106.172':139
'19#.#31.50.247':139
'19#.#31.127.166':139
'19#.#31.147.231':139
'19#.#31.31.137':139
'19#.#31.133.43':139
'19#.#31.57.100':139
'19#.#31.175.81':139
'19#.#31.35.166':139
'19#.#31.212.80':139
'19#.#31.101.244':139
'19#.#31.80.249':139
'19#.#31.69.234':139
'19#.#31.25.237':139
'19#.#31.89.70':139
'19#.#31.167.60':139
'19#.#31.171.97':139
'19#.#31.73.246':139
'19#.#31.20.30':139
'19#.#31.50.135':139
'19#.#31.50.90':139
'19#.#31.22.38':139
'19#.#31.149.21':139
'19#.#31.58.157':445
'19#.#31.202.197':445
'19#.#31.15.232':445
'19#.#31.41.2':445
'19#.#31.6.74':445
'19#.#31.66.58':445
'19#.#31.129.153':445
'19#.#31.85.223':445
'19#.#31.16.8':445
'19#.#31.223.63':445
'19#.#31.235.241':445
'19#.#31.129.153':139
'19#.#31.62.23':139
'19#.#31.66.58':139
'19#.#31.223.63':139
'19#.#31.85.223':139
'19#.#31.84.249':445
'19#.#31.134.153':445
'19#.#31.95.253':139
'19#.#31.11.14':139
'19#.#31.23.141':139
'19#.#31.12.49':139
'19#.#31.34.227':139
'19#.#31.44.205':139
'19#.#31.60.240':139
'19#.#31.160.60':139
'19#.#31.75.210':139
'19#.#31.208.47':139
'19#.#31.168.78':139
'19#.#31.156.238':139
'19#.#31.12.39':139
'19#.#31.6.171':139
'19#.#31.95.253':445
'19#.#31.151.27':139
'19#.#31.23.141':445
'19#.#31.62.23':445
'19#.#31.11.14':445
'19#.#31.100.171':139
'19#.#31.88.11':139
'19#.#31.50.136':139
'19#.#31.142.151':139
'19#.#31.103.174':139
'19#.#31.202.197':139
'19#.#31.181.9':445
'19#.#31.58.160':445
'19#.#31.189.210':445
'19#.#31.100.229':445
'19#.#31.32.145':445
'19#.#31.52.48':9988
'19#.#31.106.172':9988
'19#.#31.27.92':9988
'19#.#31.71.148':445
'19#.#31.199.74':9988
'19#.#31.182.98':445
'19#.#31.101.244':445
'19#.#31.80.249':445
'19#.#31.147.231':445
'19#.#31.31.137':445
'19#.#31.127.166':445
'19#.#31.68.126':445
'19#.#31.254.68':445
'19#.#31.35.166':445
'19#.#31.212.80':445
'19#.#31.175.81':445
'19#.#31.134.153':139
'19#.#31.235.241':139
'19#.#31.84.249':139
'19#.#31.50.90':9988
'19#.#31.57.100':9988
'19#.#31.58.157':139
'19#.#31.16.8':139
'19#.#31.15.232':139
'19#.#31.41.2':139
'19#.#31.6.74':139
'19#.#31.171.97':9988
'19#.#31.248.124':9988
'19#.#31.165.145':9988
'19#.#31.194.36':9988
'19#.#31.50.247':9988
'19#.#31.134.213':9988
'19#.#31.22.243':9988
'19#.#31.149.21':9988
'19#.#31.16.145':9988
'19#.#31.16.87':9988
'19#.#31.3.141':9988

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial