Trojan.Starman.5157

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER7a2e.dir00\svchost.exe.mdmp 16325836412032116

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER7a2e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'21#.#59.219.214':139
'21#.#59.168.165':139
'21#.#59.33.86':139
'21#.#59.213.100':139
'21#.#59.92.92':139
'21#.#59.49.55':139
'21#.#59.127.4':445
'21#.#59.12.122':445
'21#.#59.9.242':445
'21#.#59.236.30':139
'21#.#59.238.235':139
'21#.#59.147.243':139
'21#.#59.208.85':139
'21#.#59.42.209':139
'21#.#59.86.34':139
'21#.#59.174.89':139
'21#.#59.34.221':139
'21#.#59.42.21':139
'21#.#59.78.175':139
'21#.#59.249.51':139
'21#.#59.250.128':139
'21#.#59.213.77':139
'21#.#59.31.220':139
'21#.#59.66.91':445
'21#.#59.183.65':445
'21#.#59.80.11':445
'21#.#59.182.178':445
'21#.#59.101.36':445
'21#.#59.10.34':445
'21#.#59.21.19':445
'21#.#59.29.76':445
'21#.#59.161.50':445
'21#.#59.1.231':445
'21#.#59.121.194':445
'21#.#59.119.185':445
'21#.#59.150.66':445
'21#.#59.4.252':445
'21#.#59.118.234':445
'21#.#59.51.246':445
'21#.#59.233.250':445
'21#.#59.160.77':445
'21#.#59.2.114':445
'21#.#59.82.199':445
'21#.#59.14.230':445
'21#.#59.13.103':445
'21#.#59.160.35':445
'21#.#59.84.56':139
'21#.#59.64.204':139
'21#.#59.241.167':445
'21#.#59.244.100':139
'21#.#59.241.167':139
'21#.#59.149.70':139
'21#.#59.149.70':445
'21#.#59.127.4':139
'21#.#59.12.122':139
'21#.#59.9.242':139
'21#.#59.244.100':445
'21#.#59.64.204':445
'21#.#59.192.145':445
'21#.#59.59.227':445
'21#.#59.236.18':445
'21#.#59.185.156':445
'21#.#59.101.50':445
'21#.#59.156.242':445
'21#.#59.160.18':445
'21#.#59.127.197':445
'21#.#59.19.103':445
'21#.#59.21.170':445
'21#.#59.5.160':445
'21#.#59.100.5':445
'21#.#59.66.91':139
'21#.#59.183.65':139
'21#.#59.80.11':139
'21#.#59.182.178':139
'21#.#59.101.36':139
'21#.#59.10.34':139
'21#.#59.21.19':139
'21#.#59.29.76':139
'21#.#59.161.50':139
'21#.#59.1.231':139
'21#.#59.121.194':139
'21#.#59.119.185':139
'21#.#59.150.66':139
'21#.#59.4.252':139
'21#.#59.118.234':139
'21#.#59.51.246':139
'21#.#59.233.250':139
'21#.#59.160.77':139
'21#.#59.2.114':139
'21#.#59.82.199':139
'21#.#59.14.230':139
'21#.#59.13.103':139
'21#.#59.160.35':139
'21#.#59.207.6':139
'21#.#59.254.206':139
'21#.#59.207.63':139
'21#.#59.145.206':139
'21#.#59.71.44':139
'21#.#59.132.132':139
'21#.#59.74.20':139
'21#.#59.253.4':139
'21#.#59.27.46':139
'21#.#59.254.196':139
'21#.#59.84.200':139
'21#.#59.224.95':139
'21#.#59.19.195':139
'21#.#59.17.108':139
'21#.#59.235.17':139
'21#.#59.233.36':139
'21#.#59.82.106':139
'21#.#59.108.221':139
'21#.#59.85.215':139
'21#.#59.249.69':139
'21#.#59.17.128':139
'21#.#59.175.246':139
'21#.#59.3.95':139
'21#.#59.5.237':445
'21#.#59.114.204':445
'21#.#59.29.181':445
'21#.#59.131.75':445
'21#.#59.45.18':445
'21#.#59.24.234':445
'21#.#59.130.133':445
'21#.#59.18.175':445
'21#.#59.132.240':445
'21#.#59.128.192':445
'21#.#59.50.104':445
'21#.#59.18.15':445
'21#.#59.216.71':139
'21#.#59.111.219':139
'21#.#59.215.56':139
'21#.#59.146.253':139
'21#.#59.235.212':139
'21#.#59.13.148':139
'21#.#59.100.213':445
'21#.#59.7.49':445
'21#.#59.183.17':445
'21#.#59.205.82':445
'21#.#59.25.205':445
'21#.#59.87.8':139
'21#.#59.33.86':445
'21#.#59.219.214':445
'21#.#59.92.92':445
'21#.#59.147.243':445
'21#.#59.213.100':445
'21#.#59.168.165':445
'21#.#59.32.208':139
'21#.#59.57.4':139
'21#.#59.238.235':445
'21#.#59.49.55':445
'21#.#59.236.30':445
'21#.#59.249.51':445
'21#.#59.86.34':445
'21#.#59.208.85':445
'21#.#59.34.221':445
'21#.#59.84.56':445
'21#.#59.174.89':445
'21#.#59.42.209':445
'21#.#59.250.128':445
'21#.#59.78.175':445
'21#.#59.31.220':445
'21#.#59.42.21':445
'21#.#59.213.77':445
'21#.#59.5.237':139
'21#.#59.114.204':139
'21#.#59.29.181':139
'21#.#59.131.75':139
'21#.#59.45.18':139
'21#.#59.24.234':139
'21#.#59.130.133':139
'21#.#59.18.175':139
'21#.#59.132.240':139
'21#.#59.128.192':139
'21#.#59.50.104':139
'21#.#59.18.15':139
'21#.#59.57.4':445
'21#.#59.69.234':445
'21#.#59.32.208':445
'21#.#59.69.234':139
'21#.#59.74.254':139
'21#.#59.74.254':445
'21#.#59.100.213':139
'21#.#59.7.49':139
'21#.#59.183.17':139
'21#.#59.205.82':139
'21#.#59.25.205':139
'21#.#59.178.155':445
'21#.#59.229.251':445
'21#.#59.243.25':445
'21#.#59.190.237':445
'21#.#59.40.191':445
'21#.#59.66.23':445
'21#.#59.117.115':445
'21#.#59.6.118':445
'21#.#59.251.28':445
'21#.#59.205.167':445
'21#.#59.63.111':445
'21#.#59.237.37':445
'21#.#59.38.232':139
'21#.#59.189.243':445
'21#.#59.45.48':139
'21#.#59.126.53':139
'21#.#59.75.106':139
'21#.#59.212.247':445
'21#.#59.204.7':445
'21#.#59.37.171':445
'21#.#59.9.91':445
'21#.#59.224.45':445
'21#.#59.247.165':445
'21#.#59.81.136':445
'21#.#59.112.194':445
'21#.#59.35.95':445
'21#.#59.235.40':445
'21#.#59.94.235':445
'21#.#59.96.179':445
'21#.#59.255.205':445
'21#.#59.15.150':445
'21#.#59.153.142':445
'21#.#59.13.245':445
'21#.#59.12.110':445
'21#.#59.197.107':445
'21#.#59.172.44':445
'21#.#59.102.229':445
'21#.#59.99.100':445
'21#.#59.169.59':445
'21#.#59.231.179':445
'21#.#59.6.108':445
'21#.#59.78.86':445
'21#.#59.176.3':445
'21#.#59.222.65':445
'21#.#59.219.166':445
'21#.#59.36.213':445
'21#.#59.3.211':139
'21#.#59.63.111':139
'21#.#59.251.28':139
'21#.#59.205.167':139
'21#.#59.229.251':139
'21#.#59.66.23':139
'21#.#59.117.115':139
'21#.#59.99.100':139
'21#.#59.172.44':139
'21#.#59.231.179':139
'21#.#59.6.118':139
'21#.#59.169.59':139
'21#.#59.178.155':139
'21#.#59.204.7':139
'21#.#59.189.243':139
'21#.#59.9.91':139
'21#.#59.224.45':139
'21#.#59.212.247':139
'21#.#59.247.165':139
'21#.#59.40.191':139
'21#.#59.243.25':139
'21#.#59.190.237':139
'21#.#59.37.171':139
'21#.#59.237.37':139
'21#.#59.12.110':139
'21#.#59.153.142':139
'21#.#59.13.245':139
'21#.#59.112.194':139
'21#.#59.96.179':139
'21#.#59.255.205':139
'21#.#59.33.163':139
'21#.#59.86.78':139
'21#.#59.155.69':139
'21#.#59.15.150':139
'21#.#59.100.184':139
'21#.#59.81.136':139
'21#.#59.36.213':139
'21#.#59.222.65':139
'21#.#59.219.166':139
'21#.#59.102.229':139
'21#.#59.6.108':139
'21#.#59.78.86':139
'21#.#59.94.235':139
'21#.#59.35.95':139
'21#.#59.235.40':139
'21#.#59.176.3':139
'21#.#59.197.107':139
'21#.#59.225.56':445
'21#.#59.136.237':445
'21#.#59.217.108':445
'21#.#59.91.222':445
'21#.#59.96.16':445
'21#.#59.158.165':445
'21#.#59.39.53':445
'21#.#59.208.206':445
'21#.#59.104.12':445
'21#.#59.194.93':445
'21#.#59.222.193':445
'21#.#59.68.96':445
'21#.#59.236.18':139
'21#.#59.160.18':139
'21#.#59.59.227':139
'21#.#59.156.242':139
'21#.#59.185.156':139
'21#.#59.5.160':139
'21#.#59.19.103':139
'21#.#59.192.145':139
'21#.#59.127.197':139
'21#.#59.100.5':139
'21#.#59.21.170':139
'21#.#59.66.186':445
'21#.#59.75.131':445
'21#.#59.61.124':445
'21#.#59.58.96':445
'21#.#59.18.138':445
'21#.#59.74.231':445
'21#.#59.91.251':445
'21#.#59.154.127':445
'21#.#59.119.254':445
'21#.#59.53.49':445
'21#.#59.120.53':445
'21#.#59.23.110':445
'21#.#59.158.168':445
'21#.#59.184.158':445
'21#.#59.91.243':445
'21#.#59.191.90':445
'21#.#59.172.175':445
'21#.#59.54.26':445
'21#.#59.78.104':445
'21#.#59.144.122':445
'21#.#59.147.137':445
'21#.#59.179.42':445
'21#.#59.66.253':445
'21#.#59.101.50':139
'21#.#59.225.56':139
'21#.#59.136.237':139
'21#.#59.217.108':139
'21#.#59.91.222':139
'21#.#59.96.16':139
'21#.#59.158.165':139
'21#.#59.39.53':139
'21#.#59.208.206':139
'21#.#59.104.12':139
'21#.#59.194.93':139
'21#.#59.222.193':139
'21#.#59.68.96':139
'21#.#59.86.78':445
'21#.#59.3.211':445
'21#.#59.33.163':445
'21#.#59.100.184':445
'21#.#59.155.69':445
'21#.#59.126.53':445
'21#.#59.190.237':9988
'21#.#59.197.107':9988
'21#.#59.38.232':445
'21#.#59.75.106':445
'21#.#59.45.48':445
'21#.#59.66.186':139
'21#.#59.75.131':139
'21#.#59.61.124':139
'21#.#59.58.96':139
'21#.#59.18.138':139
'21#.#59.74.231':139
'21#.#59.91.251':139
'21#.#59.154.127':139
'21#.#59.119.254':139
'21#.#59.53.49':139
'21#.#59.120.53':139
'21#.#59.23.110':139
'21#.#59.158.168':139
'21#.#59.184.158':139
'21#.#59.91.243':139
'21#.#59.191.90':139
'21#.#59.172.175':139
'21#.#59.54.26':139
'21#.#59.78.104':139
'21#.#59.144.122':139
'21#.#59.147.137':139
'21#.#59.179.42':139
'21#.#59.66.253':139

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial