Trojan.Starman.5577

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERb83d.dir00\svchost.exe.mdmp 16325836412032364

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERb83d.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'63.##.230.190':139
'63.#0.3.248':139
'63.#0.77.66':139
'63.##.132.83':139
'63.##.150.140':139
'63.#0.23.41':445
'63.##.103.171':445
'63.#0.71.41':139
'63.#0.168.4':139
'63.##.48.168':139
'63.##.89.117':139
'63.##.133.155':139
'63.##.149.214':139
'63.#0.10.97':139
'63.##.27.172':139
'63.##.89.197':139
'63.##.153.205':139
'63.#0.2.240':139
'63.##.84.113':139
'63.##.115.36':139
'63.#0.7.115':139
'63.##.111.87':445
'63.#0.77.66':445
'63.##.230.190':445
'63.##.150.140':445
'63.##.89.117':445
'63.##.132.83':445
'63.#0.71.41':445
'63.##.84.121':139
'63.##.48.168':445
'63.#0.3.248':445
'63.#0.168.4':445
'63.#0.2.240':445
'63.#0.10.97':445
'63.##.133.155':445
'63.##.89.197':445
'63.#0.1.141':445
'63.##.27.172':445
'63.##.84.113':445
'63.##.153.205':445
'63.#0.7.115':445
'63.##.149.214':445
'63.##.115.36':445
'63.#0.3.129':445
'63.##.183.214':445
'63.##.27.208':445
'63.##.49.100':445
'63.#0.0.105':445
'63.##.250.72':445
'63.##.209.217':445
'63.##.10.227':445
'63.##.42.126':445
'63.#0.81.53':445
'63.#0.46.28':139
'63.#0.62.65':139
'63.##.106.197':139
'63.##.24.155':139
'63.##.127.105':139
'63.##.93.127':139
'63.##.90.145':139
'63.#0.30.90':139
'63.##.194.123':139
'63.##.33.142':139
'63.##.237.70':139
'63.##.118.45':445
'63.##.90.145':445
'63.#0.30.90':445
'63.##.194.123':445
'63.##.33.142':445
'63.##.237.70':445
'63.##.111.87':139
'63.#0.1.141':139
'63.##.103.171':139
'63.#0.46.28':445
'63.#0.23.41':139
'63.##.106.197':445
'63.##.98.111':445
'63.##.203.98':445
'63.##.111.33':445
'63.##.193.117':445
'63.##.33.193':445
'63.##.24.155':445
'63.#0.62.65':445
'63.##.93.127':445
'63.##.104.203':445
'63.##.127.105':445
'63.##.228.71':139
'63.#0.126.1':139
'63.##.55.139':139
'63.#0.13.92':445
'63.##.122.210':139
'63.##.217.165':139
'63.##.218.25':139
'63.#0.69.77':139
'63.##.242.218':139
'63.##.160.135':139
'63.##.144.54':445
'63.##.222.232':445
'63.##.146.223':445
'63.##.232.176':445
'63.##.138.204':445
'63.##.142.163':445
'63.##.78.245':445
'63.##.214.78':445
'63.#0.28.95':445
'63.##.231.146':445
'63.##.147.91':445
'63.#0.75.69':139
'63.##.55.139':445
'63.##.228.71':445
'63.##.122.210':445
'63.##.94.246':139
'63.#0.92.56':139
'63.#0.69.77':445
'63.##.217.165':445
'63.##.160.135':445
'63.#0.126.1':445
'63.##.242.218':445
'63.##.245.183':139
'63.#0.3.58':139
'63.##.88.104':139
'63.##.45.103':139
'63.##.127.191':139
'63.##.97.228':139
'63.#0.37.5':139
'63.##.49.110':139
'63.##.127.146':139
'63.##.147.76':139
'63.##.110.139':139
'63.##.85.117':139
'63.##.138.204':139
'63.#0.210.3':139
'63.##.200.128':139
'63.##.138.243':139
'63.##.146.223':139
'63.##.231.146':139
'63.##.222.232':139
'63.##.142.163':139
'63.##.232.176':139
'63.##.102.68':139
'63.##.191.130':139
'63.##.42.116':139
'63.#0.0.242':139
'63.##.214.17':139
'63.##.10.143':139
'63.##.24.197':139
'63.#0.68.67':139
'63.##.212.103':139
'63.##.175.42':139
'63.##.226.87':139
'63.##.147.91':139
'63.##.24.197':445
'63.#0.68.67':445
'63.##.212.103':445
'63.##.175.42':445
'63.##.226.87':445
'63.#0.210.3':445
'63.##.85.117':445
'63.##.138.243':445
'63.##.102.68':445
'63.##.200.128':445
'63.##.42.116':445
'63.##.144.54':139
'63.#0.13.92':139
'63.##.214.78':139
'63.#0.28.95':139
'63.##.78.245':139
'63.#0.0.242':445
'63.##.191.130':445
'63.##.10.143':445
'63.##.84.121':445
'63.##.214.17':445
'63.##.104.203':139
'63.##.86.144':445
'63.##.179.86':445
'63.##.139.215':445
'63.##.214.244':445
'63.##.145.37':445
'63.##.204.136':445
'63.##.43.203':445
'63.##.228.147':445
'63.##.134.236':445
'63.##.159.208':445
'63.##.33.152':445
'63.##.88.251':139
'63.##.20.111':139
'63.#0.23.51':139
'63.#0.81.98':139
'63.##.165.198':139
'63.##.107.104':445
'63.##.199.46':445
'63.##.19.112':139
'63.##.160.44':139
'63.##.112.181':139
'63.##.191.43':445
'63.#0.0.248':445
'63.##.31.143':445
'63.##.170.197':445
'63.##.202.109':445
'63.#0.16.82':445
'63.##.153.183':445
'63.##.38.156':445
'63.##.57.239':445
'63.##.48.230':445
'63.##.93.242':445
'63.##.111.21':445
'63.##.11.105':445
'63.##.31.252':445
'63.#0.5.80':445
'63.##.105.191':445
'63.##.25.139':445
'63.##.239.231':445
'63.##.66.240':445
'63.##.232.108':445
'63.##.225.107':445
'63.##.108.225':445
'63.##.105.191':139
'63.##.25.139':139
'63.##.191.43':139
'63.##.204.136':139
'63.##.43.203':139
'63.##.225.107':139
'63.##.108.225':139
'63.##.31.252':139
'63.#0.5.80':139
'63.##.11.105':139
'63.##.228.147':139
'63.##.33.152':139
'63.##.199.46':139
'63.##.107.104':139
'63.##.139.215':139
'63.##.214.244':139
'63.##.134.236':139
'63.##.159.208':139
'63.##.179.86':139
'63.##.145.37':139
'63.##.86.144':139
'63.##.232.108':139
'63.##.36.108':139
'63.#0.98.90':139
'63.##.120.151':139
'63.##.153.183':139
'63.##.38.156':139
'63.#0.8.53':139
'63.##.159.192':139
'63.##.144.34':139
'63.#0.66.27':139
'63.##.12.146':139
'63.##.57.239':139
'63.##.202.109':139
'63.#0.16.82':139
'63.##.111.21':139
'63.##.239.231':139
'63.##.66.240':139
'63.##.48.230':139
'63.##.93.242':139
'63.##.31.143':139
'63.##.170.197':139
'63.#0.0.248':139
'63.##.163.247':445
'63.##.141.164':445
'63.##.247.147':445
'63.##.136.24':445
'63.##.173.48':445
'63.##.134.154':445
'63.##.11.189':445
'63.##.186.154':445
'63.##.91.115':445
'63.##.120.22':445
'63.##.174.162':445
'63.##.72.137':139
'63.##.132.75':445
'63.#0.88.9':139
'63.##.239.114':139
'63.##.202.77':139
'63.##.236.82':445
'63.##.221.39':445
'63.##.24.248':445
'63.##.152.137':445
'63.#0.28.2':445
'63.##.57.191':445
'63.##.209.217':139
'63.##.118.45':139
'63.##.250.72':139
'63.#0.81.53':139
'63.##.10.227':139
'63.##.98.111':139
'63.##.203.98':139
'63.##.111.33':139
'63.##.193.117':139
'63.##.33.193':139
'63.##.42.126':139
'63.#0.88.9':445
'63.##.72.137':445
'63.##.202.77':445
'63.#0.30.92':445
'63.##.239.114':445
'63.#0.3.129':139
'63.##.183.214':139
'63.##.27.208':139
'63.##.49.100':139
'63.#0.0.105':139
'63.##.112.181':445
'63.##.19.112':445
'63.##.160.44':445
'63.##.88.251':445
'63.##.20.111':445
'63.##.86.144':9988
'63.##.239.231':9988
'63.##.66.240':9988
'63.##.139.215':9988
'63.##.31.143':9988
'63.#0.23.51':445
'63.#0.66.27':445
'63.##.12.146':445
'63.#0.98.90':445
'63.##.36.108':445
'63.##.120.151':445
'63.#0.81.98':445
'63.##.165.198':445
'63.##.159.192':445
'63.##.144.34':445
'63.#0.8.53':445
'63.##.33.152':9988
'63.##.91.115':139
'63.##.120.22':139
'63.##.141.164':139
'63.##.247.147':139
'63.##.163.247':139
'63.##.57.191':139
'63.#0.30.92':139
'63.##.11.189':139
'63.##.186.154':139
'63.##.134.154':139
'63.##.173.48':139
'63.##.152.137':139
'63.#0.28.2':139
'63.##.132.75':139
'63.##.153.183':9988
'63.#0.23.51':9988
'63.##.174.162':139
'63.##.136.24':139
'63.##.221.39':139
'63.##.24.248':139
'63.##.236.82':139

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial