Trojan.Starman.5599

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER3e23.dir00\svchost.exe.mdmp 16325836412027412

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER3e23.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Network activity:

Connects to:

'80.##.206.213':139
'80.##.16.167':139
'80.##.151.98':139
'80.#7.201.7':139
'80.##.157.37':139
'80.##.21.189':139
'80.#7.29.64':139
'80.##.189.78':139
'80.##.119.21':139
'80.##.98.236':139
'80.#7.68.2':139
'80.##.246.149':139
'80.##.137.246':139
'80.#7.56.96':139
'80.##.184.239':139
'80.##.219.174':139
'80.##.157.33':139
'80.##.39.110':139
'80.##.195.66':139
'80.##.110.127':139
'80.##.199.23':139
'80.##.53.124':139
'80.##.119.189':139
'80.##.89.147':445
'80.##.199.108':445
'80.#7.1.175':445
'80.#7.5.173':445
'80.##.127.103':445
'80.##.75.240':445
'80.##.36.102':445
'80.##.36.201':445
'80.##.81.148':445
'80.##.201.20':445
'80.#7.58.49':445
'80.##.13.101':139
'80.##.101.157':139
'80.##.201.241':139
'80.##.174.107':139
'80.##.54.223':139
'80.##.26.105':139
'80.##.43.202':139
'80.##.147.12':139
'80.##.112.249':139
'80.#7.0.176':139
'80.##.176.225':139
'80.##.161.171':445
'80.##.99.107':445
'80.##.84.163':445
'80.##.104.44':445
'80.##.239.144':445
'80.##.254.210':445
'80.#7.7.15':445
'80.##.132.10':445
'80.#7.58.91':445
'80.##.117.123':445
'80.##.109.38':445
'80.##.201.155':445
'80.##.37.230':445
'80.##.106.78':445
'80.##.38.196':445
'80.##.78.102':445
'80.##.209.26':445
'80.##.119.103':445
'80.##.221.230':445
'80.##.132.211':445
'80.##.115.114':445
'80.##.41.110':445
'80.##.166.174':445
'80.#7.58.49':139
'80.##.81.148':139
'80.##.201.20':139
'80.##.199.108':139
'80.##.75.240':139
'80.##.36.102':139
'80.##.245.20':139
'80.##.49.165':139
'80.##.127.67':139
'80.##.36.201':139
'80.##.19.119':139
'80.##.178.171':139
'80.##.34.125':139
'80.##.114.69':445
'80.##.228.164':445
'80.#7.22.51':445
'80.##.178.171':445
'80.#7.1.175':139
'80.##.89.147':139
'80.##.127.103':139
'80.##.34.125':445
'80.#7.5.173':139
'80.##.19.119':445
'80.##.179.13':139
'80.##.250.192':139
'80.##.20.108':139
'80.##.160.43':139
'80.#7.5.148':139
'80.##.13.150':139
'80.##.238.60':139
'80.#7.78.63':139
'80.##.174.105':139
'80.##.47.206':139
'80.##.122.195':139
'80.##.19.188':139
'80.##.250.114':139
'80.#7.0.94':139
'80.##.226.15':139
'80.#7.2.67':139
'80.##.119.70':139
'80.#7.52.89':139
'80.##.182.51':139
'80.##.182.111':139
'80.##.107.41':139
'80.##.32.167':139
'80.##.174.229':139
'80.#7.65.14':139
'80.##.199.35':139
'80.#7.14.24':139
'80.##.174.76':139
'80.##.170.31':139
'80.##.76.101':139
'80.##.127.210':139
'80.##.90.132':139
'80.##.120.88':139
'80.##.178.103':139
'80.##.241.198':139
'80.##.12.198':139
'80.##.133.44':139
'80.##.128.251':139
'80.##.41.174':139
'80.#7.68.72':139
'80.##.89.159':139
'80.##.194.20':139
'80.#7.53.51':139
'80.#7.6.141':139
'80.#7.1.90':139
'80.##.41.201':139
'80.#7.201.7':445
'80.##.157.37':445
'80.##.195.66':445
'80.##.110.127':445
'80.##.39.110':445
'80.##.151.98':445
'80.##.98.236':445
'80.#7.68.2':445
'80.##.21.189':445
'80.##.206.213':445
'80.##.16.167':445
'80.##.184.239':445
'80.##.219.174':445
'80.##.49.165':445
'80.##.127.67':445
'80.##.245.20':445
'80.#7.56.96':445
'80.##.199.23':445
'80.##.53.124':445
'80.##.157.33':445
'80.##.246.149':445
'80.##.137.246':445
'80.##.119.21':445
'80.##.131.118':139
'80.##.136.88':139
'80.##.147.12':445
'80.##.112.249':445
'80.##.43.202':445
'80.##.131.118':445
'80.##.121.154':139
'80.##.15.110':139
'80.##.154.159':139
'80.##.136.88':445
'80.#7.19.48':139
'80.##.174.107':445
'80.##.54.223':445
'80.##.119.189':445
'80.#7.29.64':445
'80.##.189.78':445
'80.##.201.241':445
'80.#7.0.176':445
'80.##.176.225':445
'80.##.26.105':445
'80.##.13.101':445
'80.##.101.157':445
'80.##.118.221':445
'80.##.161.242':445
'80.##.106.242':445
'80.#7.4.16':445
'80.##.107.223':445
'80.#7.91.34':445
'80.##.116.115':445
'80.##.138.247':445
'80.##.179.188':445
'80.##.249.90':445
'80.#7.9.57':445
'80.##.99.224':139
'80.#7.8.244':139
'80.#7.88.59':139
'80.##.73.108':139
'80.#7.74.6':139
'80.##.133.78':139
'80.#7.83.12':445
'80.##.215.206':445
'80.##.31.213':445
'80.##.43.181':445
'80.##.37.104':445
'80.##.165.20':445
'80.##.110.249':445
'80.##.13.231':445
'80.##.112.209':445
'80.##.129.92':445
'80.##.73.163':445
'80.##.78.219':445
'80.##.205.149':445
'80.##.130.72':445
'80.##.133.18':445
'80.##.51.144':445
'80.##.33.153':445
'80.##.156.67':445
'80.##.195.76':445
'80.#7.212.8':445
'80.##.173.249':445
'80.##.193.61':445
'80.##.93.195':445
'80.##.154.233':445
'80.##.242.167':445
'80.#7.5.150':445
'80.#7.52.93':445
'80.#7.61.67':445
'80.##.116.115':139
'80.##.138.247':139
'80.##.179.188':139
'80.##.249.90':139
'80.#7.9.57':139
'80.##.165.20':139
'80.##.156.67':139
'80.##.195.76':139
'80.#7.212.8':139
'80.##.173.249':139
'80.##.193.61':139
'80.##.37.104':139
'80.##.215.206':139
'80.##.107.223':139
'80.##.43.181':139
'80.##.31.213':139
'80.#7.83.12':139
'80.##.161.242':139
'80.#7.91.34':139
'80.##.118.221':139
'80.#7.4.16':139
'80.##.106.242':139
'80.##.93.195':139
'80.##.205.149':139
'80.##.130.72':139
'80.##.133.18':139
'80.##.51.144':139
'80.##.33.153':139
'80.##.129.44':139
'80.##.97.190':139
'80.#7.57.97':139
'80.#7.99.4':139
'80.##.254.122':139
'80.##.82.191':139
'80.##.154.233':139
'80.##.242.167':139
'80.#7.5.150':139
'80.#7.52.93':139
'80.#7.61.67':139
'80.##.129.92':139
'80.##.13.231':139
'80.##.78.219':139
'80.##.110.249':139
'80.##.73.163':139
'80.##.112.209':139
'80.##.129.44':445
'80.##.109.38':139
'80.#7.58.91':139
'80.##.117.123':139
'80.##.99.107':139
'80.##.254.210':139
'80.#7.7.15':139
'80.#7.22.51':139
'80.##.114.69':139
'80.##.228.164':139
'80.##.132.10':139
'80.##.166.174':139
'80.##.41.110':139
'80.##.132.211':139
'80.##.115.114':139
'80.##.37.230':139
'80.##.209.26':139
'80.##.119.103':139
'80.##.84.163':139
'80.##.161.171':139
'80.##.239.144':139
'80.##.221.230':139
'80.##.104.44':139
'80.##.69.119':445
'80.#7.90.94':445
'80.##.37.116':445
'80.##.94.184':445
'80.##.178.136':445
'80.##.184.178':445
'80.##.28.203':445
'80.##.242.30':445
'80.##.150.86':445
'80.##.162.105':445
'80.##.104.56':445
'80.##.106.101':445
'80.#7.33.36':445
'80.##.28.233':445
'80.#7.33.91':445
'80.##.188.143':445
'80.#7.9.37':445
'80.##.152.49':445
'80.##.145.242':445
'80.##.137.37':445
'80.##.67.177':445
'80.#7.88.94':445
'80.#7.56.58':445
'80.##.31.213':9988
'80.##.73.163':9988
'80.#7.83.12':9988
'80.##.43.181':9988
'80.##.106.242':9988
'80.##.73.108':9988
'80.#7.9.37':139
'80.#7.33.91':139
'80.##.188.143':139
'80.#7.74.6':9988
'80.##.69.119':139
'80.##.97.190':445
'80.#7.57.97':445
'80.#7.99.4':445
'80.##.254.122':445
'80.##.82.191':445
'80.##.73.108':445
'80.#7.8.244':445
'80.##.133.78':445
'80.##.99.224':445
'80.#7.74.6':445
'80.#7.88.59':445
'80.#7.33.36':139
'80.##.106.101':139
'80.##.162.105':139
'80.##.104.56':139
'80.##.37.116':139
'80.##.28.203':139
'80.##.242.30':139
'80.##.106.78':139
'80.##.201.155':139
'80.##.78.102':139
'80.##.150.86':139
'80.##.38.196':139
'80.#7.56.58':139
'80.##.67.177':139
'80.#7.88.94':139
'80.##.28.233':139
'80.##.152.49':139
'80.##.145.242':139
'80.##.94.184':139
'80.#7.90.94':139
'80.##.184.178':139
'80.##.137.37':139
'80.##.178.136':139

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial