Trojan.Starman.6627

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER2edf.dir00\svchost.exe.mdmp 16325836412032404

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'22#.#05.25.149':445
'22#.#05.203.44':445
'22#.#05.49.134':139
'22#.#05.121.239':139
'22#.#05.53.61':445
'22#.#05.7.163':445
'22#.#05.89.213':445
'22#.#05.96.161':445
'22#.#05.193.165':445
'22#.#05.50.111':139
'22#.#05.232.216':139
'22#.#05.250.94':139
'22#.#05.22.188':139
'22#.#05.150.127':139
'22#.#05.249.62':139
'22#.#05.13.30':139
'22#.#05.213.2':139
'22#.#05.63.20':139
'22#.#05.129.90':445
'22#.#05.129.2':445
'22#.#05.139.118':445
'22#.#05.18.152':445
'22#.#05.208.197':445
'22#.#05.104.4':445
'22#.#05.240.227':445
'22#.#05.234.110':445
'22#.#05.70.221':445
'22#.#05.152.187':445
'22#.#05.177.17':445
'22#.#05.119.31':445
'22#.#05.201.26':445
'22#.#05.17.13':445
'22#.#05.27.9':445
'22#.#05.169.153':445
'22#.#05.25.209':445
'22#.#05.96.139':445
'22#.#05.15.156':445
'22#.#05.31.89':139
'22#.#05.96.139':139
'22#.#05.15.156':139
'22#.#05.119.31':139
'22#.#05.27.9':139
'22#.#05.169.153':139
'22#.#05.208.197':139
'22#.#05.129.2':139
'22#.#05.25.209':139
'22#.#05.18.152':139
'22#.#05.193.165':139
'22#.#05.7.163':139
'22#.#05.53.61':139
'22#.#05.96.161':139
'22#.#05.89.213':139
'22#.#05.17.13':139
'22#.#05.177.17':139
'22#.#05.129.90':139
'22#.#05.201.26':139
'22#.#05.139.118':139
'22#.#05.131.214':139
'22#.#05.16.163':139
'22#.#05.220.130':139
'22#.#05.204.57':139
'22#.#05.77.75':139
'22#.#05.55.36':139
'22#.#05.237.202':139
'22#.#05.249.101':139
'22#.#05.107.249':139
'22#.#05.152.187':139
'22#.#05.240.227':139
'22#.#05.104.4':139
'22#.#05.70.221':139
'22#.#05.234.110':139
'22#.#05.39.17':139
'22#.#05.228.16':139
'22#.#05.21.252':139
'22#.#05.126.198':139
'22#.#05.21.252':445
'22#.#05.193.199':139
'22#.#05.215.85':139
'22#.#05.67.147':139
'22#.#05.11.159':139
'22#.#05.133.96':139
'22#.#05.73.214':139
'22#.#05.5.236':139
'22#.#05.17.218':139
'22#.#05.55.85':139
'22#.#05.183.81':139
'22#.#05.10.126':139
'22#.#05.76.103':139
'22#.#05.48.223':139
'22#.#05.182.178':139
'22#.#05.29.126':139
'22#.#05.106.32':139
'22#.#05.89.171':139
'22#.#05.163.84':139
'22#.#05.195.160':139
'22#.#05.112.66':139
'22#.#05.89.29':139
'22#.#05.62.157':139
'22#.#05.191.217':139
'22#.#05.241.179':139
'22#.#05.40.84':139
'22#.#05.239.91':139
'22#.#05.108.13':139
'22#.#05.144.170':139
'22#.#05.65.3':139
'22#.#05.162.152':139
'22#.#05.20.239':139
'22#.#05.111.250':139
'22#.#05.255.151':139
'22#.#05.251.197':139
'22#.#05.122.251':139
'22#.#05.32.38':139
'22#.#05.34.1':139
'22#.#05.148.240':139
'22#.#05.237.202':445
'22#.#05.31.89':445
'22#.#05.107.249':445
'22#.#05.55.36':445
'22#.#05.250.94':445
'22#.#05.232.216':445
'22#.#05.150.127':445
'22#.#05.22.188':445
'22#.#05.50.111':445
'22#.#05.228.16':445
'22#.#05.220.130':445
'22#.#05.126.198':445
'22#.#05.39.17':445
'22#.#05.204.57':445
'22#.#05.77.75':445
'22#.#05.249.101':445
'22#.#05.131.214':445
'22#.#05.16.163':445
'22#.#05.213.2':445
'22#.#05.28.25':139
'22#.#05.240.154':139
'22#.#05.129.88':139
'22#.#05.49.130':139
'22#.#05.170.4':139
'22#.#05.61.173':139
'22#.#05.230.74':139
'22#.#05.28.108':139
'22#.#05.29.51':139
'22#.#05.13.30':445
'22#.#05.49.134':445
'22#.#05.63.20':445
'22#.#05.249.62':445
'22#.#05.121.239':445
'22#.#05.150.128':139
'22#.#05.88.150':139
'22#.#05.68.249':139
'22#.#05.128.133':139
'22#.#05.203.44':139
'22#.#05.239.248':139
'22#.#05.243.239':139
'22#.#05.173.6':139
'22#.#05.248.229':139
'22#.#05.204.37':445
'22#.#05.135.97':445
'22#.#05.21.232':445
'22#.#05.237.160':445
'22#.#05.57.52':445
'22#.#05.206.113':139
'22#.#05.222.34':139
'22#.#05.37.52':139
'22#.#05.72.39':139
'22#.#05.85.234':139
'22#.#05.23.123':139
'22#.#05.85.188':139
'22#.#05.16.5':139
'22#.#05.0.55':139
'22#.#05.201.124':445
'22#.#05.84.48':445
'22#.#05.64.59':445
'22#.#05.150.94':445
'22#.#05.222.214':445
'22#.#05.167.70':445
'22#.#05.80.80':445
'22#.#05.178.80':445
'22#.#05.52.18':445
'22#.#05.80.18':445
'22#.#05.50.100':445
'22#.#05.59.204':445
'22#.#05.5.195':445
'22#.#05.221.55':445
'22#.#05.218.101':445
'22#.#05.70.102':445
'22#.#05.210.89':445
'22#.#05.101.194':445
'22#.#05.233.101':445
'22#.#05.85.83':139
'22#.#05.101.194':139
'22#.#05.233.101':139
'22#.#05.59.204':139
'22#.#05.218.101':139
'22#.#05.70.102':139
'22#.#05.222.214':139
'22#.#05.84.48':139
'22#.#05.210.89':139
'22#.#05.150.94':139
'22#.#05.204.37':139
'22#.#05.57.52':139
'22#.#05.237.160':139
'22#.#05.135.97':139
'22#.#05.21.232':139
'22#.#05.221.55':139
'22#.#05.50.100':139
'22#.#05.201.124':139
'22#.#05.5.195':139
'22#.#05.64.59':139
'22#.#05.81.75':139
'22#.#05.10.131':139
'22#.#05.206.96':139
'22#.#05.6.10':139
'22#.#05.253.9':139
'22#.#05.74.49':139
'22#.#05.23.12':139
'22#.#05.172.102':139
'22#.#05.51.0':139
'22#.#05.80.18':139
'22#.#05.80.80':139
'22#.#05.167.70':139
'22#.#05.52.18':139
'22#.#05.178.80':139
'22#.#05.27.239':139
'22#.#05.113.107':139
'22#.#05.39.198':139
'22#.#05.239.213':139
'22#.#05.39.198':445
'22#.#05.32.0':139
'22#.#05.94.18':139
'22#.#05.102.97':139
'22#.#05.215.39':139
'22#.#05.143.215':139
'22#.#05.230.214':139
'22#.#05.210.5':139
'22#.#05.57.72':139
'22#.#05.61.167':139
'22#.#05.253.9':9988
'22#.#05.222.34':9988
'22#.#05.80.80':9988
'22#.#05.113.107':9988
'22#.#05.172.102':9988
'22#.#05.2.221':139
'22#.#05.186.81':139
'22#.#05.72.39':9988
'22#.#05.11.111':139
'22#.#05.56.210':139
'22#.#05.61.167':445
'22#.#05.230.214':445
'22#.#05.143.215':445
'22#.#05.57.72':445
'22#.#05.210.5':445
'22#.#05.184.5':445
'22#.#05.25.149':139
'22#.#05.56.210':445
'22#.#05.203.82':445
'22#.#05.11.111':445
'22#.#05.2.221':445
'22#.#05.203.82':139
'22#.#05.184.5':139
'22#.#05.186.81':445
'22#.#05.32.0':445
'22#.#05.94.18':445
'22#.#05.102.97':445
'22#.#05.215.39':445
'22#.#05.80.18':9988
'22#.#05.23.12':445
'22#.#05.85.83':445
'22#.#05.51.0':445
'22#.#05.74.49':445
'22#.#05.37.52':445
'22#.#05.222.34':445
'22#.#05.85.234':445
'22#.#05.72.39':445
'22#.#05.206.113':445
'22#.#05.113.107':445
'22#.#05.206.96':445
'22#.#05.239.213':445
'22#.#05.27.239':445
'22#.#05.6.10':445
'22#.#05.253.9':445
'22#.#05.172.102':445
'22#.#05.81.75':445
'22#.#05.10.131':445
'22#.#05.16.5':445
'22#.#05.5.195':9988
'22#.#05.221.55':9988
'22#.#05.135.97':9988
'22#.#05.57.52':9988
'22#.#05.50.100':9988
'22#.#05.150.94':9988
'22#.#05.222.214':9988
'22#.#05.233.101':9988
'22#.#05.70.102':9988
'22#.#05.85.188':445
'22#.#05.173.6':445
'22#.#05.0.55':445
'22#.#05.23.123':445
'22#.#05.248.229':445
'22#.#05.21.232':9988
'22#.#05.201.124':9988
'22#.#05.239.248':445
'22#.#05.243.239':445

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial