Trojan.Starman.4787

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERa5f5.dir00\svchost.exe.mdmp 16325836412029756

Modifies file system :

Creates the following files:

%WINDIR%\pchealth\helpctr\System\sysinfo\rbcjjwqr.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\rercrnhh.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\rqxjhbsl.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\vkchbbxh.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\bjlkjrls.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\cntbrbzr.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\jbrhbztz.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ctjxljxh.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ccthwjlr.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\rbntkevt.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\shrnxshq.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\wesnhzec.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\neqvzkeh.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ezslqrbz.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\vsekkehe.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\kkrtrbns.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\erwskeqr.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\vxwqhwzs.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\vxwqhwzs.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\vxwqhwzs.exe
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\vxwqhwzs.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\qxshkkqn.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\jrtqcssx.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\rnbrkrlv.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\lwklbvze.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\trkhkjxz.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\rrbvcsbb.exe
%WINDIR%\pchealth\helpctr\System\UpdateCtr\snqesjrk.exe
%WINDIR%\pchealth\helpctr\System\errors\jcjjlqnq.exe
%WINDIR%\pchealth\helpctr\System\ErrMsg\vlvxqrek.exe
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\shrrtjet.exe
%WINDIR%\pchealth\helpctr\System\NetDiag\xrvxszvs.exe
%WINDIR%\pchealth\helpctr\System\panels\sncncweb.exe
%WINDIR%\pchealth\helpctr\System\panels\nntlskwn.exe
%WINDIR%\pchealth\helpctr\System\NetDiag\hsjqschn.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\tnslrrhk.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\jbnxjtkn.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\zlhqrlbx.exe
%WINDIR%\pchealth\helpctr\System\CompatCtr\hrtbebze.exe
%WINDIR%\pchealth\helpctr\System\DFS\nbzhnzrx.exe
%WINDIR%\pchealth\helpctr\System\DFS\jnxckxkh.exe
%WINDIR%\pchealth\helpctr\System\DFS\jlejjblt.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\ekjvhbcn.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\ttzvrbzr.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\knenvxlj.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\wbjbjelb.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\shnkjjbh.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\kbzzlwlr.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\bbsbrlee.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\hxrshqsj.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\seshhtth.exe
%WINDIR%\pchealth\helpctr\System\rc\qbrblthb.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\rwcjrqhw.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\zqwkjbbt.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\jjennetl.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\rzqstbqq.exe

Network activity:

Connects to:

'63.##2.113.154':445
'63.##2.153.196':445
'63.##2.142.107':445
'63.##2.84.178':445
'63.##2.134.67':445
'63.##2.7.134':445
'63.##2.113.153':445
'63.##2.156.47':445
'63.##2.152.155':445
'63.##2.110.155':445
'63.##2.196.113':445
'63.##2.47.54':445
'63.##2.54.196':445
'63.##2.207.254':445
'63.##2.252.22':445
'63.##2.123.251':445
'63.##2.186.191':445
'63.##2.98.17':445
'63.##2.198.164':445
'63.##2.41.124':445
'63.##2.172.79':445
'63.##2.25.188':445
'63.#32.6.52':445
'63.##2.42.100':445
'63.##2.6.239':445
'63.##2.224.0':445
'63.##2.67.133':139
'63.##2.160.211':139
'63.##2.84.84':139
'63.##2.2.167':445
'63.#32.39.2':445
'63.#32.49.8':139
'63.##2.235.63':139
'63.##2.246.134':139
'63.##2.167.100':139
'63.##2.209.145':139
'63.##2.233.235':139
'63.##2.151.233':139
'63.##2.251.132':139
'63.##2.162.10':445
'63.##2.40.162':445
'63.##2.100.83':445
'63.##2.67.48':445
'63.##2.179.102':445
'63.##2.10.180':445
'63.##2.154.116':445
'63.##2.36.29':445
'63.##2.91.77':445
'63.##2.35.125':445
'63.##2.242.82':445
'63.##2.203.218':445
'63.##2.208.170':445
'63.##2.7.134':139
'63.##2.113.154':139
'63.##2.153.196':139
'63.#32.6.52':139
'63.##2.84.178':139
'63.##2.134.67':139
'63.##2.142.107':139
'63.##2.47.54':139
'63.##2.156.47':139
'63.##2.152.155':139
'63.##2.113.153':139
'63.##2.196.113':139
'63.##2.54.196':139
'63.##2.198.164':139
'63.##2.207.254':139
'63.##2.252.22':139
'63.#32.9.29':139
'63.##2.186.191':139
'63.##2.98.17':139
'63.##2.123.251':139
'63.##2.224.0':139
'63.##2.172.79':139
'63.##2.25.188':139
'63.##2.41.124':139
'63.##2.42.100':139
'63.##2.6.239':139
'63.##2.10.130':445
'63.##2.182.0':445
'63.##2.12.65':445
'63.##2.35.125':139
'63.##2.2.167':139
'63.#32.39.2':139
'63.##2.237.250':445
'63.##2.244.2':445
'63.##2.164.59':445
'63.#32.9.29':445
'63.##2.41.161':445
'63.##2.225.81':445
'63.##2.2.225':445
'63.##2.10.180':139
'63.##2.162.10':139
'63.##2.40.162':139
'63.##2.110.155':139
'63.##2.67.48':139
'63.##2.179.102':139
'63.##2.100.83':139
'63.##2.208.170':139
'63.##2.36.29':139
'63.##2.91.77':139
'63.##2.154.116':139
'63.##2.242.82':139
'63.##2.203.218':139
'63.##2.121.201':139
'63.##2.30.136':445
'63.##2.230.30':445
'63.##2.72.230':445
'63.##2.52.47':445
'63.#32.6.92':445
'63.##2.125.22':445
'63.##2.139.125':445
'63.#32.76.0':445
'63.#32.3.73':445
'63.##2.125.211':445
'63.##2.248.237':445
'63.##2.253.137':445
'63.##2.8.183':445
'63.##2.92.221':445
'63.##2.56.38':445
'63.##2.186.139':445
'63.##2.29.42':445
'63.##2.142.164':445
'63.#32.3.36':445
'63.##2.22.59':445
'63.##2.76.66':445
'63.##2.13.76':445
'63.##2.75.199':445
'63.##2.212.228':445
'63.##2.48.156':445
'63.##2.23.20':445
'63.##2.60.74':139
'63.##2.96.115':139
'63.##2.17.230':139
'63.##2.219.152':139
'63.##2.57.176':139
'63.##2.116.211':139
'63.##2.94.11':139
'63.##2.171.6':139
'63.##2.244.18':139
'63.##2.12.223':139
'63.##2.231.93':139
'63.##2.3.232':139
'63.##2.219.237':139
'63.##2.27.176':445
'63.##2.7.213':445
'63.#32.37.8':445
'63.##2.131.210':445
'63.##2.188.247':445
'63.##2.146.52':445
'63.##2.176.247':445
'63.##2.80.105':445
'63.##2.41.113':445
'63.##2.112.41':139
'63.##2.86.122':445
'63.##2.25.234':445
'63.##2.151.77':445
'63.##2.125.22':139
'63.##2.30.136':139
'63.##2.230.30':139
'63.##2.75.199':139
'63.##2.52.47':139
'63.#32.6.92':139
'63.##2.72.230':139
'63.##2.8.183':139
'63.#32.76.0':139
'63.#32.3.73':139
'63.##2.139.125':139
'63.##2.248.237':139
'63.##2.253.137':139
'63.#32.3.36':139
'63.##2.92.221':139
'63.##2.56.38':139
'63.##2.64.121':139
'63.##2.29.42':139
'63.##2.142.164':139
'63.##2.186.139':139
'63.##2.23.20':139
'63.##2.76.66':139
'63.##2.13.76':139
'63.##2.22.59':139
'63.##2.212.228':139
'63.##2.48.156':139
'63.##2.84.84':445
'63.##2.235.63':445
'63.##2.233.235':445
'63.#32.49.8':445
'63.##2.67.133':445
'63.##2.160.211':445
'63.##2.151.233':445
'63.##2.209.145':445
'63.##2.121.201':445
'63.##2.64.121':445
'63.##2.251.132':445
'63.##2.246.134':445
'63.##2.167.100':445
'63.##2.146.52':139
'63.##2.27.176':139
'63.##2.7.213':139
'63.##2.125.211':139
'63.##2.131.210':139
'63.##2.188.247':139
'63.#32.37.8':139
'63.##2.151.77':139
'63.##2.80.105':139
'63.##2.41.113':139
'63.##2.176.247':139
'63.##2.86.122':139
'63.##2.25.234':139
'63.##2.164.59':139
'63.##2.11.119':445
'63.##2.208.184':445
'63.##2.169.11':445
'63.##2.7.155':445
'63.##2.129.153':445
'63.##2.5.138':445
'63.##2.165.232':445
'63.##2.64.30':445
'63.##2.213.200':445
'63.##2.92.169':445
'63.##2.215.3':445
'63.##2.167.198':445
'63.##2.201.247':445
'63.##2.109.90':445
'63.##2.224.165':445
'63.##2.51.233':445
'63.##2.255.32':445
'63.##2.15.204':445
'63.##2.24.130':445
'63.##2.158.83':445
'63.##2.163.15':445
'63.##2.170.184':445
'63.##2.126.203':445
'63.##2.76.245':445
'63.##2.134.117':445
'63.##2.28.247':445
'63.##2.142.89':445
'63.##2.13.47':445
'63.##2.119.7':445
'63.##2.106.237':445
'63.##2.232.12':445
'63.##2.31.247':445
'63.##2.198.92':445
'63.##2.15.204':9988
'63.##2.190.38':9988
'63.##2.210.38':139
'63.##2.70.70':445
'63.##2.194.115':445
'63.##2.57.227':445
'63.##2.107.7':445
'63.##2.254.94':445
'63.##2.139.76':445
'63.##2.11.62':445
'63.##2.230.178':445
'63.#32.87.2':445
'63.##2.108.252':445
'63.##2.167.141':445
'63.##2.129.64':445
'63.##2.17.108':445
'63.##2.87.198':445
'63.##2.82.168':445
'63.##2.53.53':445
'63.##2.7.155':139
'63.##2.230.178':139
'63.##2.163.15':139
'63.##2.24.130':139
'63.##2.92.169':139
'63.##2.170.184':139
'63.##2.5.138':139
'63.##2.167.198':139
'63.##2.108.252':139
'63.##2.11.119':139
'63.##2.215.3':139
'63.##2.208.184':139
'63.##2.169.11':139
'63.##2.76.245':139
'63.##2.129.153':139
'63.##2.28.247':139
'63.##2.190.38':139
'63.##2.255.32':139
'63.##2.134.117':139
'63.##2.109.90':139
'63.##2.158.83':139
'63.##2.15.204':139
'63.##2.165.232':139
'63.##2.51.233':139
'63.##2.224.165':139
'63.##2.126.203':139
'63.##2.167.141':139
'63.##2.17.108':139
'63.##2.31.247':139
'63.##2.200.242':139
'63.##2.194.115':139
'63.##2.106.237':139
'63.##2.13.47':139
'63.##2.142.89':139
'63.##2.198.92':139
'63.##2.190.38':445
'63.##2.232.12':139
'63.##2.70.70':139
'63.##2.119.7':139
'63.##2.254.94':139
'63.##2.139.76':139
'63.#32.87.2':139
'63.##2.82.168':139
'63.##2.201.247':139
'63.##2.57.227':139
'63.##2.87.198':139
'63.##2.107.7':139
'63.##2.64.30':139
'63.##2.213.200':139
'63.##2.11.62':139
'63.##2.129.64':139
'63.##2.53.53':139
'63.##2.150.146':139
'63.##2.205.149':445
'63.##2.230.205':445
'63.##2.185.231':445
'63.##2.57.61':445
'63.##2.242.105':445
'63.##2.97.44':445
'63.##2.16.169':445
'63.##2.13.29':445
'63.##2.58.188':445
'63.##2.171.58':445
'63.##2.49.12':445
'63.##2.35.49':445
'63.##2.77.220':445
'63.##2.62.91':445
'63.##2.101.157':445
'63.##2.232.83':445
'63.##2.135.166':445
'63.##2.201.16':445
'63.##2.90.200':445
'63.##2.74.187':445
'63.##2.84.150':445
'63.##2.137.110':445
'63.##2.216.87':445
'63.##2.217.25':445
'63.##2.153.32':445
'63.##2.102.221':445
'63.#32.8.84':445
'63.##2.86.222':445
'63.##2.10.130':139
'63.##2.6.171':445
'63.##2.214.97':445
'63.##2.11.221':445
'63.##2.182.0':139
'63.##2.225.81':139
'63.##2.2.225':139
'63.##2.244.2':139
'63.##2.12.65':139
'63.##2.237.250':139
'63.##2.41.161':139
'63.##2.128.29':445
'63.##2.41.85':445
'63.##2.67.213':445
'63.##2.59.251':445
'63.##2.97.132':445
'63.##2.29.97':445
'63.##2.253.211':445
'63.##2.12.55':445
'63.##2.116.216':445
'63.##2.129.116':445
'63.##2.64.166':445
'63.##2.73.61':445
'63.##2.209.161':445
'63.##2.57.61':139
'63.##2.242.105':139
'63.##2.97.44':139
'63.##2.84.150':139
'63.##2.137.110':139
'63.##2.216.87':139
'63.##2.205.149':139
'63.##2.49.12':139
'63.##2.35.49':139
'63.##2.77.220':139
'63.##2.230.205':139
'63.##2.185.231':139
'63.##2.16.169':139
'63.##2.135.166':139
'63.##2.201.16':139
'63.##2.90.200':139
'63.##2.66.125':139
'63.##2.5.220':139
'63.##2.228.154':139
'63.##2.62.91':139
'63.##2.217.25':139
'63.##2.153.32':139
'63.##2.102.221':139
'63.##2.101.157':139
'63.##2.232.83':139
'63.##2.74.187':139
'63.##2.6.171':139
'63.##2.214.97':139
'63.##2.11.221':139
'63.##2.12.55':139
'63.##2.116.216':139
'63.##2.129.116':139
'63.#32.8.84':139
'63.##2.66.125':445
'63.##2.5.220':445
'63.##2.228.154':445
'63.##2.86.222':139
'63.##2.210.38':445
'63.##2.150.146':445
'63.##2.59.251':139
'63.##2.97.132':139
'63.##2.29.97':139
'63.##2.13.29':139
'63.##2.58.188':139
'63.##2.171.58':139
'63.##2.128.29':139
'63.##2.64.166':139
'63.##2.73.61':139
'63.##2.209.161':139
'63.##2.41.85':139
'63.##2.67.213':139
'63.##2.253.211':139

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial