Malware

Win32/Stration.DR removal instruction

Malware Removal

The Win32/Stration.DR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Stration.DR virus can do?

  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (93 unique times)
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Attempts to identify installed AV products by registry key
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
mta6.am0.yahoodns.net
mta5.am0.yahoodns.net
mta7.am0.yahoodns.net
www4.cedesunjerinkas.com
hotmail-com.olc.protection.outlook.com
www3.cedesunjerinkas.com
mx.yandex.ru
mx00.mail.com
mx01.mail.com
mx3.bigmir.net
mx10.bigmir.net
mx12.bigmir.net
mx13.bigmir.net
mx1.bigmir.net
mx2.inbox.lv
mx1.inbox.lv
ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
rn-mailsvcp-ppex-lapp24.apple.com
rn-mailsvcp-ppex-lapp34.apple.com
rn-mailsvcp-ppex-lapp35.apple.com
rn-mailsvcp-ppex-lapp44.apple.com
rn-mailsvcp-ppex-lapp45.apple.com
pb-mx20.pobox.com
pb-mx22.pobox.com
pb-mx10.pobox.com
pb-mx14.pobox.com
pb-mx23.pobox.com
pb-mx21.pobox.com
pb-mx9.pobox.com
pb-mx11.pobox.com
mx01.oxsus-vadesecure.net
mx02.oxsus-vadesecure.net
mx03.oxsus-vadesecure.net
mx04.oxsus-vadesecure.net
mxa-00377f03.gslb.pphosted.com
mxb-00377f03.gslb.pphosted.com
mxb-00377f01.gslb.pphosted.com
mxa-00377f01.gslb.pphosted.com
mx.cam.ac.uk
ismtp.sitestar.everyone.net
onlineconnections.com.au
mx2-lw-us.apache.org
mx1-lw-us.apache.org
mx1-lw-eu.apache.org
mx2-lw-eu.apache.org
msn-com.olc.protection.outlook.com
mx-aol.mail.gm0.yahoodns.net
mxa-0028be01.gslb.pphosted.com
mxb-0028be01.gslb.pphosted.com
aspmx2.googlemail.com
aspmx3.googlemail.com
mx2.mailchannels.net
mx1.mailchannels.net
oopp.pl
contoso-com.mail.protection.outlook.com
mail.fabrikam.com
mail.adatum.com
aspmx4.googlemail.com
aspmx5.googlemail.com
contoso-mx.mail.protection.outlook.com
smtp.litwareinc.com
mail.vlada.hr
ma-01.vlada.hr
ma-02.vlada.hr
mail.dva.hr
antispam.hosting-zdarma.cz
cluster10.us.messagelabs.com
cluster10a.us.messagelabs.com
mail.h-email.net
dns2.leonet.it
mx.leonet.it
smtp2.leonet.it
ppp.ro
domini-cat.mail.protection.outlook.com
mxbiz1.qq.com
mxbiz2.qq.com
mail.python.org
digicool.com
in2-smtp.messagingengine.com
in1-smtp.messagingengine.com
www2.cedesunjerinkas.com
wellpartner-com.mail.protection.outlook.com
2mx.integra.net
park-mx.above.com
mail.ietf.org
pb-bounce5.pobox.com
pb-bounce4.pobox.com
mxg.dd.org
teconcept-de.mail.protection.outlook.com
mailfilter01.leaseweb.us
mailfilter02.leaseweb.us
mail.mailroute.net
mx1.mail.ovh.net
mx3.mail.ovh.net
mx2.mail.ovh.net
mta.openssl.org
mx11.blackberry.com
hamlmail.niwa.co.nz
mx12.blackberry.com
wellmail.niwa.co.nz
mx13.blackberry.com
mx14.blackberry.com
mx15.blackberry.com
mx16.blackberry.com
mx2.surfmailfilter.nl
mx01.lightboundhosting.com
mx1.surfmailfilter.nl
zeus.iit.demokritos.gr
mx.domain.com

How to determine Win32/Stration.DR?


File Info:

crc32: EF00112D
md5: db78de83df37ca02c8e92442571bf68f
name: DB78DE83DF37CA02C8E92442571BF68F.mlw
sha1: 5cf24676e0fc986f37e88ab08fb3a46a29c1565d
sha256: c8e15e628f1807ca5f2680152dfecd426eca5cfbad75305577fb223d07db9352
sha512: 57efca978445db5b81097329569adabafd759f559f62e1f801daa772b7ce7c625ac91fcf37f8d470d3e1443ed4f8b468ff194c532b5d39736c2419442688b06a
ssdeep: 3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoz:JjqVG/pJZzfwsGX+LOODbS
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/Stration.DR also known as:

K7AntiVirusTrojan ( 00010be51 )
DrWebWin32.HLLM.Limar.based
MicroWorld-eScanTrojan.GenericKD.30865232
CMCEmail-Worm.Win32.Warezov!O
CAT-QuickHealTrojan.Mauvaise.SL1
ALYacTrojan.GenericKD.30865232
CylanceUnsafe
ZillyaWorm.Stration.Win32.32
SangforMalware
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaWorm:Win32/Stration.0fd8ec3d
K7GWTrojan ( 00010be51 )
Cybereasonmalicious.3df37c
TrendMicroMal_Strat-3
CyrenW32/Warezov.YBCD-4106
SymantecW32.Stration!gen
ESET-NOD32Win32/Stration.DR
APEXMalicious
TotalDefenseWin32/Stration.BV
AvastWin32:Warezov-FL [Wrm]
ClamAVWin.Worm.Warezov-6804540-0
GDataTrojan.GenericKD.30865232
KasperskyEmail-Worm.Win32.Warezov.gen
BitDefenderTrojan.GenericKD.30865232
NANO-AntivirusTrojan.Win32.Warezov.fadsim
TencentMalware.Win32.Gencirc.10b3b0b6
Ad-AwareTrojan.GenericKD.30865232
SophosTroj/Agent-BAKM
ComodoWorm.Win32.Stration.DR@13yt
F-SecureWorm.WORM/Stration.C
BitDefenderThetaAI:FileInfector.B7B4D1F315
VIPRETrojan.Win32.Generic!BT
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Generic.gz
Trapminesuspicious.low.ml.score
FireEyeGeneric.mg.db78de83df37ca02
EmsisoftTrojan.GenericKD.30865232 (B)
SentinelOneDFI – Malicious PE
F-ProtW32/Warezov.AI@mm
JiangminWorm.Warezov.avj
AviraWORM/Stration.C
eGambitUnsafe.AI_Score_99%
Antiy-AVLWorm[Email]/Win32.Warezov
MicrosoftWorm:Win32/Stration.M@mm
ArcabitTrojan.Generic.D1D6F750
AegisLabWorm.Win32.Warezov.tpLU
ZoneAlarmEmail-Worm.Win32.Warezov.gen
AhnLab-V3Worm/Win32.Warezov.R227713
Acronissuspicious
McAfeeGenericRXFJ-CM!DB78DE83DF37
MAXmalware (ai score=80)
VBA32Worm.Warezov
MalwarebytesWorm.Stration
PandaW32/Spamta.BV.worm
TrendMicro-HouseCallMal_Strat-3
RisingWorm.Stration!1.B560 (CLOUD)
YandexI-Worm.Opnis!1XBzcy5mbys
IkarusWin32.Warezov
MaxSecureWorm.Warezov.GEN
FortinetW32/Stration.46FD!tr
AVGWin32:Warezov-FL [Wrm]
Paloaltogeneric.ml
Qihoo-360Win32/Worm.Warezov.A

How to remove Win32/Stration.DR?

Win32/Stration.DR removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment