Worm

Worm.Stration removal

Malware Removal

The Worm.Stration is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm.Stration virus can do?

  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (98 unique times)
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Attempts to identify installed AV products by registry key
  • Creates a copy of itself
  • Makes SMTP requests, possibly sending spam or exfiltrating data.
  • Anomalous binary characteristics

Related domains:

mta5.am0.yahoodns.net
mta7.am0.yahoodns.net
mta6.am0.yahoodns.net
hotmail-com.olc.protection.outlook.com
www4.cedesunjerinkas.com
www3.cedesunjerinkas.com
mx.yandex.ru
mx00.mail.com
mx01.mail.com
mx1.bigmir.net
mx3.bigmir.net
mx10.bigmir.net
mx12.bigmir.net
mx1.inbox.lv
mx13.bigmir.net
mx2.inbox.lv
ma1-aaemail-dr-lapp01.apple.com
ma1-aaemail-dr-lapp02.apple.com
ma1-aaemail-dr-lapp03.apple.com
rn-mailsvcp-ppex-lapp14.apple.com
rn-mailsvcp-ppex-lapp15.apple.com
rn-mailsvcp-ppex-lapp24.apple.com
rn-mailsvcp-ppex-lapp34.apple.com
rn-mailsvcp-ppex-lapp35.apple.com
rn-mailsvcp-ppex-lapp44.apple.com
pb-mx11.pobox.com
rn-mailsvcp-ppex-lapp45.apple.com
pb-mx10.pobox.com
pb-mx21.pobox.com
pb-mx14.pobox.com
pb-mx20.pobox.com
mx01.oxsus-vadesecure.net
pb-mx23.pobox.com
mx02.oxsus-vadesecure.net
pb-mx9.pobox.com
mx03.oxsus-vadesecure.net
pb-mx22.pobox.com
mx04.oxsus-vadesecure.net
mx.cam.ac.uk
mxb-00377f03.gslb.pphosted.com
mxb-00377f01.gslb.pphosted.com
mxa-00377f01.gslb.pphosted.com
mxa-00377f03.gslb.pphosted.com
ismtp.sitestar.everyone.net
onlineconnections.com.au
mx2-lw-us.apache.org
mx1-lw-us.apache.org
mx1-lw-eu.apache.org
mx2-lw-eu.apache.org
msn-com.olc.protection.outlook.com
mx-aol.mail.gm0.yahoodns.net
mxa-0028be01.gslb.pphosted.com
mxb-0028be01.gslb.pphosted.com
aspmx2.googlemail.com
aspmx3.googlemail.com
mx2.mailchannels.net
mx1.mailchannels.net
oopp.pl
contoso-com.mail.protection.outlook.com
mail.fabrikam.com
mail.adatum.com
contoso-mx.mail.protection.outlook.com
aspmx5.googlemail.com
aspmx4.googlemail.com
smtp.litwareinc.com
mail.vlada.hr
ma-01.vlada.hr
ma-02.vlada.hr
mail.dva.hr
antispam.hosting-zdarma.cz
cluster10.us.messagelabs.com
cluster10a.us.messagelabs.com
mail.h-email.net
mx.leonet.it
dns2.leonet.it
smtp2.leonet.it
ppp.ro
domini-cat.mail.protection.outlook.com
mx.domain.com
mxbiz1.qq.com
mxbiz2.qq.com
mail.python.org
digicool.com
in1-smtp.messagingengine.com
in2-smtp.messagingengine.com
www2.cedesunjerinkas.com
wellpartner-com.mail.protection.outlook.com
2mx.integra.net
park-mx.above.com
mail.ietf.org
mxg.dd.org
pb-bounce4.pobox.com
pb-bounce5.pobox.com
teconcept-de.mail.protection.outlook.com
mailfilter02.leaseweb.us
mailfilter01.leaseweb.us
mail.mailroute.net
mta.openssl.org
mx13.blackberry.com
mx14.blackberry.com
hamlmail.niwa.co.nz
mx3.mail.ovh.net
mx1.mail.ovh.net
mx01.lightboundhosting.com
mx2.mail.ovh.net
mx15.blackberry.com
wellmail.niwa.co.nz
mx1.surfmailfilter.nl
mx16.blackberry.com
mx11.blackberry.com
mx12.blackberry.com
mx2.surfmailfilter.nl
zeus.iit.demokritos.gr

How to determine Worm.Stration?


File Info:

crc32: 4FB8061D
md5: 14a486559d91a7c1f33d48f295089e4f
name: 14A486559D91A7C1F33D48F295089E4F.mlw
sha1: c73b5078eb2994167eeee9825da11d666b01b454
sha256: 3a66e1a9df774cad13d3251abf22ecbf59a000cb6ba838085b2d6816128fc988
sha512: 58e927d091d2db57afb3cdac65f0d77c86cbdac8e056a043ab9e647f5fab4dae8ed61953f1638a9add1e2cceab3c5c7c8450085571617a42bbd92c6c27e1d113
ssdeep: 3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoo:JjqVG/pJZzfwsGX+LOOD8ddzZXQ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Worm.Stration also known as:

K7AntiVirusTrojan ( 00010be51 )
DrWebWin32.HLLM.Limar.based
MicroWorld-eScanTrojan.GenericKD.30865232
CMCEmail-Worm.Win32.Warezov!O
ALYacTrojan.GenericKD.30865232
CylanceUnsafe
ZillyaWorm.Stration.Win32.32
SangforMalware
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaWorm:Win32/Stration.04b20381
K7GWTrojan ( 00010be51 )
Cybereasonmalicious.59d91a
TrendMicroMal_Strat-3
CyrenW32/Warezov.YBCD-4106
SymantecW32.Stration!gen
ESET-NOD32Win32/Stration.DR
APEXMalicious
TotalDefenseWin32/Stration.BV
AvastWin32:Warezov-FL [Wrm]
ClamAVWin.Worm.Warezov-6804540-0
GDataTrojan.GenericKD.30865232
BitDefenderTrojan.GenericKD.30865232
NANO-AntivirusTrojan.Win32.Warezov.fadsim
ViRobotWorm.Win32.Z.Warezov.536148
TencentMalware.Win32.Gencirc.10b3b0b6
Ad-AwareTrojan.GenericKD.30865232
SophosTroj/Agent-BAKM
ComodoWorm.Win32.Stration.DR@13yt
F-SecureWorm.WORM/Stration.C
BitDefenderThetaAI:FileInfector.B7B4D1F315
VIPRETrojan.Win32.Generic!BT
Invinceaheuristic
Trapminesuspicious.low.ml.score
FireEyeGeneric.mg.14a486559d91a7c1
EmsisoftTrojan.GenericKD.30865232 (B)
SentinelOneDFI – Malicious PE
F-ProtW32/Warezov.AI@mm
Endgamemalicious (high confidence)
AviraWORM/Stration.C
Antiy-AVLWorm[Email]/Win32.Warezov
MicrosoftWorm:Win32/Stration.M@mm
JiangminWorm.Warezov.avj
ArcabitTrojan.Generic.D1D6F750
AegisLabWorm.Win32.Warezov.tpLU
ZoneAlarmEmail-Worm.Win32.Warezov.gen
AhnLab-V3Worm/Win32.Warezov.R227713
Acronissuspicious
McAfeeGenericRXFJ-CM!14A486559D91
MAXmalware (ai score=82)
VBA32Worm.Warezov
MalwarebytesWorm.Stration
PandaW32/Spamta.BV.worm
TrendMicro-HouseCallMal_Strat-3
RisingWorm.Stration!1.B560 (CLOUD)
YandexI-Worm.Opnis!l0hoL16v56k
IkarusWin32.Warezov
MaxSecureWorm.Warezov.GEN
FortinetW32/Stration.46FD!tr
AVGWin32:Warezov-FL [Wrm]
Paloaltogeneric.ml
Qihoo-360Win32/Worm.Warezov.A

How to remove Worm.Stration?

Worm.Stration removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment