GenPack.Generic.Malware.Sdld.1280091E_44cfceefd5 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The GenPack creates the following process(es):No processes have been created.The GenPack injects its code into the following process(es):

%original file name%.exe:2604

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2604 makes changes in the file system.

The GenPack creates and/or writes to the following file(s):

C:\Windows\win32dc\FlatOut_fix.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942 cheat.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2(codes).exe (673 bytes)
C:\Windows\win32dc\Doom 3(nocd).exe (673 bytes)
C:\Windows\win32dc\Half-Life 2_nocd.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942_serial.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942 cdfix.exe (673 bytes)
C:\Windows\win32dc\Quake3 trainer.exe (17935 bytes)
C:\Windows\win32dc\DAoC fix.exe (10879 bytes)
C:\Windows\win32dc\BattleField 1942(codes).exe (673 bytes)

Registry activity

Dropped PE files

MD5	File path
bca5cae5072346e1392440729b5e7b66	c:\Windows\win32dc\DAoC fix.exe
3d576f5787c5c21fe5fea283f359ec9f	c:\Windows\win32dc\Quake3 trainer.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original GenPack file.
Delete or disinfect the following files created/modified by the GenPack:
C:\Windows\win32dc\FlatOut_fix.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942 cheat.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2(codes).exe (673 bytes)
C:\Windows\win32dc\Doom 3(nocd).exe (673 bytes)
C:\Windows\win32dc\Half-Life 2_nocd.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942_serial.exe (673 bytes)
C:\Windows\win32dc\BattleField 1942 cdfix.exe (673 bytes)
C:\Windows\win32dc\Quake3 trainer.exe (17935 bytes)
C:\Windows\win32dc\DAoC fix.exe (10879 bytes)
C:\Windows\win32dc\BattleField 1942(codes).exe (673 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	57344	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	61440	77824	76288	5.52273	f21ff4cceefda9b5054791a5e3f71f39
.rsrc	139264	4096	2048	2.63797	b5916a1f63e299e8c8a487a2ccfe581b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 102
160d678a252aefd448f7bd865300d247
ba46a5833f97662f8a6ee78799bbdae0
da6e382e08a3c834910e324e8c374f70
e2ece1575866f0ca2f45b1108035502d
e90a05afabf9d324c7dfc8a7a274009a
d9198e914ce05f856cedab900e4de37f
b600785770e6decccbec456bcb286410
97363988837118be3c05b952e1bb7d70
9e2328c7872843ff5149b70751e78b2c
fd2c800d3c78560591aee7f1b77549bc
f53a93314c6fc7ee2eb3f932e883d090
3fa15d68ddc812b05674674d25230669
ac52f0d2d4e80319ca96ee9edad1904b
a27dc1ec88ee99ea69da31a6b3db6d11
e84e9a54eb52f8ea74f73388827ee43f
cebcc604c5708853e6d22085c6daec41
ce0718bffbecccb038720866330bb4c1
8e23290f91f5c9b2cd3774e9079e3cc2
5ccab02f261101bc9a4a839f2a43a04e
5ff92265c5224c46d90f70c2b8e3dc2a
229ce8cf36aa7ee1b800b2b4a9025a5b
17c9476d094315b62e9c40b5c709e9b5
f581ca27f039a9dcfc29d748b14866f1
eb0105edfc43d14854a6735f4591551c
e5b37efa77f703c8fc717e2d61036389
d8a63c42ec102be1704df4975ff8f5e5

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The GenPack connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2604:

`.rsrc

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

A.zm2

y.pD/

e./.VLD

&pWebServ

FO^nKey

.dgWHlV]O_

v6dÂ

%xLy?x

KERNEL32.DLL

advapi32.dll

mpr.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

wsock32.dll

%original file name%.exe_2604_rwx_00401000_00014000:

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

A.zm2

y.pD/

e./.VLD

&pWebServ

FO^nKey

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps