Gen:Trojan.Heur.9y1@vqu9UYmi (BitDefender), Worm:Win32/Mira.A (Microsoft), Trojan.Win32.Agent.icgh (Kaspersky), Worm.Win32.Mira.a (v) (VIPRE), Trojan.MulDrop5.32888 (DrWeb), Gen:Trojan.Heur.9y1@vqu9UYmi (B) (Emsisoft), W32/Worm-FUC!CC65720EF4BF (McAfee), W32.SillyFDC (Symantec), Trojan-Spy.Zbot (Ikarus), Gen:Trojan.Heur.9y1@vqu9UYmi (FSecure), SHeur4.BVDT (AVG), Win32:Malware-gen (Avast), WORM_MIRAS.SMN (TrendMicro), Gen:Trojan.Heur.9y1@vqu9UYmi (AdAware), Trojan.Win32.Swrort.4.FD, TrojanSwrort.YR (Lavasoft MAS)Behaviour: Trojan-Spy, Trojan, Worm, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: cc65720ef4bf65cbf625ea210cc4a52c
SHA1: 8132897878db6921bfc7eae9c690286de187df81
SHA256: 5b545e71b16766135941e852dce1918700ed9c9a9f3fa15f3adc7d969702f082
SSDeep: 24576:/1/aGLDCM4D8ayGMZo8/s7BRzsIC1s PqFep61lEt0KuVYTH3TAJItX2Sknvf6Pf:wD8ayGMZoPBBXy
Size: 1010931 bytes
File type: EXE
Platform: WIN32
Entropy: Probably Packed
PEID: UPolyXv05_v6
Company: CamStudio Group
Created at: no data
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan-Spy. Spy program intended for stealing user's confidential data.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
gokyp.exe:1916
%original file name%.exe:3628
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process gokyp.exe:1916 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1963131 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)
The Trojan deletes the following file(s):
C:\Mirax (0 bytes)
C:\Mirav (0 bytes)
C:\Miraw (0 bytes)
C:\Mirar (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Mirao (0 bytes)
C:\Mirah (0 bytes)
C:\Mirai (0 bytes)
C:\Mirad (0 bytes)
C:\Miraf (0 bytes)
C:\Mirab (0 bytes)
C:\Mirac (0 bytes)
The process %original file name%.exe:3628 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\gokyp.exe (1020884 bytes)
Registry activity
The process gokyp.exe:1916 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\gokyp.exe"
Dropped PE files
MD5 | File path |
---|---|
5d0e24bf2d74a683ff5e0eb938cda647 | c:\$Recycle.Bin .exe |
2a9123f47777d3eec79ec531e55d1169 | c:\BOOTSECT.BAK .exe |
07e89a25e0c2041e0a9fa3d0ef799b75 | c:\Boot .exe |
b6bc3df858101cb356e20d1a79714e38 | c:\Documents and Settings .exe |
d7e773b040e654bb7384b7f2fd5298da | c:\Perl .exe |
a4db2c6b1d0df8b1f4fac315a7e8efb0 | c:\Program Files .exe |
68051f69892820c15ca83cbd45fcc667 | c:\ProgramData .exe |
2549139ceeb2c40c2ea0aeb04527d833 | c:\ProgramData\Saaaalamm\Mira.h |
329338d01a272986f8944d6e14b8a3e7 | c:\ProgramData\gokyp.exe |
c8c993c698cda3e3b6aa8f0cce440d8d | c:\System Volume Information .exe |
e24b0252d66a3b30aa58d9e15cfdfd11 | c:\Users .exe |
2549139ceeb2c40c2ea0aeb04527d833 | c:\Users\All Users\Saaaalamm\Mira.h |
329338d01a272986f8944d6e14b8a3e7 | c:\Users\All Users\gokyp.exe |
06ab9bd9ae3e1248774d34a46ccbbce9 | c:\Windows .exe |
22ecbd59e01497a643b0f258f9b9dbb2 | c:\XELDZ .exe |
6606244d7e19caa8c3f6daaedb2f3da4 | c:\autoexec.bat .exe |
d1557a4af94ea8403638c4d8c47eb142 | c:\bootmgr .exe |
d967aa3ab584e250f1c9b5a3f0552f8f | c:\%original file name%.exe .exe |
b9d8508123dc9488d13fa1107c3db1f6 | c:\config.sys .exe |
540f708bb52a986fa20e5a698be5da49 | c:\marker .exe |
c6559575d6f8449a99763abb23eb7688 | c:\original .exe |
451ce85eb8a2cb7424848a94aa9abb68 | c:\pagefile.sys .exe |
9964d1674affd5fa31879b2615dfdb25 | c:\totalcmd .exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
gokyp.exe:1916
%original file name%.exe:3628 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1963131 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)
C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\gokyp.exe (1020884 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\gokyp.exe"
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: Russian (Russia)
Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: Russian (Russia)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 245368 | 245760 | 4.21465 | 8b164ac8ef3742f37830dc1842275667 |
.data | 249856 | 608 | 1024 | 0.488703 | 6fda88cf7188a8245a53dfde927250fd |
.rdata | 253952 | 9384 | 9728 | 3.47165 | dbe852009dbd077a9976cb0ecfb9aadf |
.bss | 266240 | 18576 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.idata | 286720 | 2212 | 2560 | 2.97703 | 5e5242c565219f3bd33a6568632559dc |
.rsrc | 290816 | 758300 | 750835 | 4.84953 | 8676a4e6fcaf267e19ac3fa0671ec8ee |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
gokyp.exe_1916:
.text
.text
`.data
`.data
.rdata
.rdata
@.bss
@.bss
.idata
.idata
C:\ProgramData\gokyp.exe
C:\ProgramData\gokyp.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows
Windows
Operating System
Operating System
%H:%M:%S
%H:%M:%S
%m/%d/%y
%m/%d/%y
-0123456789
-0123456789
%s:%u: failed assertion `%s'
%s:%u: failed assertion `%s'
RegCloseKey
RegCloseKey
RegOpenKeyA
RegOpenKeyA
ADVAPI32.DLL
ADVAPI32.DLL
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
SHELL32.DLL
SHELL32.DLL