Trojan.Win32.MicroFake.ba (Kaspersky), Trojan.Microfake.D (B) (Emsisoft), Trojan.Microfake.D (AdAware), VirusVirut.YR, DDoSNitol.YR (Lavasoft MAS)Behaviour: Trojan, Virus
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 72ce30645bd84be1ecc4dde1e6d8ce1f
SHA1: c9ba888205423dca0fb04746c913d38399876903
SHA256: 8d0a69498488888a9ccb7a725f294817855bd3ae0411e99451bd770e61c71bcd
SSDeep: 3072:TUJuIyDKZRyHj9bTINkhb9gMBceBBLRggsqADvgp:TRI4yRyHjJ/BceRLs9v
Size: 137728 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-06-08 12:59:36
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
regsvr32.exe:2180
hrl1498.tmp:1796
The Trojan injects its code into the following process(es):
fsflsu.exe:3388
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process regsvr32.exe:2180 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrl1498.tmp (261 bytes)
The process hrl1498.tmp:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\System32\fsflsu.exe (601 bytes)
The process fsflsu.exe:3388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\RCX1C84.tmp (17084 bytes)
C:\Windows\System32\hra33.dll (7 bytes)
C:\Windows\Sys (139 bytes)
C:\Boot\lpk.dll (673 bytes)
Registry activity
The process hrl1498.tmp:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\System\CurrentControlSet\Services\Distribuoyo]
"Description" = "Distribuajk Transaction Coordinator Service."
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SOFTWARE.LOG,"
Dropped PE files
MD5 | File path |
---|---|
50b2e1131e61706f7f1c84a8c2f88f9f | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SOFTWARE.LOG |
50b2e1131e61706f7f1c84a8c2f88f9f | c:\Windows\System32\fsflsu.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | www.Brenz.pl |
127.0.0.1 | validation.sls.microsoft.com |
Rootkit activity
The Trojan installs the following user-mode hooks in ntdll.dll:
NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
regsvr32.exe:2180
hrl1498.tmp:1796 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrl1498.tmp (261 bytes)
C:\Windows\System32\fsflsu.exe (601 bytes)
C:\RCX1C84.tmp (17084 bytes)
C:\Windows\System32\hra33.dll (7 bytes)
C:\Boot\lpk.dll (673 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 2860 | 3072 | 3.84485 | c9b6b9fbded3d4764666702b145428d1 |
.rdata | 8192 | 2505 | 2560 | 3.36056 | 6951ee1a0ff3a7f5a44727b4713506a3 |
.data | 12288 | 672 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 16384 | 130196 | 130560 | 5.04951 | f7f1019f9cba20d347086022584f640d |
.reloc | 147456 | 494 | 512 | 3.52939 | cfa8d04dd000bb30ab126902176ed40d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
ilo.brenz.pl | 148.81.111.121 |
fei9988.3322.org | 221.130.179.36 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
wje..........q......^...#bZ.:..<.......#..-v..x.Z9S.V.bz.A.s.].9..c.
:irc 001 nuwrexuk :Hi virtu.:irc 376 nuwrexuk :End of /MOTD command.:irc 001 nuwrexuk :Hi virtu.:irc 376 nuwrexuk :End of /MOTD command..:nuwrexuk JOIN #.0..:nuwrexuk JOIN #.0.
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
regsvr32.exe_2180:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
msvcrt.dll
msvcrt.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
COMCTL32.dll
COMCTL32.dll
regsvr32.pdb
regsvr32.pdb
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
version="5.1.0.0"
version="5.1.0.0"
name="Microsoft.Windows.RegSvr32"
name="Microsoft.Windows.RegSvr32"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
\regsvr32.exe
\regsvr32.exe
user32.dll
user32.dll
Excessive # of DLL's on cmdline
Excessive # of DLL's on cmdline
6.1.7600.16385 (win7_rtm.090713-1255)
6.1.7600.16385 (win7_rtm.090713-1255)
REGSVR32.EXE
REGSVR32.EXE
Windows
Windows
Operating System
Operating System
6.1.7600.16385
6.1.7600.16385
fsflsu.exe_3388:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
.ld50l
.ld50l
.lyA/l
.lyA/l
USER32.dll
USER32.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
WINMM.dll
WINMM.dll
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
MFC42.DLL
MFC42.DLL
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
fei9988.3322.org:8080
fei9988.3322.org:8080
564528578564528578
564528578564528578
%u.%u.%u.%u
%u.%u.%u.%u
hra%u.dll
hra%u.dll
iexplore.exe
iexplore.exe
stf%c%c%c%c%c.exe
stf%c%c%c%c%c.exe
PlusCtrl.dll
PlusCtrl.dll
kernel32.dll
kernel32.dll
SOFTWARE.LOG
SOFTWARE.LOG
%c%c%c%c%c%c.exe
%c%c%c%c%c%c.exe
%u MB
%u MB
%u MHz
%u MHz
Windows NT
Windows NT
Windows 7
Windows 7
Windows 2008
Windows 2008
Windows Vista
Windows Vista
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Program Files\Internet Explorer\iexplore.exe
\Program Files\Internet Explorer\iexplore.exe
#0%s!
#0%s!
%s/%s
%s/%s
GET %s HTTP/1.1
GET %s HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
Host: %s:%d
Host: %s:%d
Host: %s
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
%s %s%s
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
%d.%d.%d.%d
%d.%d.%d.%d
192.168.1.244
192.168.1.244
`.rdata
`.rdata
@.reloc
@.reloc
SHLWAPI.dll
SHLWAPI.dll
lpk.dll
lpk.dll
9(Cj%s
9(Cj%s
FX !>%D
FX !>%D
ADVAPI32.DLL
ADVAPI32.DLL
JOIN #.%d
JOIN #.%d
DSTAMP %ddd
DSTAMP %ddd
\USERINIT.EXE
\USERINIT.EXE
%s:*:enabled:@shell32.dll,-1
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
ilo.brenz.pl
ilo.brenz.pl
ant.trenz.pl
ant.trenz.pl
NICK fqwsyamo
NICK fqwsyamo
SFC.DLL
SFC.DLL
SFC_OS.DLL
SFC_OS.DLL
USER32.DLL
USER32.DLL
SHLWAPI.DLL
SHLWAPI.DLL
WSOCK32.DLL
WSOCK32.DLL
WININET.DLL
WININET.DLL
%.6x . . :%c%.8x%x *%s
%.6x . . :%c%.8x%x *%s
KERNEL32.DLL
KERNEL32.DLL
windowsupdate
windowsupdate
drweb
drweb
NICK xscwxrus
NICK xscwxrus
%.6x . . :%c%.8x%x %s
%.6x . . :%c%.8x%x %s
JOIN
JOIN
127.0.0.1 VVV.Brenz.pl
127.0.0.1 VVV.Brenz.pl
#
#
cmd /c RD /s /q "%s"
cmd /c RD /s /q "%s"
"%s" a -r -ep1"%s" "%s" "%s\lpk.dll"
"%s" a -r -ep1"%s" "%s" "%s\lpk.dll"
"%s" x "%s" *.exe "%s\"
"%s" x "%s" *.exe "%s\"
cmd /c %s vb "%s" lpk.dll|find /i "lpk.dll"
cmd /c %s vb "%s" lpk.dll|find /i "lpk.dll"
rar.exe
rar.exe
1, 0, 0, 1
1, 0, 0, 1
server.EXE
server.EXE
fsflsu.exe_3388_rwx_0040C000_00008000:
9(Cj%s
9(Cj%s
FX !>%D
FX !>%D
1, 0, 0, 1
1, 0, 0, 1
server.EXE
server.EXE
fsflsu.exe_3388_rwx_00415000_00007000:
ADVAPI32.DLL
ADVAPI32.DLL
JOIN #.%d
JOIN #.%d
DSTAMP %ddd
DSTAMP %ddd
\USERINIT.EXE
\USERINIT.EXE
%s:*:enabled:@shell32.dll,-1
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
ilo.brenz.pl
ilo.brenz.pl
ant.trenz.pl
ant.trenz.pl
NICK fqwsyamo
NICK fqwsyamo
SFC.DLL
SFC.DLL
SFC_OS.DLL
SFC_OS.DLL
USER32.DLL
USER32.DLL
SHLWAPI.DLL
SHLWAPI.DLL
WSOCK32.DLL
WSOCK32.DLL
WININET.DLL
WININET.DLL
%.6x . . :%c%.8x%x *%s
%.6x . . :%c%.8x%x *%s
KERNEL32.DLL
KERNEL32.DLL
windowsupdate
windowsupdate
drweb
drweb
fsflsu.exe_3388_rwx_0041D000_00007000:
ADVAPI32.DLL
ADVAPI32.DLL
DSTAMP %ddd
DSTAMP %ddd
\USERINIT.EXE
\USERINIT.EXE
%s:*:enabled:@shell32.dll,-1
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
ilo.brenz.pl
ilo.brenz.pl
ant.trenz.pl
ant.trenz.pl
NICK xscwxrus
NICK xscwxrus
SFC.DLL
SFC.DLL
SFC_OS.DLL
SFC_OS.DLL
USER32.DLL
USER32.DLL
SHLWAPI.DLL
SHLWAPI.DLL
WSOCK32.DLL
WSOCK32.DLL
WININET.DLL
WININET.DLL
%.6x . . :%c%.8x%x %s
%.6x . . :%c%.8x%x %s
JOIN
JOIN
127.0.0.1 VVV.Brenz.pl
127.0.0.1 VVV.Brenz.pl
#
#
KERNEL32.DLL
KERNEL32.DLL
windowsupdate
windowsupdate
drweb
drweb