Skip to main content

Trojan.GenericKD.3603338_e88b870d7b


Susp_Dropper (Kaspersky), Trojan.GenericKD.3603338 (B) (Emsisoft), Trojan.GenericKD.3603338 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e88b870d7b896328bbf9be446d1e9211

SHA1: f733c2c7549d30aec64ae994e9cc97f5b52522ae

SHA256: 7b9268e036482ac09df24efad3a581e4bf4c1b4b0c94a8212034356538525c4a

SSDeep: 49152:sCLM0FFi3fxMAtxrdK kXPYhAyGWv4uA6 s8KuqGaX0ToIBAUZLYB:iNtxrsgG02JBAUZLi

Size: 2510848 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: Lis

Created at: 2016-02-11 18:58:39

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.


Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1652

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1652 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Config.ini (105 bytes)

Registry activity

The process %original file name%.exe:1652 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"EnableFileTracing" = "0"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Config.ini (105 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ??K???Www.hypanda.com
Product Version: 1.0.0.0
Legal Copyright: ??K???Www.hypanda.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??K???Www.hypanda.com
Language: English (United States)

Company Name: Product Name: ??K???Www.hypanda.comProduct Version: 1.0.0.0Legal Copyright: ??K???Www.hypanda.comLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??K???Www.hypanda.comLanguage: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40967644517659524.55205e0958094e663ec5ec75a86a95047a307
.rdata770048162700616302085.2815828960eb9a0f803bb91dd9270cf52bec8
.data2400256255336778243.7020369fffde155582d2726ce214c869da9e3
.rsrc265830430180327683.41993555b76645769d67eb0d85e2b6b3cb344

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://cdn.sp.cdntip.com/ic.asp
hxxp://1212.ip138.com/ic.asp42.56.65.150

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ic.asp HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: 1212.ip138.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Microsoft-IIS/6.0

Connection: keep-alive

Date: Sun, 30 Oct 2016 22:56:07 GMT

Content-Type: text/html

Content-Length: 219

X-Powered-By: ASP.NET

Set-Cookie: ASPSESSIONIDQCTTBBDB=OECGCLHAGFOJIOGNHMCAOOPO; path=/

X-Daa-Tunnel: hop_count=1

<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=gb2312">..<title> ....IP.... </title>..</head>..<body style="margin:0px"><center>....IP....[194.242.96.218] ............</center></body></html>HTTP/1.1 200 OK..Server: Microsoft-IIS/6.0..Connection: keep-alive..Date: Sun, 30 Oct 2016 22:56:07 GMT..Content-Type: text/html..Content-Length: 219..X-Powered-By: ASP.NET..Set-Cookie: ASPSESSIONIDQCTTBBDB=OECGCLHAGFOJIOGNHMCAOOPO; path=/..X-Daa-Tunnel: hop_count=1..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=gb2312">..<title> ....IP.... </title>..</head>..<body style="margin:0px"><center>....IP....[194.242.96.218] ............</center></body></html>..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1652:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

Bv.SCv=kAv

Bv.SCv=kAv

wininet.dll

wininet.dll

kernel32.dll

kernel32.dll

ole32.dll

ole32.dll

Winhttp.dll

Winhttp.dll

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

WinHttpCheckPlatform

WinHttpCheckPlatform

WinHttpCrackUrl

WinHttpCrackUrl

WinHttpOpen

WinHttpOpen

WinHttpConnect

WinHttpConnect

WinHttpOpenRequest

WinHttpOpenRequest

WinHttpSetTimeouts

WinHttpSetTimeouts

WinHttpSetCredentials

WinHttpSetCredentials

WinHttpCloseHandle

WinHttpCloseHandle

WinHttpSetOption

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpReceiveResponse

WinHttpQueryDataAvailable

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpReadData

WinHttpQueryHeaders

WinHttpQueryHeaders

ShellExecuteA

ShellExecuteA

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

\Config.ini

\Config.ini

hXXp://kg.qq.com/play.html?s=

hXXp://kg.qq.com/play.html?s=

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_getdetail?rnd=&g_tk=&callback=jsopgetsonginfo&shareid=

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_getdetail?rnd=&g_tk=&callback=jsopgetsonginfo&shareid=

https

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

http=

HTTP/1.1

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXps://

hXXp://

hXXp://

"nick":"(.*?)"

"nick":"(.*?)"

"playurl":"

"playurl":"

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_0&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&type=get_uinfo&start=1&num=8&touin=&share_uid=

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_0&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&type=get_uinfo&start=1&num=8&touin=&share_uid=

head_img_url":"

head_img_url":"

data.ugclist

data.ugclist

].title

].title

data.ugclist[

data.ugclist[

].shareid

].shareid

@1970-01-01 08:00:00

@1970-01-01 08:00:00

","nickname":"

","nickname":"

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Adodb.Stream

Adodb.Stream

WinHttp

WinHttp

&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&nocache=

&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&nocache=

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_

hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_

function time(){return Math.random()}

function time(){return Math.random()}

/userRpm/PPPoECfgRpm.htm?wan=0&wantype=2&acc=

/userRpm/PPPoECfgRpm.htm?wan=0&wantype=2&acc=

&psw=Hello123World&confirm=Hello123World&specialDial=100&SecType=0&sta_ip=0.0.0.0&sta_mask=0.0.0.0&linktype=1&waittime=15&Disconnect=露