Susp_Dropper (Kaspersky), Trojan.GenericKD.3603338 (B) (Emsisoft), Trojan.GenericKD.3603338 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: e88b870d7b896328bbf9be446d1e9211
SHA1: f733c2c7549d30aec64ae994e9cc97f5b52522ae
SHA256: 7b9268e036482ac09df24efad3a581e4bf4c1b4b0c94a8212034356538525c4a
SSDeep: 49152:sCLM0FFi3fxMAtxrdK kXPYhAyGWv4uA6 s8KuqGaX0ToIBAUZLYB:iNtxrsgG02JBAUZLi
Size: 2510848 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Lis
Created at: 2016-02-11 18:58:39
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1652
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Config.ini (105 bytes)
Registry activity
The process %original file name%.exe:1652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"EnableFileTracing" = "0"
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASAPI32]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\e88b870d7b896328bbf9be446d1e9211_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Config.ini (105 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ??K???Www.hypanda.com
Product Version: 1.0.0.0
Legal Copyright: ??K???Www.hypanda.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??K???Www.hypanda.com
Language: English (United States)
Company Name: Product Name: ??K???Www.hypanda.comProduct Version: 1.0.0.0Legal Copyright: ??K???Www.hypanda.comLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??K???Www.hypanda.comLanguage: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 764451 | 765952 | 4.55205 | e0958094e663ec5ec75a86a95047a307 |
.rdata | 770048 | 1627006 | 1630208 | 5.28158 | 28960eb9a0f803bb91dd9270cf52bec8 |
.data | 2400256 | 255336 | 77824 | 3.70203 | 69fffde155582d2726ce214c869da9e3 |
.rsrc | 2658304 | 30180 | 32768 | 3.41993 | 555b76645769d67eb0d85e2b6b3cb344 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://cdn.sp.cdntip.com/ic.asp | |
hxxp://1212.ip138.com/ic.asp | 42.56.65.150 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ic.asp HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: 1212.ip138.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
Connection: keep-alive
Date: Sun, 30 Oct 2016 22:56:07 GMT
Content-Type: text/html
Content-Length: 219
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDQCTTBBDB=OECGCLHAGFOJIOGNHMCAOOPO; path=/
X-Daa-Tunnel: hop_count=1
<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=gb2312">..<title> ....IP.... </title>..</head>..<body style="margin:0px"><center>....IP....[194.242.96.218] ............</center></body></html>HTTP/1.1 200 OK..Server: Microsoft-IIS/6.0..Connection: keep-alive..Date: Sun, 30 Oct 2016 22:56:07 GMT..Content-Type: text/html..Content-Length: 219..X-Powered-By: ASP.NET..Set-Cookie: ASPSESSIONIDQCTTBBDB=OECGCLHAGFOJIOGNHMCAOOPO; path=/..X-Daa-Tunnel: hop_count=1..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=gb2312">..<title> ....IP.... </title>..</head>..<body style="margin:0px"><center>....IP....[194.242.96.218] ............</center></body></html>..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1652:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
Bv.SCv=kAv
Bv.SCv=kAv
wininet.dll
wininet.dll
kernel32.dll
kernel32.dll
ole32.dll
ole32.dll
Winhttp.dll
Winhttp.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
WinHttpCheckPlatform
WinHttpCheckPlatform
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpOpen
WinHttpOpen
WinHttpConnect
WinHttpConnect
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpSetOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReadData
WinHttpQueryHeaders
WinHttpQueryHeaders
ShellExecuteA
ShellExecuteA
{A0005538-9391-4dd9-B4D6-8EB7B9360F08}
{A0005538-9391-4dd9-B4D6-8EB7B9360F08}
\Config.ini
\Config.ini
hXXp://kg.qq.com/play.html?s=
hXXp://kg.qq.com/play.html?s=
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_getdetail?rnd=&g_tk=&callback=jsopgetsonginfo&shareid=
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_getdetail?rnd=&g_tk=&callback=jsopgetsonginfo&shareid=
https
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXps://
hXXp://
hXXp://
"nick":"(.*?)"
"nick":"(.*?)"
"playurl":"
"playurl":"
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_0&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&type=get_uinfo&start=1&num=8&touin=&share_uid=
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_0&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&type=get_uinfo&start=1&num=8&touin=&share_uid=
head_img_url":"
head_img_url":"
data.ugclist
data.ugclist
].title
].title
data.ugclist[
data.ugclist[
].shareid
].shareid
@1970-01-01 08:00:00
@1970-01-01 08:00:00
","nickname":"
","nickname":"
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Adodb.Stream
Adodb.Stream
WinHttp
WinHttp
&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&nocache=
&inCharset=GB2312&outCharset=utf-8&g_tk=5381&g_tk_openkey=5381&nocache=
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_
hXXp://cgi.kg.qq.com/fcgi-bin/kg_ugc_get_homepage?jsonpCallback=callback_
function time(){return Math.random()}
function time(){return Math.random()}
/userRpm/PPPoECfgRpm.htm?wan=0&wantype=2&acc=
/userRpm/PPPoECfgRpm.htm?wan=0&wantype=2&acc=
&psw=Hello123World&confirm=Hello123World&specialDial=100&SecType=0&sta_ip=0.0.0.0&sta_mask=0.0.0.0&linktype=1&waittime=15&Disconnect=露