Skip to main content

Gen.Trojan.Heur.9y1vqu9UYmi_e6113382c6


Trojan.Win32.Agent.icgh (Kaspersky), Gen:Trojan.Heur.9y1@vqu9UYmi (B) (Emsisoft), Gen:Trojan.Heur.9y1@vqu9UYmi (AdAware), Trojan.Win32.Swrort.4.FD, TrojanSwrort.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e6113382c66b9cd0528a5f4f924fdb7d

SHA1: 498bccb25de56675faa366601734ceb3537666b2

SHA256: c7fa50884c14f1c39db6952edd4adbf2faeb2e70cf869a09300de0387e75d407

SSDeep: 24576:/1/aGLDCM4D8ayGMZo8/uvehD6mQ2iOzV87yD21Qh8sS0h7PjK4Vdy9MCuSz:wD8ayGMZosy98y

Size: 1010931 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: EU Millennium Business LP

Created at: no data

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1388
nvmsin.exe:1224

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1388 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\nvmsin.exe (1020359 bytes)
%Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (960207 bytes)

The process nvmsin.exe:1224 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\AUTOEXEC.BAT .exe (1963130 bytes)
C:\MSDOS.SYS .exe (1963130 bytes)
C:\IO.SYS .exe (1963130 bytes)
C:\boot.ini .exe (1963130 bytes)
%Documents and Settings% .exe (1963130 bytes)
C:\RECYCLER .exe (1963130 bytes)
C:\ntldr .exe (1963130 bytes)
C:\original .exe (1963130 bytes)
C:\totalcmd .exe (1963130 bytes)
C:\NTDETECT.COM .exe (1963130 bytes)
C:\%original file name%.exe .exe (1963130 bytes)
C:\System Volume Information .exe (1963130 bytes)
C:\CONFIG.SYS .exe (1963130 bytes)
C:\marker .exe (1963130 bytes)
%Program Files% .exe (1963130 bytes)
%WinDir% .exe (1963130 bytes)
C:\pagefile.sys .exe (1963130 bytes)

The Trojan deletes the following file(s):

C:\Mirax (0 bytes)
C:\Miray (0 bytes)
C:\Mirav (0 bytes)
C:\Miras (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Mirah (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirab (0 bytes)
C:\Mirac (0 bytes)

Registry activity

The process %original file name%.exe:1388 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 BD 95 AD E9 04 0C 0C 21 EA 1B ED B9 3C 2A 94"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process nvmsin.exe:1224 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\nvmsin.exe"

Dropped PE files

MD5 File path
10c96393e5df53b4d16eda50e97a1c74c:\AUTOEXEC.BAT .exe
3a3418eaecfd8714f938e9e312357cb4c:\CONFIG.SYS .exe
0d6c71c92c39114ec2d71fab7104418ac:\Documents and Settings .exe
2549139ceeb2c40c2ea0aeb04527d833c:\Documents and Settings\All Users\Application Data\Saaaalamm\Mira.h
e6975c308fe5d8e3b55b50d6b5656db2c:\Documents and Settings\All Users\Application Data\nvmsin.exe
f9be61b9a21ecc139819100db37c6bc1c:\IO.SYS .exe
bc5c1ecab36a686f07c734092b8b5615c:\MSDOS.SYS .exe
0bdbe4ef2b85ad2df994d4509f14f715c:\NTDETECT.COM .exe
7b234a44c550e4f49236dfe13daf4aadc:\Perl .exe
8703f698114e413858e604799c0e4c78c:\Program Files .exe
e6bb109c6722e2b147a705a2610b29a0c:\RECYCLER .exe
3f852714ea65f145b91d40a0f2102ca9c:\System Volume Information .exe
eee6ec9aa84ac29e505460456ffc6167c:\WINDOWS .exe
b2aed5e6986f1330364a736ee5e63ac3c:\boot.ini .exe
41bb61adf87dc37b51f5bbc52fa30e80c:\%original file name%.exe .exe
f1bc37d44bbebce74227b4c006fea20ec:\marker .exe
f6e832145c1e2336b5ebf44b218428e0c:\ntldr .exe
4831f935ebe02119bf12ba04ce0702fec:\original .exe
3bf6c32d238a33daee263c890c840bd7c:\pagefile.sys .exe
2942d043d342463b6a998e015c7055b5c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1388
    nvmsin.exe:1224

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\All Users\Application Data\nvmsin.exe (1020359 bytes)
    %Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (960207 bytes)
    C:\AUTOEXEC.BAT .exe (1963130 bytes)
    C:\MSDOS.SYS .exe (1963130 bytes)
    C:\IO.SYS .exe (1963130 bytes)
    C:\boot.ini .exe (1963130 bytes)
    %Documents and Settings% .exe (1963130 bytes)
    C:\RECYCLER .exe (1963130 bytes)
    C:\ntldr .exe (1963130 bytes)
    C:\original .exe (1963130 bytes)
    C:\totalcmd .exe (1963130 bytes)
    C:\NTDETECT.COM .exe (1963130 bytes)
    C:\%original file name%.exe .exe (1963130 bytes)
    C:\System Volume Information .exe (1963130 bytes)
    C:\CONFIG.SYS .exe (1963130 bytes)
    C:\marker .exe (1963130 bytes)
    %Program Files% .exe (1963130 bytes)
    %WinDir% .exe (1963130 bytes)
    C:\pagefile.sys .exe (1963130 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\nvmsin.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40962453682457604.214658b164ac8ef3742f37830dc1842275667
.data24985660810240.4887036fda88cf7188a8245a53dfde927250fd
.rdata253952938497283.47165dbe852009dbd077a9976cb0ecfb9aadf
.bss2662401857600d41d8cd98f00b204e9800998ecf8427e
.idata286720221225602.977035e5242c565219f3bd33a6568632559dc
.rsrc2908167583007508354.91583bc6c1d2c7aa9211981b88cff69d72902

Dropped from:

19d0c62237c2abed6dd5fadc41539a11

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

nvmsin.exe_1392:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

%Documents and Settings%\All Users\Application Data\nvmsin.exe

%Documents and Settings%\All Users\Application Data\nvmsin.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL

nvmsin.exe_1224:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

%Documents and Settings%\All Users\Application Data\nvmsin.exe

%Documents and Settings%\All Users\Application Data\nvmsin.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL