Skip to main content

Gen.Variant.Kazy.45011_2dd188c0aa


Trojan-Dropper.Win32.Mudrop.yfe (Kaspersky), Gen:Variant.Kazy.45011 (B) (Emsisoft), Gen:Variant.Kazy.45011 (AdAware), Backdoor.Win32.PcClient.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Backdoor, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 2dd188c0aa394218f26d96fdbe7d2ff6

SHA1: 4e6e6e6bc179cfc1ff4749068e165f599339fd23

SHA256: da98a023a1c9c6f2aed4f0cab68653ed33d5e6705a4441c0e0c5fbe52c3b535e

SSDeep: 768:cE6HJUhMmFguOuD1uDQUx3IWKPJs1gow2u9INETGy5PFdbF CGH4X0XTksill4:cE6HJUhMdAxuHKP4g 8Iyiy5NFF CGcO

Size: 39005 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-06-06 18:08:46

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

taskkill.exe:472
taskkill.exe:416
taskkill.exe:1808
rundll32.exe:468
sc.exe:436
cacls.exe:344
cacls.exe:476

The Trojan injects its code into the following process(es):

%original file name%.exe:1016

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rundll32.exe:468 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (12 bytes)

The process %original file name%.exe:1016 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%System%\CatRoot2 (96 bytes)
%System%\drivers\etc\hosts (5 bytes)
%WinDir%\SoftwareDistribution (4 bytes)
%WinDir%\pchealth\helpctr\System\images (4 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
%WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
%WinDir%\phpi.dll (22141559 bytes)
%WinDir%\pchealth\helpctr\System\panels (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
%Documents and Settings%\Default User (540 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
%WinDir%\pchealth\helpctr\System (4 bytes)
C:\$Directory (288 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%System%\config (192 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
%WinDir%\Prefetch (1728 bytes)
%Documents and Settings%\All Users\Application Data (4 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
%System%\CatRoot (4 bytes)
C:\autorun.inf (21 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
%WinDir%\assembly\GAC_32 (4 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
%System% (6740 bytes)
%System%\config\systemprofile\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
%Program Files%\Common Files\VMware\Drivers (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
%Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
%Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
%WinDir%\assembly\GAC_MSIL (36 bytes)
%WinDir%\Microsoft.NET (4 bytes)
%Documents and Settings%\NetworkService\Local Settings (4 bytes)
%WinDir%\WinSxS\Policies (8 bytes)
%WinDir%\SoftwareDistribution\Download (45 bytes)
%System%\oobe\html (4 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
%WinDir%\ime (4 bytes)
C:\1.exe (39 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
C:\ (4 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (8 bytes)
%Program Files%\Movie Maker (4 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation (4 bytes)
%Documents and Settings%\LocalService (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
%WinDir%\WinSxS (12 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US (4 bytes)
%WinDir% (1064 bytes)
%WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
C:\PROGRAM FILES (100 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32 (28 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
%Documents and Settings% (4 bytes)
%Documents and Settings%\Default User\Local Settings (4 bytes)
%WinDir%\$hf_mig$ (8 bytes)
%System%\spool\XPSEP\amd64 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
%WinDir%\ime\imjp8_1 (4 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Resource (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer (4 bytes)
%Documents and Settings%\NetworkService (4 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
%System%\oobe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
%Program Files%\Microsoft Office\Office14 (4 bytes)
%WinDir%\Temp (4 bytes)
%WinDir%\Installer (8 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (1732 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
%WinDir%\pchealth\helpctr (4 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
%WinDir%\Prefetch\TSHARK.EXE-2564C650.pf (106 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
%WinDir%\ime\imkr6_1 (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment (4 bytes)
%WinDir%\Web (4 bytes)
C:\totalcmd (4 bytes)
%Program Files%\Common Files\System (4 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
%Program Files%\Windows Media Player (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
%Documents and Settings%\%current user%\Application Data (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles (8 bytes)
%WinDir%\msagent (4 bytes)
%Program Files%\Movie Maker\Shared (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
%System%\wbem (588 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader (96 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%System%\mui (4 bytes)
%WinDir%\REGISTRATION (4 bytes)
%System%\spool\XPSEP\i386 (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_638.dat (4 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
%System%\config\systemprofile\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer# (4 bytes)
%System%\func.dll (17546807 bytes)
%Documents and Settings%\%current user%\Local Settings (8 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32 (28 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
%WinDir%\pchealth\helpctr\Config (4 bytes)
%Program Files%\Adobe\Reader 9.0 (4 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727 (1848 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (4 bytes)
%System%\drivers (768 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.ServiceModel# (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (4 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\System.DirectorySer# (4 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
%WinDir%\Help (248 bytes)
%WinDir%\security (4 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo (4 bytes)
%System%\config\systemprofile (4 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
%WinDir%\Installer\$PatchCache$\Managed (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data (4 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft (4 bytes)
%WinDir%\Web\printers (4 bytes)
%System%\config\systemprofile\Local Settings (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security (4 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5 (12 bytes)
%Documents and Settings%\LocalService\Local Settings (4 bytes)
%Program Files%\COMMON FILES (4 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
%Program Files%\Common Files\Microsoft Shared (4 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins (4 bytes)
%System%\oobe\html\mouse (4 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
%WinDir%\assembly (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas# (4 bytes)

Registry activity

The process taskkill.exe:472 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 55 CD 5C 9B 4D A7 27 6F FC A6 A3 3D 4B D4 92"

The process taskkill.exe:416 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 9B F5 DF 52 81 98 3A 5E 55 D6 A5 4D 4F 14 D7"

The process taskkill.exe:1808 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 6E 7D 45 27 B8 B8 F8 E4 8F 2C EE 73 E3 BD 04"

The process rundll32.exe:468 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 DF 34 FC 52 16 F2 54 02 74 6A 7F FE D1 10 15"

The process sc.exe:436 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D C7 58 0F 70 9A 7B 6B D7 90 29 35 C6 98 83 88"

The process cacls.exe:344 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC EF A6 25 A8 FF C9 98 73 CE 24 6C 3D 5C 5D 9C"

The process cacls.exe:476 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 19 7E 5D 49 FC C9 8E F0 EE 20 D5 79 5B 03 2E"

Dropped PE files

MD5 File path
c304efc4114cec5492b915f19b44ec5bc:\WINDOWS\LastGood\system32\drivers\acpiec.sys
b8eedc98c04854e78eff7ffa274fcaf8c:\WINDOWS\phpi.dll
9859c0f6936e723e4892d7141b1327d5c:\WINDOWS\system32\dllcache\acpiec.sys
c304efc4114cec5492b915f19b44ec5bc:\WINDOWS\system32\drivers\OLD3.tmp
601b3f2466bfa6989b9c7586b5ba54aac:\WINDOWS\system32\drivers\pcidump.sys
dd04d564e022a6f1a7b76a34b55d1a62c:\WINDOWS\system32\func.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1v.onondown.com.cn
127.0.0.2ymsdasdw1.cn
127.0.0.3h96b.info
127.0.0.0fuck.zttwp.cn
127.0.0.0www.hackerbf.cn
127.0.0.0geekbyfeng.cn
127.0.0.0121.14.101.68
127.0.0.0ppp.etimes888.com
127.0.0.0www.bypk.com
127.0.0.0CSC3-2004-crl.verisign.com
127.0.0.1va9sdhun23.cn
127.0.0.0udp.hjob123.com
127.0.0.2bnasnd83nd.cn
127.0.0.0www.gamehacker.com.cn
127.0.0.0gamehacker.com.cn
127.0.0.3adlaji.cn
127.0.0.1858656.com
127.1.1.1bnasnd83nd.cn
127.0.0.1my123.com
127.0.0.0user1.12-27.net
127.0.0.18749.com
127.0.0.0fengent.cn
127.0.0.14199.com
127.0.0.1user1.16-22.net
127.0.0.17379.com
127.0.0.12be37c5f.3f6e2cc5f0b.com
127.0.0.17255.com
127.0.0.1user1.23-12.net
127.0.0.13448.com
127.0.0.1www.guccia.net
127.0.0.17939.com
127.0.0.1a.o1o1o1.nEt
127.0.0.18009.com
127.0.0.1user1.12-73.cn
127.0.0.1piaoxue.com
127.0.0.13n8nlasd.cn
127.0.0.1kzdh.com
127.0.0.0www.sony888.cn
127.0.0.1about.blank.la
127.0.0.0user1.asp-33.cn
127.0.0.16781.com
127.0.0.0www.netkwek.cn
127.0.0.17322.com
127.0.0.0ymsdkad6.cn
127.0.0.0www.lkwueir.cn
127.0.0.106.jacai.com
127.0.1.1user1.23-17.net
127.0.0.11.jopenkk.com
127.0.0.0upa.luzhiai.net
127.0.0.11.jopenqc.com
127.0.0.0www.guccia.net
127.0.0.11.joppnqq.com
127.0.0.04m9mnlmi.cn
127.0.0.11.xqhgm.com
127.0.0.0mm119mkssd.cn
127.0.0.1100.332233.com
127.0.0.061.128.171.115:8080
127.0.0.1121.11.90.79
127.0.0.0www.1119111.com
127.0.0.1121565.net
127.0.0.0win.nihao69.cn
127.0.0.1125.90.88.38
127.0.0.116888.6to23.com
127.0.0.12.joppnqq.com
127.0.0.0puc.lianxiac.net
127.0.0.1204.177.92.68
127.0.0.0pud.lianxiac.net
127.0.0.1210.74.145.236
127.0.0.0210.76.0.133
127.0.0.1219.129.239.220
127.0.0.061.166.32.2
127.0.0.1219.153.40.221
127.0.0.0218.92.186.27
127.0.0.1219.153.46.27
127.0.0.0www.fsfsfag.cn
127.0.0.1219.153.52.123
127.0.0.0ovo.ovovov.cn
127.0.0.1221.195.42.71
127.0.0.0dw.com.com
127.0.0.1222.73.218.115
127.0.0.1203.110.168.233:80
127.0.0.13.joppnqq.com
127.0.0.1203.110.168.221:80
127.0.0.1363xx.com
127.0.0.1www1.ip10086.com.cm
127.0.0.14199.com
127.0.0.1blog.ip10086.com.cn
127.0.0.143242.com
127.0.0.1www.ccji68.cn
127.0.0.15.xqhgm.com
127.0.0.0t.myblank.cn
127.0.0.1520.mm5208.com
127.0.0.0x.myblank.cn
127.0.0.159.34.131.54
127.0.0.1210.51.45.5
127.0.0.159.34.198.228
127.0.0.1www.ew1q.cn
127.0.0.159.34.198.88
127.0.0.159.34.198.97
127.0.0.160.190.114.101
127.0.0.160.190.218.34
127.0.0.0qq-xing.com.cn
127.0.0.160.191.124.252
127.0.0.161.145.117.212
127.0.0.161.157.109.222
127.0.0.175.126.3.216
127.0.0.175.126.3.217
127.0.0.175.126.3.218
127.0.0.059.125.231.177:17777
127.0.0.175.126.3.220
127.0.0.175.126.3.221
127.0.0.175.126.3.222
127.0.0.1772630.com
127.0.0.1832823.cn
127.0.0.18749.com
127.0.0.1888.jopenqc.com
127.0.0.189382.cn
127.0.0.18v8.biz
127.0.0.197725.com
127.0.0.19gg.biz
127.0.0.1www.9000music.com
127.0.0.1test.591jx.com
127.0.0.1a.topxxxx.cn
127.0.0.1picon.chinaren.com
127.0.0.1www.5566.net
127.0.0.1p.qqkx.com
127.0.0.1news.netandtv.com
127.0.0.1z.neter888.cn
127.0.0.1b.myblank.cn
127.0.0.1wvw.wokutu.com
127.0.0.1unionch.qyule.com
127.0.0.1www.qyule.com
127.0.0.1it.itjc.cn
127.0.0.1www.linkwww.com
127.0.0.1vod.kaicn.com
127.0.0.1www.tx8688.com
127.0.0.1b.neter888.cn
127.0.0.1promote.huanqiu.com
127.0.0.1www.huanqiu.com
127.0.0.1www.haokanla.com
127.0.0.1play.unionsky.cn
127.0.0.1www.52v.com
127.0.0.1www.gghka.cn
127.0.0.1icon.ajiang.net
127.0.0.1new.ete.cn
127.0.0.1www.stiae.cn
127.0.0.1o.neter888.cn
127.0.0.1comm.jinti.com
127.0.0.1www.google-analytics.com
127.0.0.1hz.mmstat.com
127.0.0.1www.game175.cn
127.0.0.1x.neter888.cn
127.0.0.1z.neter888.cn
127.0.0.1p.etimes888.com
127.0.0.1hx.etimes888.com
127.0.0.1abc.qqkx.com
127.0.0.1dm.popdm.cn
127.0.0.1www.yl9999.com
127.0.0.1www.dajiadoushe.cn
127.0.0.1v.onondown.com.cn
127.0.0.1www.interoo.net
127.0.0.1bally1.bally-bally.net
127.0.0.1www.bao5605509.cn
127.0.0.1www.rty456.cn
127.0.0.1www.werqwer.cn
127.0.0.11.360-1.cn
127.0.0.1user1.23-16.net
127.0.0.1www.guccia.net
127.0.0.1www.interoo.net
127.0.0.1upa.netsool.net
127.0.0.1js.users.51.la
127.0.0.1vip2.51.la
127.0.0.1web.51.la
127.0.0.1qq.gong2008.com
127.0.0.12008tl.copyip.com
127.0.0.1tla.laozihuolaile.cn
127.0.0.1www.tx6868.cn
127.0.0.1p001.tiloaiai.com
127.0.0.1s1.tl8tl.com
127.0.0.1s1.gong2008.com
127.0.0.14b3ce56f9g.3f6e2cc5f0b.com


Rootkit activity

The Trojan installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Trojan substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    taskkill.exe:472
    taskkill.exe:416
    taskkill.exe:1808
    rundll32.exe:468
    sc.exe:436
    cacls.exe:344
    cacls.exe:476

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %System%\drivers\acpiec.sys (12 bytes)
    %System%\CatRoot2 (96 bytes)
    %System%\drivers\etc\hosts (5 bytes)
    %WinDir%\SoftwareDistribution (4 bytes)
    %WinDir%\pchealth\helpctr\System\images (4 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
    %WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
    %WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
    %WinDir%\phpi.dll (22141559 bytes)
    %WinDir%\pchealth\helpctr\System\panels (4 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
    %Documents and Settings%\Default User (540 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
    C:\$Directory (288 bytes)
    %Documents and Settings%\%current user%\My Documents (4 bytes)
    %System%\config (192 bytes)
    %WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
    %WinDir%\Prefetch (1728 bytes)
    %Documents and Settings%\All Users\Application Data (4 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
    C:\autorun.inf (21 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
    %WinDir%\assembly\GAC_32 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
    %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
    %System%\config\systemprofile\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
    %Program Files%\Common Files\VMware\Drivers (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
    %Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
    %Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
    %WinDir%\assembly\GAC_MSIL (36 bytes)
    %Documents and Settings%\NetworkService\Local Settings (4 bytes)
    %WinDir%\WinSxS\Policies (8 bytes)
    %System%\oobe\html (4 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
    %WinDir%\ime (4 bytes)
    C:\1.exe (39 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
    %Documents and Settings%\%current user%\Favorites (4 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp (8 bytes)
    %Program Files%\Movie Maker (4 bytes)
    %WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation (4 bytes)
    %Documents and Settings%\LocalService (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
    %WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
    %System%\drivers\pcidump.sys (5404535 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
    C:\PROGRAM FILES (100 bytes)
    %WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32 (28 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
    %Documents and Settings%\Default User\Local Settings (4 bytes)
    %WinDir%\$hf_mig$ (8 bytes)
    %System%\spool\XPSEP\amd64 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
    %WinDir%\ime\imjp8_1 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
    %Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
    %Program Files%\Microsoft Office\Office14 (4 bytes)
    %WinDir%\Temp (4 bytes)
    %WinDir%\Installer (8 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
    %WinDir%\Prefetch\TSHARK.EXE-2564C650.pf (106 bytes)
    %Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
    %WinDir%\ime\imkr6_1 (4 bytes)
    %WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
    %Documents and Settings%\All Users\Documents\My Music (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
    %WinDir%\Web (4 bytes)
    C:\totalcmd (4 bytes)
    %Program Files%\Common Files\System (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
    %Program Files%\Windows Media Player (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
    %WinDir%\msagent (4 bytes)
    %Program Files%\Movie Maker\Shared (4 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
    %System%\wbem (588 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft (4 bytes)
    %System%\mui (4 bytes)
    %WinDir%\REGISTRATION (4 bytes)
    %System%\spool\XPSEP\i386 (4 bytes)
    %WinDir%\Temp\Perflib_Perfdata_638.dat (4 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
    %System%\config\systemprofile\Start Menu\Programs (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
    %WinDir%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer# (4 bytes)
    %System%\func.dll (17546807 bytes)
    %WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
    %WinDir%\pchealth\helpctr\Config (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (4 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\System.ServiceModel# (4 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\System.DirectorySer# (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
    %WinDir%\security (4 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
    %WinDir%\Installer\$PatchCache$\Managed (4 bytes)
    %Documents and Settings%\All Users\Application Data\Microsoft (4 bytes)
    %WinDir%\Web\printers (4 bytes)
    %System%\config\systemprofile\Local Settings (4 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
    %Program Files%\Internet Explorer (4 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
    %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
    %Documents and Settings%\LocalService\Local Settings (4 bytes)
    %Program Files%\COMMON FILES (4 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
    %Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
    %Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
    %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
    %System%\oobe\html\mouse (4 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
    %Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas# (4 bytes)

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????
Product Version: 4, 3, 1, 1
Legal Copyright: ???? (C) 2009
Legal Trademarks:
Original Filename: notepad.EXE
Internal Name: test
File Version: 1, 0, 0, 1
File Description: Microsoft ???????
Comments:
Language: English (United States)

Company Name: Product Name: ????Product Version: 4, 3, 1, 1Legal Copyright: ???? (C) 2009Legal Trademarks: Original Filename: notepad.EXEInternal Name: testFile Version: 1, 0, 0, 1File Description: Microsoft ???????Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.UPX140961024005120.93464810cb6a5442bb7af6341688f91ba1c0a3
.UPX110649653168379815.49025533bb8dc28a5f721dfe16b25de261017

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 1
2c2d24510c690080a277fc765751c02e

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1016_rwx_00403000_00001000:

GetWindowsDirectoryA

GetWindowsDirectoryA

WinExec

WinExec

\phpi.dll

\phpi.dll

rundll32.exe func.dll, droqp

rundll32.exe func.dll, droqp

\system32\func.dll

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

%original file name%.exe_1016_rwx_00421000_00006000:

kernel32.dll

kernel32.dll

user32.dll

user32.dll

Could not load %s dynamic link library!

Could not load %s dynamic link library!

Could not find X export inside %s dynamic link library!

Could not find X export inside %s dynamic link library!

Could not find ordinal export:X inside %s dynamic link library!

Could not find ordinal export:X inside %s dynamic link library!

Warning: Password you have entered is not vaild!

Warning: Password you have entered is not vaild!

Warning: Application can not run without nessesary .dll files!

Warning: Application can not run without nessesary .dll files!

Could not download nessesary .dll file(s) because:

Could not download nessesary .dll file(s) because:

Since application can not run without nessesary .dll files, program will now close!

Since application can not run without nessesary .dll files, program will now close!

Downloaded .dll file is corrupt and can not be loaded!

Downloaded .dll file is corrupt and can not be loaded!

ntdll.dll

ntdll.dll

18467-41

18467-41

\\.\SICE

\\.\SICE

\\.\SIWVID

\\.\SIWVID

\\.\NTICE

\\.\NTICE

\\.\REGSYS

\\.\REGSYS

\\.\REGVXG

\\.\REGVXG

\\.\FILEVXG

\\.\FILEVXG

\\.\FILEM

\\.\FILEM

\\.\TRW

\\.\TRW

\\.\ICEEXT

\\.\ICEEXT

Windows NT users: Please note that having the WinIce/SoftIce

Windows NT users: Please note that having the WinIce/SoftIce

Windows NT users: Please note that having the FileMon/RegMon

Windows NT users: Please note that having the FileMon/RegMon

urlmon.dll

urlmon.dll

advapi32.dll

advapi32.dll

PWD-X

PWD-X

Password you have entered has been saved!

Password you have entered has been saved!

Do you want to save the password?

Do you want to save the password?

rundll32.exe_468:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

%original file name%.exe_1016_rwx_10000000_00001000:

.data

.data

.rsrc

.rsrc

@.reloc

@.reloc

psapi.dll

psapi.dll

\patch.exe

\patch.exe

\dstdisk.exe

\dstdisk.exe

\defence.exe

\defence.exe

192yuioealdjfiefjsdfas.txt

192yuioealdjfiefjsdfas.txt

%SystemRoot%\System32\DRIVERS\puid.sys

%SystemRoot%\System32\DRIVERS\puid.sys

\drivers\pcidump.sys

\drivers\pcidump.sys

System32\DRIVERS\pcidump.sys

System32\DRIVERS\pcidump.sys

%SystemRoot%\system32\drivers\puid.sys

%SystemRoot%\system32\drivers\puid.sys

\\.\pcidump

\\.\pcidump

\drivers\gm.dls

\drivers\gm.dls

Windows

Windows

1.exe

1.exe

autorun.inf

autorun.inf

Open=1.exe

Open=1.exe

urlmon

urlmon

\setup.exe

\setup.exe

?mac=%s&ver=%s&key=%d&os=windows

?mac=%s&ver=%s&key=%d&os=windows

.html

.html

.hhqg

.hhqg

qq.exe

qq.exe

360safe.exe

360safe.exe

\explorer.exe

\explorer.exe

\temp\explorer.exe

\temp\explorer.exe

infect_exe

infect_exe

%original file name%.exe_1016_rwx_10005000_00001000:

\??\c:\%original file name%.exe

\??\c:\%original file name%.exe

\??\%WinDir%\explorer.exe

\??\%WinDir%\explorer.exe

ers\gm.dls

ers\gm.dls

WinExec

WinExec

CreatePipe

CreatePipe

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

ADVAPI32.dll

ADVAPI32.dll

InternetOpenUrlA

InternetOpenUrlA

WININET.dll

WININET.dll