Win32.Bolik.Gen_17b6efc780

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Efnio.exe:1712

The Trojan injects its code into the following process(es):

wininit.exe:360
%original file name%.exe:1804

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Efnio.exe:1712 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\Ahgymevyisa\USERENV.dll (126 bytes)

The process %original file name%.exe:1804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\kl-setup-2017-03-26-04-00-13.log (1302 bytes)

Registry activity

Dropped PE files

MD5	File path
0facc053baff107027cbd1f48885fd4a	c:\Windows\System32\Ahgymevyisa\Efnio.exe
2b379fcf9e1a20f2e9c8a6347eb159d6	c:\Windows\System32\Ahgymevyisa\USERENV.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   Efnio.exe:1712
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\Windows\System32\Ahgymevyisa\USERENV.dll (126 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\kl-setup-2017-03-26-04-00-13.log (1302 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??????????? ???????????
Product Name: Kaspersky Installer
Product Version: 1.0.7.25
Legal Copyright: (c) ??? "??????????? ???????????", 2012
Legal Trademarks: ?????????????????? ???????? ????? ? ????? ???????????? ???????? ?????????????? ?? ????????????????
Original Filename: Setup
Internal Name:
File Version: 1.0.7.25
File Description: Kaspersky Installer [1.0.7.25]
Comments:
Language: English (United States)

Company Name: ??????????? ???????????Product Name: Kaspersky InstallerProduct Version: 1.0.7.25Legal Copyright: (c) ??? "??????????? ???????????", 2012Legal Trademarks: ?????????????????? ???????? ????? ? ????? ???????????? ???????? ?????????????? ?? ????????????????Original Filename: SetupInternal Name: File Version: 1.0.7.25File Description: Kaspersky Installer [1.0.7.25]Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	249657	249856	4.56053	53f5d7b508a8908170a3dc37871429e7
.rdata	253952	62392	62464	3.24223	ad9483fde5115ef715d81d446add029b
.data	319488	16444	8192	2.74359	984c2099ddbdd615a52e47ff0d860344
.rsrc	339968	766424	766464	5.35534	ae2dee6c58ec927dadb5d00bc5bec49e
.reloc	1110016	12766	12800	4.38833	19906692eb652d6eae2bb20166a09e26

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://91.215.154.155/

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps