GenPack.Generic.Malware.Sdld.0B0DA6E6_065cc7fd4e – Adaware

Dynamic Analysis

Payload

Behaviour	Description
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The GenPack creates the following process(es):No processes have been created.The GenPack injects its code into the following process(es):

%original file name%.exe:2956

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2956 makes changes in the file system.

The GenPack creates and/or writes to the following file(s):

C:\Windows\win32dc\Quake3 serial.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (673 bytes)
C:\Windows\win32dc\UT2004 fix.exe (17935 bytes)
C:\Windows\win32dc\Doom 3(cdfix).exe (673 bytes)
C:\Windows\win32dc\Counter-Strike trainer.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut hack.exe (6639 bytes)
C:\Windows\win32dc\FlatOut_codes.exe (6639 bytes)
C:\Windows\win32dc\Counter-Strike patch.exe (10879 bytes)
C:\Windows\win32dc\Doom 3(patch).exe (14311 bytes)

Registry activity

Dropped PE files

MD5	File path
ec9b2e4277840d4b786ee1931c239088	c:\Windows\win32dc\Counter-Strike patch.exe
87237d11fcf45a3871173ef136b0342a	c:\Windows\win32dc\Doom 3(patch).exe
56a608294f9204ab5f92fb5439228c2a	c:\Windows\win32dc\FlatOut hack.exe
b55145e51f797d9f997f6dee19594a33	c:\Windows\win32dc\FlatOut_codes.exe
1c08a0f21dd5a0d1a36272399140e281	c:\Windows\win32dc\Half-Life 2 cheat.exe
6e0d02b3998e6d336032b9833e192ee9	c:\Windows\win32dc\UT2004 fix.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original GenPack file.
Delete or disinfect the following files created/modified by the GenPack:
C:\Windows\win32dc\Quake3 serial.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (673 bytes)
C:\Windows\win32dc\UT2004 fix.exe (17935 bytes)
C:\Windows\win32dc\Doom 3(cdfix).exe (673 bytes)
C:\Windows\win32dc\Counter-Strike trainer.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut hack.exe (6639 bytes)
C:\Windows\win32dc\FlatOut_codes.exe (6639 bytes)
C:\Windows\win32dc\Counter-Strike patch.exe (10879 bytes)
C:\Windows\win32dc\Doom 3(patch).exe (14311 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	57344	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	61440	77824	76288	5.52197	d6258383e557ea7abf33e63e245c5c97
.rsrc	139264	4096	2048	2.63797	b5916a1f63e299e8c8a487a2ccfe581b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 78
0e8cc3029d3acf2b7758eb0168804d9e
14477edda0cae19be69cf5006eb941b3
f9990007d6590bd13269080bb6c21ca1
efce4f8851962bafee5777844e5b1e92
ef8efd31a93b37726b6548cc32d15c8b
ea2f5c3f421b7f54e6e90c6e0be9c4bb
d1fceadc2ec13c77c64691677b455fcc
6bc2c3f22d75f318cce1fbf50a362a9f
5bb7eb12e7f44dbe3727e6b9b5858ebb
027836c1dff19350fd4534c661cb6372
ef4f4829f04358e403d3c7d7c555f03b
e953f4d6eff1ff48f58b73fb1a8cd75a
e17c6e18bad60f0c0d0f9371a130bec8
c74b71dfa83b878c345d2dd13cb9f84e
8ebf91afaa3f36629e3bc1bc31db9c3d
8a95b5bd4327b0338b95a544dafaa533
794ec7feff497f63da9ea049bc4141e0
36b761531cc64940dd5859c9eb10125d
30525465afeecf6da2833625e2554e8c
29d725c5009d591759099020aeab702e
1c5dc4296f3c4f7fbcc09f098bf3efc6
fe81d1e58fe7052a28fce71e0b5c2ce5
ee57e38250b8429c9841000c00fc122c
94ab19937152a6126a257c02a248fce2
8a7cb6d0600d54911896cb1b5c031292
70ee15b2f5b973043d8a5d63dc51275a

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The GenPack connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2956:

`.rsrc

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

)( *-,/.!

&pWebServ

O^nKey

URLg

KERNEL32.DLL

advapi32.dll

mpr.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

wsock32.dll

%original file name%.exe_2956_rwx_00401000_00014000:

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

)( *-,/.!

&pWebServ

O^nKey

URLg

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps