GenPack.Generic.Malware.Sdld.818C51EF_c6afc31411 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The GenPack creates the following process(es):No processes have been created.The GenPack injects its code into the following process(es):

%original file name%.exe:1672

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1672 makes changes in the file system.

The GenPack creates and/or writes to the following file(s):

C:\Windows\win32dc\Silent Hill 4 patch.exe (10879 bytes)
C:\Windows\win32dc\Counter-Strike serial.exe (17935 bytes)
C:\Windows\win32dc\Quake3_cdfix.exe (673 bytes)
C:\Windows\win32dc\FlatOut(fix).exe (17935 bytes)
C:\Windows\win32dc\Counter-Strike(cdfix).exe (2533 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (10879 bytes)
C:\Windows\win32dc\DAoC_crack.exe (673 bytes)
C:\Windows\win32dc\Quake3 crack.exe (14311 bytes)
C:\Windows\win32dc\Doom 3_cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut crack.exe (6639 bytes)

Registry activity

Dropped PE files

MD5	File path
85d98e43b2577455f43c30d5c28dd869	c:\Windows\win32dc\Counter-Strike serial.exe
1450e0787aa8f86bd378ed4086da3896	c:\Windows\win32dc\Counter-Strike(cdfix).exe
f2aa680eb7f4951cc0627a02f9adb692	c:\Windows\win32dc\Doom 3_cheat.exe
537f16f9667663dcc2074d3c47f6f047	c:\Windows\win32dc\FlatOut crack.exe
b664ff2c08b7561dc40cb53c3078546e	c:\Windows\win32dc\FlatOut(fix).exe
38f0275a3fb09468bac7385455c9192a	c:\Windows\win32dc\Half-Life 2 codes.exe
5506331e924bf3d788afc67a27150f27	c:\Windows\win32dc\Quake3 crack.exe
075bbd4e9059fc365eab8c60788fae18	c:\Windows\win32dc\Silent Hill 4 patch.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original GenPack file.
Delete or disinfect the following files created/modified by the GenPack:
C:\Windows\win32dc\Silent Hill 4 patch.exe (10879 bytes)
C:\Windows\win32dc\Counter-Strike serial.exe (17935 bytes)
C:\Windows\win32dc\Quake3_cdfix.exe (673 bytes)
C:\Windows\win32dc\FlatOut(fix).exe (17935 bytes)
C:\Windows\win32dc\Counter-Strike(cdfix).exe (2533 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (10879 bytes)
C:\Windows\win32dc\DAoC_crack.exe (673 bytes)
C:\Windows\win32dc\Quake3 crack.exe (14311 bytes)
C:\Windows\win32dc\Doom 3_cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut crack.exe (6639 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	57344	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	61440	77824	76288	5.52171	a326ad8cdebbed6b2a7163a111d9bd1b
.rsrc	139264	4096	2048	2.63797	b5916a1f63e299e8c8a487a2ccfe581b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 77
0e8cc3029d3acf2b7758eb0168804d9e
f9990007d6590bd13269080bb6c21ca1
efce4f8851962bafee5777844e5b1e92
ef8efd31a93b37726b6548cc32d15c8b
ea2f5c3f421b7f54e6e90c6e0be9c4bb
d1fceadc2ec13c77c64691677b455fcc
6bc2c3f22d75f318cce1fbf50a362a9f
5bb7eb12e7f44dbe3727e6b9b5858ebb
027836c1dff19350fd4534c661cb6372
ef4f4829f04358e403d3c7d7c555f03b
e953f4d6eff1ff48f58b73fb1a8cd75a
e17c6e18bad60f0c0d0f9371a130bec8
c74b71dfa83b878c345d2dd13cb9f84e
8ebf91afaa3f36629e3bc1bc31db9c3d
8a95b5bd4327b0338b95a544dafaa533
794ec7feff497f63da9ea049bc4141e0
36b761531cc64940dd5859c9eb10125d
30525465afeecf6da2833625e2554e8c
29d725c5009d591759099020aeab702e
1c5dc4296f3c4f7fbcc09f098bf3efc6
fe81d1e58fe7052a28fce71e0b5c2ce5
ee57e38250b8429c9841000c00fc122c
94ab19937152a6126a257c02a248fce2
8a7cb6d0600d54911896cb1b5c031292
70ee15b2f5b973043d8a5d63dc51275a
6e43b10d7acf40e331e91eac679197cd

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The GenPack connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1672:

`.rsrc

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

&pWebServ

O^nKey

URL!wn}

:"58=05^

.xmsJz)

5670123

=>?89:;$%&

URLbUPbaZVK

KERNEL32.DLL

advapi32.dll

mpr.dll

oleaut32.dll

shell32.dll

URLMON.DLL

user32.dll

wininet.dll

wsock32.dll

%original file name%.exe_1672_rwx_00401000_00014000:

PRIVMSG

JOIN

login

PRIVMSG

:Fisier Executat

(Director Windows:

(netbios_invalidpass:

File(%cur%\

File(%sys%\

rndnick

NICK

join

%sys%\

%cur%\

%rnddir%\%rand%.exe

system.ini

explorer.exe

.com "win2k" :

DCPlusPlus.xml

dcplusplus.xml

%sys%

%cur%

\WINDOWS\Start Menu\Programs\Startup\

netapi32.dll

%rnddir%\%rand%.com

us.undernet.org

KWindows

&pWebServer

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

&pWebServ

O^nKey

URL!wn}

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps