Gen:Variant.Mikey.53671 (B) (Emsisoft), Gen:Variant.Mikey.53671 (AdAware), Trojan.Win32.Swrort.3.FD, SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR, PUPSpigot.YR (Lavasoft MAS)Behaviour: Trojan, PUP
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 089453e52b8a5f02c79dc427daf66394
SHA1: ababa71b79440c98db40ea318b298d0bcabbeeb7
SHA256: 8617c3033c9eccadbedc13c5cfba8440aa0fd3c1842314a044625cb0734c5279
SSDeep: 3072:9zvR8lcJ9v/lau/B1nbesQvl2fwiHmbIeY41U:VvR8lcJB/N/fC2fwiH2I6O
Size: 175104 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-10-02 21:40:08
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
C552.tmp.exe:3972
%original file name%.exe:3904
9F3B.tmp.exe:3452
mshta.exe:4052
The Trojan injects its code into the following process(es):
C552.tmp.exe:3900
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process C552.tmp.exe:3900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\common.js (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\search_protect.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_horz.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttFDFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\styles\common.css (101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_icon.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\index.hta (522 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\fr.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_bittorrent.ico (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\index.hta.log (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_horz_ru.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-732923889-1296844034-1208581001-1000\1f91d2d17ea675d4c2c3192e241743f9_88dcd395-b062-45b3-a6cd-79f37c0eba08 (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCComSDK.dll (218 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8I7MPU49.txt (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\firefox.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\es.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\uninstall.hta (575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\it.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\install.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_utorrent.ico (107 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\chrome.png (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\logo.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\shell_install_offer.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCSetupHlp.dll (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\pt.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\install.1478187436.zip (279261 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\es5-shim.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\de.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\internetexplorer.png (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KRJ8QK73.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\screenshot.png (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\ru.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\en.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\initialize.js (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_browser_setup.bmp (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\uninstall.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\bt_icon_48px.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\br.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\styles\installer.css (296 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttFDFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8I7MPU49.txt (0 bytes)
The process %original file name%.exe:3904 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9F3B.tmp.exe (14611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C552.tmp.exe (205076 bytes)
The process 9F3B.tmp.exe:3452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\Admin Cleaner\Admin Cleaner.exe (601 bytes)
The process mshta.exe:4052 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_utorrent.ico (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json[1].js (322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\index.hta.log (154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\featuredcontent[1].htm (21 bytes)
Registry activity
The process C552.tmp.exe:3900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Rpc]
"UuidSequenceNumber" = "134429773"
[HKCU\Software\Classes\FalconBetaAccount]
"remote_access_client_id" = "8873702140"
[HKCU\Software\BitTorrent\uTorrent]
"OfferProvider" = ""
[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\BitTorrent\uTorrent]
"OfferViaCAU" = "0"
"OfferName" = ""
"OfferAccepted" = "0"
The process %original file name%.exe:3904 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"
The process 9F3B.tmp.exe:3452 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\SecureWebChannel]
"channel" = "UN"
[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"
The process mshta.exe:4052 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1299588363"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 38 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "mshta.exe"
[HKLM\SOFTWARE\Microsoft\Tracing\mshta_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Microsoft\Code Store Database\NT5LockDownTest]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
91f2d46151f93599aa519d0d93e0c80d | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\9F3B.tmp.exe |
5fe59fc57869508e1c84812dbd36ce3b | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\C552.tmp.exe |
7a51490de5906042b3f440ae9600fd76 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCComSDK.dll |
428a5d062b8665ff64b8024a487a4604 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCSetupHlp.dll |
91f2d46151f93599aa519d0d93e0c80d | c:\Users\"%CurrentUserName%"\AppData\Roaming\Admin Cleaner\Admin Cleaner.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
C552.tmp.exe:3972
%original file name%.exe:3904
9F3B.tmp.exe:3452
mshta.exe:4052 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\common.js (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\search_protect.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_horz.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttFDFD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\styles\common.css (101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_icon.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\index.hta (522 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\fr.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_bittorrent.ico (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\index.hta.log (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_horz_ru.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-732923889-1296844034-1208581001-1000\1f91d2d17ea675d4c2c3192e241743f9_88dcd395-b062-45b3-a6cd-79f37c0eba08 (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCComSDK.dll (218 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8I7MPU49.txt (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\firefox.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\es.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\uninstall.hta (575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\it.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\install.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\main_utorrent.ico (107 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\chrome.png (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\logo.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\shell_install_offer.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\3rdparty\OCSetupHlp.dll (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\pt.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\install.1478187436.zip (279261 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\es5-shim.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\de.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\internetexplorer.png (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KRJ8QK73.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\mediacaster\screenshot.png (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\ru.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\en.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\initialize.js (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\yandex_browser_setup.bmp (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\scripts\uninstall.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\images\bt_icon_48px.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\i18n\br.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\HYD2DE.tmp.1478187436\HTA\styles\installer.css (296 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\9F3B.tmp.exe (14611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\C552.tmp.exe (205076 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Admin Cleaner\Admin Cleaner.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json[1].js (322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\featuredcontent[1].htm (21 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (Canada)
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (Canada)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 115308 | 115712 | 4.54764 | 23c58d64d3c116cf34cbd00f2d8f1c0c |
.rdata | 122880 | 15226 | 15360 | 3.71605 | 05e17ca9bf31b8416f6517f7fe985d51 |
.data | 139264 | 19468 | 5120 | 2.38158 | 1fa4fc79905bcca5a5bc216063393702 |
.rsrc | 159744 | 1964 | 2048 | 3.39461 | a55f06b1710f745042c6566eeda01ed1 |
.reloc | 163840 | 35712 | 35840 | 1.17261 | 37582812433268d44035b905fdc40ac6 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://download-new.utorrent.com/endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110339694/ | |
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=50 | |
hxxp://ip-api.com/json?callback=jQuery191041635303065350876_1478187448945&_=1478187448946 | |
hxxp://update.utorrent.com/featuredcontent.php?w=6.1 | 67.215.246.203 |
hxxp://download-lb.utorrent.com/endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110339694/ | 67.215.238.66 |
hxxp://i-50.b-000.xyz.bench.utorrent.com/e?i=50 | 50.17.220.153 |
router.utorrent.com | 82.221.103.244 |
s3-us-west-2.amazonaws.com | 54.231.169.64 |
api.wiseinstaller.net | 104.24.113.101 |
router.bittorrent.com | 67.215.246.10 |
api.mediaconfig.net | 104.27.181.218 |
s3.amazonaws.com | 54.231.50.28 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /featuredcontent.php?w=6.1 HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: update.utorrent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Thu, 03 Nov 2016 15:37:30 GMT
Content-Type: text/html
Content-Length: 21
Connection: close
X-Powered-By: PHP/5.4.30
Expires: Thu, 21 Jul 1980 00:00:00 GMT
Cache-Control: private
Last-Modified: Thu, 03 Nov 2016 15:37:30 GMT
{"content_offers":[]}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 234
{"eventName":"hydra1","action":"begin","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"2","v":"110339694","cl":"uTorrent","osv":"6.1","l":"en","pid":"3900","h":"GN-7GzYFp-UDUPDe","sid":"GN-7GzYFp-UDUPDe1478187436","order":"0"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 03 Nov 2016 15:37:12 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 248
{"eventName":"hydra1","action":"packDownloadStarted","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"2","v":"110339694","cl":"uTorrent","osv":"6.1","l":"en","pid":"3900","h":"GN-7GzYFp-UDUPDe","sid":"GN-7GzYFp-UDUPDe1478187436","order":"1"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 03 Nov 2016 15:37:12 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
GET /endpoint/hydra-ut/os/win7/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/6.1/enc-ver/110339694/ HTTP/1.1
Host: download-lb.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 0
HTTP/1.1 200 OK
Server: nginx/1.6.1
Date: Thu, 03 Nov 2016 15:37:12 GMT
Content-Type: application/octet-stream
Content-Length: 2397689
Connection: close
X-bt-sig: 6280eb8890af3f03bce5acbc7887c10c05697ddeee48ef03c41cbf3d4b52b0fadf6fa51d9387dc46e6ee2b55de245bd5829ee53d4aab8724f6e6530f7123858adfbf1a401eee9122e32776588b30687e7254665ace20eb2415cb2b60c5f6276edabebecc5c2ce0d6a30690508383fad15eeccc470a73548a8f34d78b246c8f2593434e5220329fe7541c4525c258a3444979f9b2b6a40fda4f5af7c96b51b93e3226859fb380c86f0ffd5646b0910289250aa34ff4830dad8e3e46f9821d29047aa0f15d38e1008628ca2e1f525a77c5eb63d4425e084f9cc7f26086083a8ea7e8cd3475ce0d8f60a5186ab7608a01ec48127c379f8b17b61156c209fe352c69
Last-Modified: Sat, 18 Jun 2016 05:45:18 0000
Accept-Ranges: none
Content-Disposition: attachment; filename="hta.zip"
X-bt-size: 2397689
Cache-Control: private
X-rl-mx: true
Rule-UUID: d7d79ca9-1978-4573-a82b-a0adc05e3e13
Content-MD5: a941fc2419a987ff4de7c86cbf782c8f
Expires: Tue, 01 Jan 1980 00:00:00 0000
X-bt-hash: c5b7fd00cac128923973150476f3f3549d55ae17
PK.........{.H.d..............index.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>.. <!--[if lte IE 8]>. <script src="scripts/es5-shim.js"></script>. <![endif]-->..</head>..<body class="installer_body">.</body>..<script src="scripts/common.js"></script>..<script src="scripts/install.js"></script>..</html>.PK.........{.Hw[Yy?...?.......uninstall.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>... <!--[if lte IE 8]>. <script language="javascript" type="text/javascript" src='scripts/es5-shim.js'></script>. <![endif]-->..</head>..<body class="installer_body">.</body>..<script src="scripts/common.js"></script>...<script src="scripts/uninstall.js"></script>..</html>.PK.........{.H.....V...V......3rdparty/OCComSDK.dllMZ......................@.................
<<< skipped >>>
GET /json?callback=jQuery191041635303065350876_1478187448945&_=1478187448946 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ip-api.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: text/javascript; charset=utf-8
Date: Thu, 03 Nov 2016 15:37:29 GMT
Content-Length: 322
jQuery191041635303065350876_1478187448945({"as":"AS31561 PITLINE-AS","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.2527,"org":"Pitline Ltd","query":"194.242.96.226","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: text/javascript; charset=utf-8..Date: Thu, 03 Nov 2016 15:37:29 GMT..Content-Length: 322..jQuery191041635303065350876_1478187448945({"as":"AS31561 PITLINE-AS","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline Ltd","lat":49.9808,"lon":36.2527,"org":"Pitline Ltd","query":"194.242.96.226","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 270
{"eventName":"hydra1","action":"INFO","type":"i","res":"1916x902","cts":"1478187445","pv":"","cau":"0","cc":"0","bkt1":"0","ssb":"11","v":"110339694","cl":"uTorrent","osv":"6.1","l":"en","pid":"3900","h":"GN-7GzYFp-UDUPDe","sid":"GN-7GzYFp-UDUPDe1478187436","order":"3"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 03 Nov 2016 15:37:21 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
POST /e?i=50 HTTP/1.1
Host: i-50.b-000.xyz.bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 261
{"eventName":"hydra1","action":"packDownloadResult","type":"i","result":"1","cau":"0","pv":"","cc":"0","bkt1":"0","ssb":"11","v":"110339694","cl":"uTorrent","osv":"6.1","l":"en","pid":"3900","h":"GN-7GzYFp-UDUPDe","sid":"GN-7GzYFp-UDUPDe1478187436","order":"2"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 03 Nov 2016 15:37:21 GMT
Server: nginx
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_3904:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
%s.ef
%s.ef
HKEY
HKEY
%s %s
%s %s
%s %d
%s %d
%s%s%s%s%s
%s%s%s%s%s
%s near end of file
%s near end of file
%s near '%s'
%s near '%s'
unable to decode byte 0x%x
unable to decode byte 0x%x
invalid Unicode '\uX'
invalid Unicode '\uX'
invalid Unicode '\uX\uX'
invalid Unicode '\uX\uX'
control character 0x%x
control character 0x%x
duplicate object key
duplicate object key
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
GetProcessWindowStation
GetProcessWindowStation
operator
operator
ole32.dll
ole32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpConnect
WinHttpConnect
WinHttpOpen
WinHttpOpen
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSendRequest
WinHttpReadData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WINHTTP.dll
WINHTTP.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
zcÃ
zcÃ
status=IS&uuid=412cb525-0eb6-52c2-a08c-3c741f2d855d&user_os=Win7 32&user_hash=&v=35.34&nuuid=cc6e0fb051f29334d991df4f89059307&user_agent=IE&trsrc=1
status=IS&uuid=412cb525-0eb6-52c2-a08c-3c741f2d855d&user_os=Win7 32&user_hash=&v=35.34&nuuid=cc6e0fb051f29334d991df4f89059307&user_agent=IE&trsrc=1
user_agent=IE&uuid=412cb525-0eb6-52c2-a08c-3c741f2d855d&user_os=Win7 32&proc=System,smss.exe,csrss.exe,wininit.exe,csrss.exe,winlogon.exe,services.exe,lsass.exe,lsm.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,spoolsv.exe,svchost.exe,vmtoolsd.exe,TPAutoConnSvc.exe,svchost.exe,taskhost.exe,dwm.exe,explorer.exe,VMwareTray.exe,vmtoolsd.exe,TPAutoConnect.exe,conhost.exe,SearchIndexer.exe,svchost.exe,taskhost.exe,sandbox_svc.exe,conhost.exe,cmd.exe,conhost.exe,tshark.exe,cmd.exe,conhost.exe,Procmon.exe,WmiPrvSE.exe&main=1&v=35.34&nuuid=cc6e0fb051f29334d991df4f89059307&user_hash=&trsrc=1 &aff=trs1&enc=
user_agent=IE&uuid=412cb525-0eb6-52c2-a08c-3c741f2d855d&user_os=Win7 32&proc=System,smss.exe,csrss.exe,wininit.exe,csrss.exe,winlogon.exe,services.exe,lsass.exe,lsm.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,svchost.exe,spoolsv.exe,svchost.exe,vmtoolsd.exe,TPAutoConnSvc.exe,svchost.exe,taskhost.exe,dwm.exe,explorer.exe,VMwareTray.exe,vmtoolsd.exe,TPAutoConnect.exe,conhost.exe,SearchIndexer.exe,svchost.exe,taskhost.exe,sandbox_svc.exe,conhost.exe,cmd.exe,conhost.exe,tshark.exe,cmd.exe,conhost.exe,Procmon.exe,WmiPrvSE.exe&main=1&v=35.34&nuuid=cc6e0fb051f29334d991df4f89059307&user_hash=&trsrc=1 &aff=trs1&enc=
C:\Users\"%CurrentUserName%"\AppData\Local\Temp
C:\Users\"%CurrentUserName%"\AppData\Local\Temp
status=%s&uuid=%s&user_os=%s&user_hash=%s&v=%s&nuuid=%s&user_agent=%s&trsrc=%s
status=%s&uuid=%s&user_os=%s&user_hash=%s&v=%s&nuuid=%s&user_agent=%s&trsrc=%s
kernel32.dll
kernel32.dll
updater_url
updater_url
%s.exe
%s.exe
updater_cmd
updater_cmd
c:\%original file name%.exe
c:\%original file name%.exe
?!?%?)?4?:?
?!?%?)?4?:?
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
KERNEL32.DLL
KERNEL32.DLL
WUSER32.DLL
WUSER32.DLL
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
user_agent=IE&uuid=%hs&user_os=%hs&proc=%s&main=%hs&v=%hs&nuuid=%hs&user_hash=%hs&trsrc=%hs&aff=%hs&enc=%hs
user_agent=IE&uuid=%hs&user_os=%hs&proc=%s&main=%hs&v=%hs&nuuid=%hs&user_hash=%hs&trsrc=%hs&aff=%hs&enc=%hs
https
https
hXXps://s3-us-west-2.amazonaws.com/151125/helloworld.exe
hXXps://s3-us-west-2.amazonaws.com/151125/helloworld.exe
api.wiseinstaller.net
api.wiseinstaller.net
6.8.6.1
6.8.6.1
amet.jpg
amet.jpg
mshta.exe_4052:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
_amsg_exit
_amsg_exit
_acmdln
_acmdln
mshta.pdb
mshta.pdb
name="Microsoft.Windows.InetCore.mshta"
name="Microsoft.Windows.InetCore.mshta"
version="5.1.0.0"
version="5.1.0.0"
Kernel32.dll
Kernel32.dll
2kernel32.dll
2kernel32.dll
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
MSHTA.EXE
MSHTA.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421