SearchProtectToolbar_pcap_f3e090350f – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1380

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:1380 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\http.lua (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\__web.xml (10968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaXml_lib.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\mime.lua (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\common.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\decline.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\back.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\socket\core.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\accept.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\cancel.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\jquery.js (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\ftp.lua (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaBridge.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\url.lua (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\close.png (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\version.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\NotifyIcon.lua (302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\lua51.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\FloatingProgress.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\UACInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\progressPause.gif (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Env.lua (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\BundleInstall.lua (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\definitions.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\extension.tlb (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\common.js (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\luacom.dll (10136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\utils.lua (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\un.package.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\UiState.lua (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\smtp.lua (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Events.lua (912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ProcessFreeFile.lua (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\BrowserControl.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Sandbox.lua (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\DownloadThread.lua (581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\mime\core.dll (1856 bytes)
%Documents and Settings%\%current user%\My Documents\My Videos\Desktop.ini (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\knockout.js (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\GuiInit.lua (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\__localxml.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Downloads.lua (9 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Administrative Tools\desktop.ini (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\json.lua (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaXml.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\DownloadList.lua (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\tp.lua (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\IntegratedOffer.lua (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\progress.gif (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\skin.jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\ltn12.lua (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\CallbackProxy.lua (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\AdvancedTests.lua (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (33139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\next.png (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1380 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 00 95 BC 69 73 CA 3F 6B F3 F9 6A AA A7 7E 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Dropped PE files

MD5	File path
1dcfa038b79b3df456a3c584d96b639c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\FloatingProgress.dll
1351244af9ca179c9081eda09662e904	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\LuaBridge.dll
4a4845ba1666907f708c9c10a31ec227	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\LuaSocket\mime\core.dll
4bf7db111acfa7c28ad36606107b3322	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\LuaSocket\socket\core.dll
7292b642bd958aeb7fd7cfd19e45b068	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\LuaXml_lib.dll
7e3c808299aa2c405dffa864471ddb7f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\System.dll
d02a497be5f89c44827f142c4662f591	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\UACInfo.dll
13c3a33c1f6e43f38de533fd0b766c98	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\lua51.dll
ed7f7857933b38e5d10daf828e79af19	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\luacom.dll
5694e7daf20c47c8d5e73d4a838c2ee6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\un.package.exe
ebc5bb904cdac1c67ada3fa733229966	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsg3.tmp\version.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\http.lua (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\__web.xml (10968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaXml_lib.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\mime.lua (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\common.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\decline.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\back.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\socket\core.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\accept.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\cancel.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\jquery.js (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\ftp.lua (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaBridge.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\url.lua (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\close.png (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\version.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\NotifyIcon.lua (302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\lua51.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\FloatingProgress.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\UACInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\progressPause.gif (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Env.lua (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\BundleInstall.lua (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\definitions.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\extension.tlb (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\common.js (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\luacom.dll (10136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\utils.lua (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\un.package.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\UiState.lua (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\smtp.lua (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Events.lua (912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\ProcessFreeFile.lua (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\BrowserControl.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Sandbox.lua (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\DownloadThread.lua (581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\mime\core.dll (1856 bytes)
%Documents and Settings%\%current user%\My Documents\My Videos\Desktop.ini (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\res\knockout.js (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\GuiInit.lua (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\__localxml.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\Downloads.lua (9 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Administrative Tools\desktop.ini (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\json.lua (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaXml.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\DownloadList.lua (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket\tp.lua (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\IntegratedOffer.lua (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\progress.gif (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\skin.jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\ltn12.lua (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\LuaSocket\lua\socket.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\CallbackProxy.lua (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\AdvancedTests.lua (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (33139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\bullet\next.png (3 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23294	23552	4.47651	ad2ebf079e89cd95e3fda4bd0b869620
.rdata	28672	5272	5632	3.56156	45097a769b809e006a7e5c1f08e7cba2
.data	36864	109756	512	0.972488	4b5dfd97899e385b2193064eb045da6b
.ndata	147456	176128	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	323584	191848	192000	2.99234	24de0349c4b4c3db8bc05d6181371a77
.reloc	516096	2680	3072	0	d2a70550489de356a2cd6bfc40711204

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3149
6d3bbc565043d7929cd81a783602d884
121e3443904b8abf088d2f37dc2f3719
e992badadde4d9816291c17c0d4e0beb
b5553982c3390ce955f09aaed6ba0c38
0d123bc72d4fdeeb0e14376b09cdf0ba
df6146735ef60cea1609ea2e78cc94ad
0a3ae0930c9ecdc8efb97bd7a900aab2
ca6786fc57b18a37275494d9629110d2
9cf3fd03c0fdc2717972896115d2353d
eda01d6a05020287c5ab4ad05b2f2312
08270b2b8b911464ab3d1b6e3640532b
a83e2273a653eacf57054512f14b969d
40d294a8b6da1d805926476117558df6
bc406a3c6a79646978d95faf0d93336e
85ea2261afe931cfea2b0077d186204b
1c20b4b8882ad6a3fb5c5ab78b9825cc
2adb87a3c426d354719c9ed68a4d9077
a014cb7435bb24b95b4d5f048414cadf
9165faefd44a675f5c1849066d09331f
d6dbaef55a6a622e3bcdbb4b760df683
5e9f09920d70e7071ab951addc5940ba
90f04d8a51a0a3cdaff2a1f01d170cea
f30fc68ea9b4207c57c40d1965c5d702
2b93d36a95572e6965417e69e2464aa2
4187459c7ebd96538cb8b3138de6f16e

Network Activity

URLs

URL	IP
hxxp://service.downloadadmin.com/install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US	50.22.63.140
hxxp://service.downloadadmin.com/env?productKey=&s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=UA	50.22.63.140

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /env?productKey=&s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=UA HTTP/1.1

connection: close, TE

x-exename: %original file name%.exe

x-webinstallurl: hXXp://service.downloadadmin.com/install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US

user-agent: Tightrope Bundle Manager(ref=[96c8658e7f7668f62e0bd317273129bbf93be52b];windows=5.1;uac=false;elevated=true;dotnet=4;startTime=1188421)

x-webinstallcode: complete url:hXXp://service.downloadadmin.com/install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US

te: trailers

host: service.downloadadmin.com

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Expires: 0

Content-Type: text/xml;charset=UTF-8

Transfer-Encoding: chunked

Date: Sun, 17 Apr 2016 10:35:19 GMT

Age: 0

Connection: close

X-Cache: MISS

001820..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Installer><Environment><Entry name="over-threshold:Taplika (GB)">true</Entry><Entry name="over-threshold:Yahoo Smartbar (UK)">true</Entry><Entry name="over-threshold:SearchProtect (GB) (Conduit Direct)">true</Entry><Entry name="over-threshold:SearchProtect (CA) (Conduit Direct)">true</Entry><Entry name="over-threshold:Snapdo (CA)">true</Entry><Entry name="over-threshold:Taplika (FR)">true</Entry><Entry name="over-threshold:Yahoo Smartbar (FR)">true</Entry><Entry name="over-threshold:CrimeWatch (GB)">true</Entry><Entry name="over-threshold:BubbleDock (GB)">true</Entry><Entry name="over-threshold:VuuPC (ClickMeIn) (GB)">true</Entry><Entry name="over-threshold:Wordproser (GB)">true</Entry><Entry name="over-threshold:PicRec UK">true</Entry><Entry name="over-threshold:DesktopDock (GB) (Verti)">true</Entry><Entry name="over-threshold:Optimizer Pro (UK)">true</Entry><Entry name="over-threshold:SystemOptimizerPro (GB)">true</Entry><Entry name="over-threshold:Fixila (GB)">true</Entry><Entry name="over-threshold:Registry Helper (SafeApp Software) (INTL)">true</Entry><Entry name="over-threshold:PCFixSpeed (GB)">true</Entry><Entry name="over-threshold:PremierOpinion (UK)">true</Entry><Entry name="over-threshold:Desk

<<< skipped >>>

GET /install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US HTTP/1.1

connection: close, TE

x-exename: %original file name%.exe

x-webinstallurl: hXXp://service.downloadadmin.com/install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US

user-agent: Tightrope Bundle Manager(ref=[96c8658e7f7668f62e0bd317273129bbf93be52b];windows=5.1;uac=false;elevated=true;dotnet=4;startTime=1188421)

x-webinstallcode: complete url:hXXp://service.downloadadmin.com/install?s=arkglu0g15gbtpbpjdve9avqb6&c=ch&brand=mytopfreegames.com&pid=Kitara&aid=2685&bc=616473&country=US

te: trailers

host: service.downloadadmin.com

HTTP/1.1 200 OK

Content-Type: text/xml;charset=UTF-8

Transfer-Encoding: chunked

Date: Sun, 17 Apr 2016 10:35:13 GMT

Age: 0

Connection: close

X-TVAR:

X-Cache: MISS

008000..<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<Installer>. <Bundle>. <LinkBelowEula>false</LinkBelowEula>. <OptInDefault>false</OptInDefault>. <ProductBinary embed="false" msioptions="" options="/S">hXXp://download.mytopfreegames.net/da/latest</ProductBinary>. <ProductEula comboPrimary="false" embed="false">http://mirror.downloadnet1210.com/products/BM2/628/kitara/mtfg/mtfg_628.mht</ProductEula>. <Primary>true</Primary>. <ProductId>463831</ProductId>. <ProductName>MyTopFreeGames</ProductName>. <Scramble>false</Scramble>. </Bundle>. <Bundle>. <Category>search, home</Category>. <CustomParameter Name="advertisername">SearchProtect</CustomParameter>. <If>. <Or>. <Env property="custom.region" op="=" value="US"/>. <Env property="custom.region" op="=" value="us"/>. </Or>. </If>. <Feature InitialState="checked" Name="TreasureAds" Options="-carrier_type=ctid -carrier_id=CT3328455 -platform=all -startpage=true -defaultsearch=true -locale=en-us -detection">. <If>. <Env property="custom.partner" op="=" value="treasureads"/>. </If>. </Feature>. <Feature InitialState="checked" Name="Not Treasu

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1380:

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

uDSSh

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

.DEFAULT\Control Panel\International

RegDeleteKeyExA

Software\Microsoft\Windows\CurrentVersion

*?|/":

%s=%s

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegDeleteKeyA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\LuaBridge.dll

ss.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\LuaBridge.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp

ns\UrlAssociations\http\UserChoice

:hHÃŒ

].uA;

..jjK

b0.zE

`'\%D,3

WININET.dll

GetProcessHeap

EnumChildWindows

OLEAUT32.dll

customnsWeb.dll

C:\Programming\GitHome\bm-core.git\25\Custom\Nsweb\Release\nsWeb.pdb

CustomNsWebForwarder

1 1$1(1,10141

All Files|*.*

COMDLG32.dll

nsDialogs.dll

.reloc

ButtonEvent.dll

C:\Nsis\Browser-%s

nswebForwarder

CustomNsWebContainer

Z:\Programming\GitHome\master\Employers\Franco\TightRope-BundleManager\Custom\Scramble\Release\Scramble.pdb

#-,.mT:

!$"'(!((!$&

##-,#1.#0- !%

! .76:76:*),

#" *#1.#1.!#&

nsg3.tmp

-exec

Games]],0x00040000) -- C:/BM/2.5/BINARIES/Bullet/Icy-AD/production/setup.exe.nsi:Line 1083.2

ction/setup.exe.nsi:Line 974.2

ction/setup.exe.nsi:Line 915.2

Tightrope Bundle Manager(ref=[96c8658e7f7668f62e0bd317273129bbf93be52b];windows=5.1;uac=false;elevated=true;dotnet=4;startTime=1188421)

1179892

1769724

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp\bullet

1187593

5334543

8664755

8760876

Nullsoft Install System vtightrope

com.build.date

2/28/2013

com.build.dir

C:\BM\2.5-Static\WebTemplates

com.build.id

com.build.machine

com.build.time

com.build.user

$%USER%

%original file name%.exe_1380_rwx_10004000_00001000:

callback%d

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps