Worm.Win32.Ainslot_VariantOfZeus_17e40d5d19 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

schtasks.exe:2012
rundll32.exe:1548
rundll32.exe:816
dumprep.exe:1980
dumprep.exe:596
%original file name%.exe:320

The Worm injects its code into the following process(es):

svchost.exe:1924

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rundll32.exe:816 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\rundll32.exe (1813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (1 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (0 bytes)

The process dumprep.exe:1980 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.mdmp (93289 bytes)

The process dumprep.exe:596 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.hdmp (191785 bytes)

The process %original file name%.exe:320 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\rundll32.exe (10448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\TOTALC~1.EXE (70216 bytes)

Registry activity

The process schtasks.exe:2012 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 72 16 B7 60 D3 82 2A 20 0B 4F BB 68 C2 F7 65"

The process rundll32.exe:1548 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 C6 92 EE A2 91 8D 76 88 F7 48 11 EA D4 A8 E4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"svchost.exe" = "Generic Host Process for Win32 Services"

[HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility]
"AppCompatCache" = "EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\%System%]
"svchost.exe" = "EnableNXShowUI"

The process rundll32.exe:816 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 B5 25 DA D4 FA 04 4F 8C AB 0E D1 5C EA 3D 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"schtasks.exe" = "Schedule Tasks"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process dumprep.exe:1980 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 57 B2 CF C9 93 5D A6 D3 B5 94 62 C1 26 F5 DE"

The process dumprep.exe:596 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 B3 13 20 1F 9E 4F 54 F0 A5 C2 1E E1 FC 5E 23"

The process %original file name%.exe:320 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 86 6F 8B 3B 42 2C 42 E3 0A 99 88 94 10 3D D0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Dropped PE files

MD5	File path
a3044d63d20fefb3e728823b69585b77	c:\Documents and Settings\"%CurrentUserName%"\Application Data\rundll32.exe
27c6d03bcdb8cfeb96b716f3d8be3e18	c:\Documents and Settings\"%CurrentUserName%"\Application Data\svchost.exe
b439967c0c3a35ca2cdbc39783f09fd9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\TOTALC~1.EXE
a3044d63d20fefb3e728823b69585b77	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\rundll32.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
schtasks.exe:2012
rundll32.exe:1548
rundll32.exe:816
dumprep.exe:1980
dumprep.exe:596
%original file name%.exe:320
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\rundll32.exe (1813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.mdmp (93289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.hdmp (191785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\rundll32.exe (10448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\TOTALC~1.EXE (70216 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.17416
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE
Internal Name: Wextract
File Version: 11.00.9600.17416 (winblue_r4.141030-1500)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.17416Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE Internal Name: Wextract File Version: 11.00.9600.17416 (winblue_r4.141030-1500)File Description: Win32 Cabinet Self-Extractor Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26980	27136	4.40175	22c7cbc7745692002dbdf65a4bc48e63
.data	32768	6796	1024	2.20139	317f8a934ee443eee01c2a315bde9ca1
.idata	40960	4220	4608	3.49841	a5d9b0c8d0d0e35bcbb5219dda1a3075
.rsrc	49152	4746367	4746752	5.5438	2ce3d2e7070b3f48005928f13a3ff570
.reloc	4796416	2240	2560	4.41763	7772c8e6ff71410862c324630aac5515

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_320:

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

SSSh

PSSShp

PSShp

t.ShB

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

SHELL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

%C DF

rundll32.exe

TOTALC~1.EXE

tcRt

.evH^

.wlkJ

&Y-o}

%sUP5

?_Gg@W.(>D)L8GSLeSh.MF

d@WI`%x

.GmY3

s.ZX^

T.roy

OY.TKc

.bW&r

*2m%C

[.ED'wG

w.IC^

%FXPD

#N-Y}

|.ta&`

V..hM

Aa.Fj

| \.nb00&

H.WP}j

f-t}o

%S.D!

\.BGM

kÃ˜-

;.jHF

nudP

6T.Jx*

]>n%xiQ

l.vR,i

Z%f[r

5].VU

.WfG

%,.ky

:1.fIR

H.JGo

I.uvS

!eQ.MlM

.Vpr2

%y"C_.fS

D.iNR

nm)%.s

lP@.Lgi

,&z%d

!.Hjn>

s_.MN

eT.gt

Hz.GN

t%7UoJ

.rg}2

lT.NpB

7l.bO`

(.jBU

%S;f%b

,k.Ib

wÃ1T

9nb$%s

qUF %x;

-^/.pXG]v

PEXe

*IEJY%c

.ZLu,

i/g%S

7~Q%c

x.Ks)

wk.yU

%U~}uv

3.SWc

6Y%fR6

npY.yL

;%UB`

x%f_l

R%x('

.AolK!

j~m.sQ."L9

%x!zG,

a!]%x

lK.Ql

.Bb/L

^.oI1[

KeYip

".SjL3j

?XS%0U

ML.LQ

.Bq-)3

.lvMG

.MEdv

":.Yb:HU

u9.fu

MsG4jUH\

<.lc>

.xZ7@

BDpL%D{

N%u&i

6.Fy2

o%U8L

X.Lnt

?.OvP

o%x`%

*'%Xws

ie)%C

BuR%X

] %DhmD

NM?.Tn

El0%U

T.jLz

K.xZ|

%U|>~

lQ.MR_

.Wj*@

w.vRK

Q.hPSr

r8E%X;Dv

E.oac

p9L8%c

}.Crk

?%?.wI

br%U6$

pOÃ‡z0

3:.bL

:>}-u}

_k.DIIr

]K.CV

.Ekf4

`0.WU

Ãœ-D

.IZwn

2kI.Skxy`qk

o:\O^p

%XOV&_v

7=u

'.TC7

X .El

.PBkC

IpUE%f

y14?.rN

C|Y.LA

9.mP(

%Xn\

DsQl

g.TjL

.RINJ

WTN.bZ

.tZV17

.OMd6

5%CyM?h

(.GGqMs{E

m.MD;

.RF.)xV

h".ONM

vIvl

.bblW

%f`RP[}

}3.nA{

J].lN

DG zK.PT

c>.adB

/[Ã½

.TlW^_

@%.Xb

msgy

~vZ%s

rT.Kz

2z.KVq

#H-Xi}V

.wXAm

.QkR(

)l%Xz

w.vVi

:I).MGs

-f%FU

AGL{lP.gE

o?%.eS]

GN97Ftp

fL0.Xn

}i6h%u

my.iX

.JrpuF

.Tz5@

%uWl 0

l%d_U

{M.FH=

(-[,_[<.>

j3Ã¾

.lP.U

n:\,

%sIE2

c.xko

rA?.sZ

7.Upe4

]Hj@B.iX

8.ok!.

Sb.TvE

|6m%S

.gB,[

9J%XR

{Zbh.Fvt'

$.nJ3

xL.EfY

S5.OleL

CS.yye

PÃZ

ayÃ¶

Frq;

b

gv.EmY

ÃŠ$_9;

H^{x%%C|?

;U%dw

}4w

.aIHy

5P}%c&XjO

".DlV

.zqAw&

s%dPU

-n}rP

.vDo@!H=gOD

HPS%S

d\V.Cm

j %c'

^kb.Kn

0ÃœPn

cG.mM

.fBY;

T

]"QF.bt5

c0|'#~%d.

W.lw^

%u3.&

B.AL/

.DRO3

F%dQSL

c.SW@DNN

p?8jG

.wQ'Fw

.ZW*e

|=|=|=|=

,`.twGo

0eo!.tqY

.xbcCI

s.tuXs

%uTQ[$

H.yEd

/-km}

H[6%s

%}L

.odC?7H3

.lUbSn

.Jh ?G2

{x.Xd

ZGt%S>

.tvYD

.cK~v

J_al.CAcT

.eFlv

.Rdqe

[%DM6

b\.Ew

a.lah3

%xN{`n

)%s:IR

!\'.yc&

6v%8s

0\.vcD

?8 .ci

oQ-%DW

5B.FAw-

=.pMZ

Z.ZA?

%u)r@

.he#r

P2`.Jj/

amSG

b}z%c

.tYEb

w%SiY

8&.wC

Yg.cj

%U)nv

.DdC|

.As^{

[%ut?:h

e%U,1

m.uqVw

-;.uz~T$

,F%dM

z#=%d

.nc#>ns

R5fq).BSVO

sr

*!.zJm

z-Q} o

-z.DR

!/!/!/!/

yeX%C

Ph.EtM

cl.AJU

a.BL[d0

8%.bZ

.Zxn[

m.MVM#

q\.Pt

Xr.Qi

pÃ’

.g G%X

[.Meo"

pcRtU

A.JN%

0[0{0{0{0{!

?fX T.Uv

Ã—.

*M`s%c

.kcHP

*%c`f

.DuP]

Ã¿{g

,.pw54

.dO|Y

.NKC3

L{

_n%Xn

/0.Or

.jc[B

&.bjr

53.DB

Ck)|

"O%F@w

b.TsQr

'x.sP1

1%s",

IMp

.syhGw

-w}!:qJ

ti.Jru

Y.YXF,T

.RT]

.PJSI Ox

]%so3

QÃ•>A

c6%UO

Fz}%d

|T.cjjk

N.Swu

tJ

;u.XV

%sjuG

VÃ¾\3

..tU5

|:~$=~~>

6.Bd@

|Ã¶S

M%du^

r%U6e

vD.xY0

G%uTe

3/.jD

;f.Rb

FÃ›&_

INSTALL.INF[Installation]

name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
9 9$9Kernel32.dll
l: %s.
zenet: %s.&Egy sz
ll %s KB szabad ter
nak kell lennie.JAdjon meg egy mapp
k be.BA tall
ges Shell32.dll nem t
n: . Oka: %s/A rendszer szektorcsoportm
lt.cA telep
shez a Windows 95 vagy a Windows NT 4.0 2-es vagy magasabb sz
pett fel a(z) %s bet
sekor.bA GetProcAddress() sikertelen a(z) '%s' f
nytelen advpack.dll verzi
shez Windows 95 vagy Windows NT 4.0 sz
tre: '%s'.
hez %s KB szabad ter
g a(z) %s: meghajt
&Hiba a Windows mappa lek
s: ExitWindowsEx hiba
jl.hA telep
t: %s.
zenet: %s.tA Telep
lt %s KB szabad ter
jra.OA telep
KA(z) '%s' csomag m
: %s.
tezik: '%s'. L
trehozza?cA(z) '%s' csomag m
.=A(z) '%s' csomag nem kompatibilis a Windows ezen verzi
val.RA(z) '%s' csomag nem kompatibilis a(z) %s f
11.00.9600.17416 (winblue_r4.141030-1500)
WEXTRACT.EXE
11.00.9600.17416
11.00.9600.16384 (winblue_rtm.130821-1623)
WEXTRACT.EXE .MUI
11.00.9600.16384
svchost.exe_1924:.text
`.data
.rsrc
MSVBVM60.DLL
bss_server.usrReverseRelay
bss_server.usrRelay
tmrWebHide
bss_server.Socket
mswinsck.ocx
MSWinsockLib.Winsock
modLaunchWeb
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\SysWOW64\ieframe.dll
winmm.dll
user32.dll
advapi32.dll
shell32.dll
kernel32.dll
avicap32.dll
advpack.dll
GetAsyncKeyState
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
SHFileOperationA
CreatePipe
PSAPI.DLL
GetTcpTable
ExitWindowsEx
EnumWindows
WinInet.dll
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
ShellExecuteA
keybd_event
CHAT_ADDMSG
cmdShowfiles
UDPSocket
G%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca
tmrTCP
tmrUDP
UDPFlood
VBA6.DLL
C:\Windows\SysWow64\msvbvm60.dll\3
ws2_32.dll
AddMsg
GdiplusShutdown
RemotePort
LocalPort
WSOCK32.DLL
RegCloseKey
RegOpenKeyExA
FtpUpload
ntdll.dll
ole32.dll
crypt32.dll
oleaut32.dll
RegOpenKeyA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
gdi32.dll
olepro32.dll
InternetOpenUrlA
FtpDownload
FtpGetFileA
FtpPutFileA
FtpSetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpOpenFileA
FtpGetFileSize
FtpDeleteFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpRenameFileA
FtpGetDirectory
Http_DownloadFile
msvbvm60.dll
?8??8??8??8??8?
uMsg
strMsg
MsgNum
AllMsgs
lngPort
Port
Password
WebURL
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Occurs after a send operation has completed
*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
{00020404-0000-0000-C000-000000000046}
data.dat
\nir_cmd.bss speak text
\nir_cmd.bss setsysvolume 65535
\nir_cmd.bss mutesysvolume 1
\nir_cmd.bss mutesysvolume 0
\nir_cmd.bss screensaver
\nir_cmd.bss monitor off
\nir_cmd.bss monitor on
PORT
TRANSFERPORT
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\
Keylog
Wscript.Shell
HKEY_CLASSES_ROOT\HTTP\shell\open\command\
\winlogon.exe
iexplore.exe
hXXp://VVV.facebook.com/?ref=home
hXXp://VVV.facebook.com
ADVAPI32.dll
Windows Firewall/Internet Connection Sharing (ICS)
WebCamCapture
\Vuze\Azureus.exe
\LimeWire\LimeWire.exe
\uTorrent\uTorrent.exe
\uTorrent\uTorrent.exe /HIDE
\BitTorrent\bittorrent.exe
\MSWINSCK.OCX
\cmd.exe
dkey
\data.dat
nkey
regsvr32.exe
\pws_mail.bss
\pws_mess.bss
\pws_cdk.bss
\nir_cmd.bss
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "
:*:Enabled:Windows Messanger" /f
winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2
00000000
winmgmts:\\.\root\cimv2
Select * from Win32_Keyboard
api.ipinfodb.com
GET /v2/ip_query.php?key=
&timezone=off HTTP/1.1
Host: api.ipinfodb.com
GET /v2/ip_query_country.php?key=
Portable
winmgmts:\\.\root\SecurityCenter
\wallpaper.bmp
\wallpaper.jpg
WScript.Shell
WinServer 2003, Web Edition
Autorun.ini
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
__oxFrame.class__
Scripting.FileSystemObject
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}
Address family not supported by protocol family.
Operation already in progress.
Operation now in progress.
Socket operation on nonsocket.
Operation not supported.
Protocol family not supported.
Protocol not supported.
Socket type not supported.
Winsock.dll version out of range.
CSocketMaster.SocketExists
CSocketMaster.PostSocket
CSocketMaster.ConnectToIP
CSocketMaster.ResolveIfHostname
CSocketMaster.SendBufferedDataUDP
CSocketMaster.SendBufferedData
sqlite3.dll
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_finalize
\mail.dat
sqlite3_column_text
abe2869f-9b47-4cd9-a358-c22904dba7f7
/stext mess.dat
\mess.dat
/stext mail.dat
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion
Windows
SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
\Mozilla Firefox\
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
softokn3.dll
nss3.dll
\Mozilla\Firefox\
profiles.ini
\signons.sqlite
select * from moz_logins
PK11_GetInternalKeySlot
http\shell\open\command
127.0.0.1
\dump.txt
\uTorrent\uTorrent.exe /DIRECTORY
255.255.255.255
finalizarprocessoportas
drvloadn.dll
CONNECT %s:%i HTTP/1.0
SOFTWARE\Classes\http\shell\open\command
Software\Classes\http\shell\open\command
Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
bnfa.exe
code.is.a.winner
Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId
bps1.exe
bhookpl.dll
drvloadx.dll
VNCHooks.dll
xr4tdwa.exe
shutdown.exe
TCnRawKeyBoard
HuntHTTPDownload
autorun.inf
hXXps://onlineeast#.bankofamerica.com
winlogon.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\system32\userinit.exe,
@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
svchost.exe_1924_rwx_00400000_0005A000:.text
`.data
.rsrc
MSVBVM60.DLL
bss_server.usrReverseRelay
bss_server.usrRelay
tmrWebHide
bss_server.Socket
mswinsck.ocx
MSWinsockLib.Winsock
modLaunchWeb
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\SysWOW64\ieframe.dll
winmm.dll
user32.dll
advapi32.dll
shell32.dll
kernel32.dll
avicap32.dll
advpack.dll
GetAsyncKeyState
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
SHFileOperationA
CreatePipe
PSAPI.DLL
GetTcpTable
ExitWindowsEx
EnumWindows
WinInet.dll
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
ShellExecuteA
keybd_event
CHAT_ADDMSG
cmdShowfiles
UDPSocket
G%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca
tmrTCP
tmrUDP
UDPFlood
VBA6.DLL
C:\Windows\SysWow64\msvbvm60.dll\3
ws2_32.dll
AddMsg
GdiplusShutdown
RemotePort
LocalPort
WSOCK32.DLL
RegCloseKey
RegOpenKeyExA
FtpUpload
ntdll.dll
ole32.dll
crypt32.dll
oleaut32.dll
RegOpenKeyA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
gdi32.dll
olepro32.dll
InternetOpenUrlA
FtpDownload
FtpGetFileA
FtpPutFileA
FtpSetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpOpenFileA
FtpGetFileSize
FtpDeleteFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpRenameFileA
FtpGetDirectory
Http_DownloadFile
msvbvm60.dll
?8??8??8??8??8?
uMsg
strMsg
MsgNum
AllMsgs
lngPort
Port
Password
WebURL
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Occurs after a send operation has completed
*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
{00020404-0000-0000-C000-000000000046}
data.dat
\nir_cmd.bss speak text
\nir_cmd.bss setsysvolume 65535
\nir_cmd.bss mutesysvolume 1
\nir_cmd.bss mutesysvolume 0
\nir_cmd.bss screensaver
\nir_cmd.bss monitor off
\nir_cmd.bss monitor on
PORT
TRANSFERPORT
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\
Keylog
Wscript.Shell
HKEY_CLASSES_ROOT\HTTP\shell\open\command\
\winlogon.exe
iexplore.exe
hXXp://VVV.facebook.com/?ref=home
hXXp://VVV.facebook.com
ADVAPI32.dll
Windows Firewall/Internet Connection Sharing (ICS)
WebCamCapture
\Vuze\Azureus.exe
\LimeWire\LimeWire.exe
\uTorrent\uTorrent.exe
\uTorrent\uTorrent.exe /HIDE
\BitTorrent\bittorrent.exe
\MSWINSCK.OCX
\cmd.exe
dkey
\data.dat
nkey
regsvr32.exe
\pws_mail.bss
\pws_mess.bss
\pws_cdk.bss
\nir_cmd.bss
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "
:*:Enabled:Windows Messanger" /f
winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2
00000000
winmgmts:\\.\root\cimv2
Select * from Win32_Keyboard
api.ipinfodb.com
GET /v2/ip_query.php?key=
&timezone=off HTTP/1.1
Host: api.ipinfodb.com
GET /v2/ip_query_country.php?key=
Portable
winmgmts:\\.\root\SecurityCenter
\wallpaper.bmp
\wallpaper.jpg
WScript.Shell
WinServer 2003, Web Edition
Autorun.ini
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
__oxFrame.class__
Scripting.FileSystemObject
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}
Address family not supported by protocol family.
Operation already in progress.
Operation now in progress.
Socket operation on nonsocket.
Operation not supported.
Protocol family not supported.
Protocol not supported.
Socket type not supported.
Winsock.dll version out of range.
CSocketMaster.SocketExists
CSocketMaster.PostSocket
CSocketMaster.ConnectToIP
CSocketMaster.ResolveIfHostname
CSocketMaster.SendBufferedDataUDP
CSocketMaster.SendBufferedData
sqlite3.dll
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_finalize
\mail.dat
sqlite3_column_text
abe2869f-9b47-4cd9-a358-c22904dba7f7
/stext mess.dat
\mess.dat
/stext mail.dat
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion
Windows
SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
\Mozilla Firefox\
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
softokn3.dll
nss3.dll
\Mozilla\Firefox\
profiles.ini
\signons.sqlite
select * from moz_logins
PK11_GetInternalKeySlot
http\shell\open\command
127.0.0.1
\dump.txt
\uTorrent\uTorrent.exe /DIRECTORY
255.255.255.255
finalizarprocessoportas
drvloadn.dll
CONNECT %s:%i HTTP/1.0
SOFTWARE\Classes\http\shell\open\command
Software\Classes\http\shell\open\command
Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
bnfa.exe
code.is.a.winner
Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId
bps1.exe
bhookpl.dll
drvloadx.dll
VNCHooks.dll
xr4tdwa.exe
shutdown.exe
TCnRawKeyBoard
HuntHTTPDownload
autorun.inf
hXXps://onlineeast#.bankofamerica.com
winlogon.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\system32\userinit.exe,
@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
rundll32.exe_1548:.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps