Generic.Malware.SLdld.FC3A329E_4afbc3e693 – Adaware

Generic.Malware.SL!dld.FC3A329E (BitDefender), Trojan:Win32/Dorv.A (Microsoft), Trojan-Dropper.Win32.Injector.paqi (Kaspersky), RiskTool.Win32.ProcessPatcher.Nor!cobra (v) (not malicious) (VIPRE), Trojan.DownLoader6.34128 (DrWeb), Artemis!4AFBC3E693A4 (McAfee), Backdoor.Trojan (Symantec), Trojan.Win32.Scar (Ikarus), Generic.Malware.SL!dld.FC3A329E (FSecure), Cryptic.CWS (AVG), Win32:Downloader-RCM [Trj] (Avast), WORM_XTREME.SMM (TrendMicro), Generic.Malware.SL!dld.FC3A329E (AdAware), Backdoor.Win32.Farfli.FD, Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Backdoor, Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 4afbc3e693a4681e0768549a15f8f7cb

SHA1: 73c1acf6ea044889f0d8f7bf58fef5606853bdc5

SHA256: ae96338971f25da85e3d4d1fe0c8f3d4552a268e7b97cd3b433451b5a0c85b29

SSDeep: 384:cIdmF TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmi5dt/H51bqpLR:cIsF8HdbKjV8BX7Vy6K7eIVT5dtBVO

Size: 21504 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 1992-06-20 01:22:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

%original file name%.exe:700

The Generic injects its code into the following process(es):

svchost.exe:1004
iexplore.exe:1144

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:700 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%System%\InstallDir\Server.exe (21 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg (2 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\x.html (0 bytes)

Registry activity

The process %original file name%.exe:700 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 88 26 B8 67 5E 5F 1C 10 10 EE A7 3C 2E 5E 05"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}]
"StubPath" = "%System%\InstallDir\Server.exe restart"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\((Mutex))]
"InstalledServer" = "%System%\InstallDir\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\((Mutex))]
"ServerStarted" = "7/13/2016 3:08:32 AM"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%System%\InstallDir\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%System%\InstallDir\Server.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:700
Delete the original Generic file.
Delete or disinfect the following files created/modified by the Generic:
%System%\InstallDir\Server.exe (21 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%System%\InstallDir\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%System%\InstallDir\Server.exe"
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	61440	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	65536	20480	19456	5.44101	a0d6d181fb13b119dedde17ed76303f1
.rsrc	86016	4096	1024	2.52474	76aafabe1c912aea6e6cbe39186e3abd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 11
b9ffa73998e6166898716d5f3b88600c
6a2d3cbf8f5bf92f9f1c5f112ef9509a
d233e8728b224e9800fa9ccd7bd4e2c1
4d538ad482f369af7b24b912448f2cec
ba38fd5c840ad950df0a6ff8e6669bbb
1b78e52df145fa557c7cc933f80e1267
63c65001b35b6552d00ae7cfda357dd6
0294dce9a3a840448e47a5fd5d0efd30
a05123d23a26ad1ef52ba7c6a44d24ee
f97b8d2b40150ee05c6e9228bb9ded3a
eae896da619fc1eca71492b7f3129923

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Generic connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_1004:

.text

`.data

.rsrc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

RPCRT4.dll

NETAPI32.dll

ole32.dll

ntdll.dll

RegCloseKey

RegOpenKeyExW

GetProcessHeap

NtOpenKey

svchost.pdb

\PIPE\

Software\Microsoft\Windows NT\CurrentVersion\Svchost

\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\

5.1.2600.5512 (xpsp.080413-2111)

svchost.exe

Windows

Operating System

5.1.2600.5512

svchost.exe_1004_rwx_00C80000_00016000:

`.rsrc

Kernel32.dll

ntdll.dll

kernel32.dll

789:;

user32.dll

urlmon.dll

wininet.dll

advapi32.dll

Shell32.dll

shell32.dll

shlwapi.dll

KWindows

UnitKeylogger

GetWindowsDirectoryW

GetProcessHeap

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

FindExecutableW

ShellExecuteW

SHDeleteKeyW

URLDownloadToFileW

UnhookWindowsHookEx

SetWindowsHookExW

MapVirtualKeyW

GetKeyboardLayout

GetKeyState

GetKeyboardState

FtpPutFileW

FtpSetCurrentDirectoryW

DeleteUrlCacheEntryW

.idata

.rdata

P.reloc

P.rsrc

DURLDr

KERNEL32.DLL

oleaut32.dll

PSAPI.dll

x.html

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows NT\CurrentVersion\Windows

explorer.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

[Execute]

KeyDelBackspace

XtremeKeylogger

hXXp://

.functions

ÃžFAULTBROWSER%

\Microsoft\Windows\

svchost.exe

desifre460.ddns.net

Server.exe

{5460C4DF-B266-909E-CB58-E32B79832EB2}

PTF.ftpserver.com

ftpuser

ftppass

%System%\InstallDir\Server.exe

%System%\InstallDir\

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg

Software\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}

iexplore.exe_1144:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_1144_rwx_00C80000_00016000:

`.rsrc

Kernel32.dll

ntdll.dll

kernel32.dll

789:;

user32.dll

urlmon.dll

wininet.dll

advapi32.dll

Shell32.dll

shell32.dll

shlwapi.dll

KWindows

UnitKeylogger

GetWindowsDirectoryW

GetProcessHeap

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

FindExecutableW

ShellExecuteW

SHDeleteKeyW

URLDownloadToFileW

UnhookWindowsHookEx

SetWindowsHookExW

MapVirtualKeyW

GetKeyboardLayout

GetKeyState

GetKeyboardState

FtpPutFileW

FtpSetCurrentDirectoryW

DeleteUrlCacheEntryW

.idata

.rdata

P.reloc

P.rsrc

DURLDr

KERNEL32.DLL

oleaut32.dll

PSAPI.dll

x.html

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows NT\CurrentVersion\Windows

explorer.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

[Execute]

KeyDelBackspace

XtremeKeylogger

hXXp://

.functions

ÃžFAULTBROWSER%

\Microsoft\Windows\

svchost.exe

desifre460.ddns.net

Server.exe

{5460C4DF-B266-909E-CB58-E32B79832EB2}

PTF.ftpserver.com

ftpuser

ftppass

%System%\InstallDir\Server.exe

%System%\InstallDir\

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg

Software\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}

c:\%original file name%.exe