Virus.Win32.Sality_5b60d99ba2 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Virus creates the following process(es):

%original file name%.exe:268

The Virus injects its code into the following process(es):

Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:268 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\netlog.txt (35 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (1062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (1888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (2734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007EFCC_Rar\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (4512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (3833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (4 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\bundle.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:268 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "3585464105"

[HKCU\Software\Store\WindApp]
"lastPartnerUpdate" = "12.12.2015 21:32:37"

[HKCU\Software\Aas\695404737]
"35845605" = "346"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "5B68D29F5F257E60B647DC1827F5438DD92AAD1B81B3A1C6102C99131826B86429DC47A17661558ABD0B88DDDBFC8C493E11520205E0DD6E2B190FFE1E602DF47196BE3B95B876A40411FD1F49281AEC0373FF8649D483A9275B5B5EFC9412D9E9102DCB8E7DB7C56D7F098531F57995DF6F48E78C56E274F6496D19EFFCB523"
"43014726" = "0900687474703A2F2F676C616D66726F6D656173742E636F6D2F696D6167652F6C6F676F2E67696600687474703A2F2F656469726E656C692E6E65742F74722F6C6F676F2E67696600687474703A2F2F656D7261686B7563756B6B617064616E2E636F6D2F696D672F627574746F6E2E67696600687474703A2F2F676172646170616C6163652E69742F6C6F676F2E67696600687474703A2F2F686964726F7365727662697374726974612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6261627973746F70686F7573652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6D616264657369676E2E756E6C756761722E636F6D2F627574746F6E2E67696600687474703A2F2F646174616C696E6B736F6C2E636F6D2F6C6F676F2E67696600687474703A2F2F736E736F66742E686F73742D65642E6D652F696D616765732F6C6F676F732E676966"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "215"

"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 C2 AC 48 7B 5D 1A 56 A9 26 20 48 C1 D1 30 E3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_0" = "9039"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:268
Delete the original Virus file.
Delete or disinfect the following files created/modified by the Virus:
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\netlog.txt (35 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (1062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (1888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (2734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007EFCC_Rar\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (4512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (3833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (4 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Nosibay
Product Name: WindApp
Product Version:
Legal Copyright: (c) Store
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.0.673.0.62793
File Description:
Comments:
Language: English (United States)

Company Name: NosibayProduct Name: WindAppProduct Version: Legal Copyright: (c) StoreLegal Trademarks: Original Filename: Internal Name: File Version: 3.0.673.0.62793File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.48079	a00d230cc84dfff4b18f935519b30858
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	188416	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	380928	98304	95232	5.40213	82b52df90f5745af38919914c1d31603

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://fr-inst.windapp.net/bundles/activelist.php	83.145.109.178
hxxp://rrbstatic.yabison.com/s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /bundles/activelist.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: partnersquery.txt

User-Agent: NSIS_Inetc (Mozilla)

Host: fr-inst.windapp.net

Content-Length: 279

Connection: Keep-Alive

Cache-Control: no-cache

c=&p=yes&ins=&lastupt=&phase=update&tag=&vuid=&offer=0&offerscount=1&browser=IEXPLORE.EXE&firewall=&os=Microsoft Windows XP Professional version : 5.1.2600 service pack : 3.0&AntiVirus=&DotNet=2.0.0&screen=1276x846&cpuspeed=3391&memory=512&bgcolor=D4D0C8&apc=APC157&enable=&api=2

HTTP/1.1 200 OK

Date: Sat, 12 Dec 2015 19:32:29 GMT

Server: Apache

X-Powered-By: PHP/5.1.6

Pragma: no-cache

Expires: 0

Content-Transfer-Encoding: binary

Content-Length: 0

Connection: close

Content-Type: text/plain; charset=iso-8859-1

GET /s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:26 GMT

Cache-Control: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: nginx..Date: Sat, 12 Dec 2015 19:32:27 GMT..Content-Type: image/gif..Content-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connection: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:32:26 GMT..Cache-Control: no-cache..GIF89a.............!.......,...........L..;....

GET /s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:29 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:28 GMT

Cache-Control: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: nginx..Date: Sat, 12 Dec 2015 19:32:29 GMT..Content-Type: image/gif..Content-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connection: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:32:28 GMT..Cache-Control: no-cache..GIF89a.............!.......,...........L..;....

GET /s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache

GIF89a.............!.......,...........L..;....

GET /s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache

GIF89a.............!.......,...........L..;....

GET /s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: nginx..Date: Sat, 12 Dec 2015 19:32:30 GMT..Content-Type: image/gif..Content-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connection: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:32:29 GMT..Cache-Control: no-cache..GIF89a.............!.......,...........L..;..

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_1140_rwx_00FF0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

Explorer.EXE_1140_rwx_01E00000_00001000:

|explorer.exeM_1140_

Explorer.EXE_1140_rwx_03A00000_0108E000:

c:\windows

hXXp://glamfromeast.com/image/logo.gif

hXXp://edirneli.net/tr/logo.gif

hXXp://emrahkucukkapdan.com/img/button.gif

hXXp://gardapalace.it/logo.gif

hXXp://hidroservbistrita.ro/images/logo.gif

hXXp://babystophouse.com/images/logo.gif

hXXp://mabdesign.unlugar.com/button.gif

hXXp://datalinksol.com/logo.gif

hXXp://snsoft.host-ed.me/images/logos.gif

%System%\drivers\kdhhe.sys

5200312201

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

rnl.exe?

= =$=(=,=0=4=8=

rv:1.9.2.3)

.NEtCLR

.klkjw:9fqwiBu

f3a.sysB

D6c.pBTab

drfig%s:*:

0}.T&?%x=

~UrlA'W

\'Web%

HTTP)s'PJ

o.ENHCD

KPCKwWEBWUPD

>*?456789:;

!"#$%&'()* ,-./01230 0

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps