Gen.Variant.Zusy.133958_fa24b6bd37 – Adaware

Trojan-Dropper.Win32.Sysn.atra (Kaspersky), Gen:Variant.Zusy.133958 (B) (Emsisoft), Gen:Variant.Zusy.133958 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: fa24b6bd370cdeb4542ca369f432bbdc

SHA1: ff218ecedce5e599886417ccecaaec2e077ba7e1

SHA256: a5cf8600289d0e9d2c169bd9d5e312811a7c5fabcc507e87428af511a0fbe1a9

SSDeep: 49152:uWsmV5zjMAaOMBDslx96 bTbtwncavywgqQTFDw0Hf3R9tKPxdhmQ0E :uIzA5pIp6 b/tw0q4DpHngxvKE

Size: 2046976 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2015-03-23 05:46:26

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

Windows Update.exe:736
%original file name%.exe:220
%original file name%.exe:1592
vbc.exe:1756
vbc.exe:2500

The Trojan injects its code into the following process(es):

Windows Update.exe:1596

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Windows Update.exe:1596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (15019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (65 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@ssl.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@money.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msnportal.112.2o7[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@auto.search.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hit.gemius[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@vk[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pass.yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky.122.2o7[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ox.sadpanda[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sadpanda[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@youtube[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
C:\FA24B6BD370CDEB4542CA369F432BBDC.EXE (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)

The process %original file name%.exe:220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Windows Update.exe (15019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SysInfo.txt (39 bytes)

The process vbc.exe:1756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)

The process vbc.exe:2500 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)

Registry activity

The process Windows Update.exe:1596 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 1F 5B FE E2 9C 17 C8 2A C2 DA A1 CC CB EE 7C"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Windows Update\DEBUG]
"Trace Level" = ""

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Windows Update\DEBUG]
"Trace Level"

The process Windows Update.exe:736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 20 D4 DF 33 85 B9 41 A1 CA A2 5B 34 57 FE 4D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 3C F5 EE 78 67 8A 0B 07 26 17 6D C4 FC BE 8C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"Windows Update.exe" = "aNfLsUrOcMeP"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:1592 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F B0 B6 99 19 8A 1F 0A 65 03 57 B3 D4 FA 8F 94"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process vbc.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 C8 30 41 17 9E DE 9D CA 5F 0F 73 C4 9F B5 B1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process vbc.exe:2500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B C2 38 A5 CD 40 A7 5F DE 71 04 0D 14 F0 D2 D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
Windows Update.exe:736
%original file name%.exe:220
%original file name%.exe:1592
vbc.exe:1756
vbc.exe:2500
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (15019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (65 bytes)
%Documents and Settings%\%current user%\Application Data\Windows Update.exe (15019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SysInfo.txt (39 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: aNfLsUrOcMeP
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2015
Legal Trademarks:
Original Filename: nEoClWuVmRg.exe
Internal Name: nEoClWuVmRg.exe
File Version: 1.0.0.0
File Description: aNfLsUrOcMeP
Comments:
Language: Language Neutral

Company Name: Product Name: aNfLsUrOcMePProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2015Legal Trademarks: Original Filename: nEoClWuVmRg.exeInternal Name: nEoClWuVmRg.exeFile Version: 1.0.0.0File Description: aNfLsUrOcMePComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	2044148	2044416	5.17627	b274637832e9cb3693d26d08d0394f76
.rsrc	2056192	1536	1536	2.76336	0b414005cb16c6419ed1cda9214ce9a8
.reloc	2064384	12	512	0.070639	770a547eef25b9023d12ce6e4c22068d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://whatismyipaddress.com/	66.171.248.172
smtp.mail.ru	217.69.139.160

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 05 Apr 2015 05:21:04 GMT

Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.30 mod_ssl/2.2.26 OpenSSL/0.9.8zc

Set-Cookie: pt=591f1a1a992cae1fc6ba0248fe4c6983; expires=Mon, 06-Apr-2015 05:21:04 GMT

Cache-Control: max-age=15

MS-Author-Via: DAV

Vary: Accept-Encoding

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

20b2..<!doctype html>.<html lang="en">.<head>..<meta charset="windows-1252">..<meta name="robots" content="noarchive">..<title>What Is My IP Address? IP Address Tools and More</title>..<meta name="description" content="IP address lookup, location, proxy detection, email tracing, IP hiding tips, blacklist check, speed test, and forums. Find, get, and show my IP address.">..<meta name="keywords" content="my ip ,ip, address, adress, my, what, is, find, get, show, locate, change, location, how, do, i, ip address, proxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer, anonymize, changer, privacy, geolocation, geolocate, lookup, look up, locate, trace, track, email, source, headers">..<meta property="fb:admins" content="607824267"/>..<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<link rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.com/css/myip_v4_4.css">..<link rel="publisher" href="hXXps://plus.google.com/ whatismyipaddress">..<link rel="canonical" href="http://whatismyipaddress.com">..<link rel="alternate" hreflang="fr" href="hXXp://whatismyipaddress.com/fr/mon-ip">..<link rel="alternate" hreflang="de" href="hXXp://whatismyipaddress.com/de/meine-ip">..<link rel="alternate" hreflang="es" href="hXXp://whatismyipaddress.com/es/mi-ip">..<link rel="alternate" hreflang="tr" href="hXXp://whatismyipaddress.com/tr/ip-im">..<link rel="alternat

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Windows Update.exe_1596:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

`.rdata

@.data

.rsrc

%UUUU3

tcPW

-4-4--567

%s%2.2X

Browser Password Dump

%s v%s by SecurityXploded

hXXp://securityxploded.com/browser-password-dump.php

BrowserPasswordDump

%s.exe [-h | -f ]

//Dump login passwords from all the Browsers to console

%s.exe

//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'

%s.exe -f "c:\passlist.txt"

%s.exe -h

pstorec.dll

http:/

https:/

abe2869f-9b47-4cd9-a358-c22904dba7f7

hXXps://%s

hXXp://%s

Cannot close vault. Error (%d)

Web Data

select * from logins where blacklisted_by_user=0;

\MapleStudio\ChromePlus\User Data\Default\

\Google\Chrome SxS\User Data\Default\

\Google\Chrome\User Data\Default\

Opera\Opera\

Opera\Opera\profile\

wand.dat

account

passwords

data

server

%s\Safari\Apple Application Support\plutil.exe

%s\Apple\Apple Application Support\plutil.exe

%s\%s\keychain.plist

%skeytest.tmp

"%s" -convert xml1 -s -o "%s" "%s"

Google Chrome

Opera Browser

Firefox

Chrome SXS

SeaMonkey

Browser: %s

Website: %s

Username: %s

Password: %s

vaultcli.dll

Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path

Browser Password Recovery Report

Website URL

Password

Produced by %s from hXXp://VVV.SecurityXploded.com

Tip: For more options type %s.exe -h

This is command-line application. Kindly Run it from the CMD Prompt

Press any key to exit....

SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

Mozilla\SeaMonkey

Mozilla\Firefox

\profiles.ini

select * from moz_logins;

/signons.txt

/signons2.txt

/signons3.txt

\signons.sqlite

nss3.dll

PK11_GetInternalKeySlot

PK11_CheckUserPassword

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

3.6.16

sqlite_version

RowKey

SQL logic error or missing database

large file support is disabled

sqlite_detach

sqlite_attach

d-d-d d:d:d

d:d:d

d-d-d

922337203685477580

%s\etilqs_

OsError 0x%x (%u)

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

sqlite3BtreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in header on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmented space is %d byte reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

%s-mjX

unable to use function %s in the requested context

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

cannot open indexed column for writing

cannot open value of type %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

misuse of aggregate: %s()

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_trigger

%s OR name=%Q

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

unable to close due to unfinished backup operation

no such vfs: %s

GetProcessWindowStation

operator

GetProcessHeap

KERNEL32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

CRYPT32.dll

GetCPInfo

OLEAUT32.dll

zcÃ

kernel32.dll

\StringFileInfo\xx\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

outlook.exe

msimn.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

Email Password Dump

hXXp://securityxploded.com/email-password-dump.php

EmailPasswordDump

//Dump all the Email passwords to console

//Dump all the Email passwords to a file "c:\passlist.txt"

\.purple\accounts.xml

%s\%s

@gmail.com

@yahoo.com

Software\Paltalk\%s

Software\Google\Google Talk\Accounts\%s

Microsoft_WinInet_VVV.google.com:443

%sMiranda_Mirror_%d.bin

LoginPassword

LoginName

LoginServer

gmail.com

%s\%s\%s.dat

pop3password=

esmtpaccount=

esmtppassword=

smtphost=

SmtpPassword

ESMTPAccountKey

c:\Program Files\Foxmail\mail

%s\%s\Account.stg

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

PopPassword

SmtpAccount

SmtpServer

%s\%s\Accounts

%s\%s\Accounts\%s

Mozilla Thunderbird

Windows Live Mail

Windows Credential Manager

Application:%s

Email ID: %s

WindowsLive:name=*

Software\Microsoft\Windows Live Mail

hXXps://

00000050

.oeaccount

Software\Microsoft\IdentityCRL\Creds\%s

ps:password

Email Password Recovery Report

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

kpstorec.dll

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417e2d75-84bd-11d0-84bb-00c04fd43f8f

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

IMAP Password

IMAP Port

POP3 Password

POP3 Port

SMTP User

SMTP Password

SMTP Server

SMTP Port

HTTP User

HTTP Password

HTTP Server URL

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

%s\%s\%s

%s\%s\%s\%s

SMTP Email Address

IMAP Password2

POP3 Password2

SMTP User Name

SMTP Password2

HTTPMail User Name

HTTPMail Password2

HTTPMail Server

LDAP Password2

Specified master password "%s" is wrong. Please try again with correct password

GetWindowsDirectoryA

RegEnumKeyExA

USERENV.dll

VERSION.dll

RPCRT4.dll

v2.0.50727

Stub.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

System.Xml

tapi32.dll

rtm.dll

user32.dll

ntdll.dll

Crypt32.dll

Stub.Form1.resources

Stub.Resources.resources

Stub.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.ctor

.cctor

System.Diagnostics

System.Threading

System.Runtime.CompilerServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

System.Reflection

ContainsKey

InvalidOperationException

MyWebServices

System.Runtime.InteropServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

fakeMSGholder

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

StealPasswords

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

System.Security

ProcessHandle

Stub.My.Resources

System.Resources

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

GoogleChrome

MozillaFirefox

loadCerts

FTPCommander

System.Text.RegularExpressions

WindowsKey

SQLite

SQLDataTypeSize

sqlite_master_entry

sql_statement

Passwords

PasswordSource

FtpCommander

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

My.Settings

$3e46a124-e015-4b12-9390-f16ac4d7ad53

1.0.0.0

_CorExeMain

mscoree.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

hXXp://

Hmscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

Fkernel32.dll

USER32.DLL

hXXp://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXp://twitter.com/

hXXps://twitter.com/

hXXps://login.yahoo.com/config/login

hXXps://pinterest.com/login/

hXXp://VVV.linkedin.com/

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://accounts.google.com/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXp://digg.com

hXXp://VVV.myspace.com

hXXps://myspace.com

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://slashdot.org/bookmark.pl

hXXp://VVV.reddit.com/login

noftp

MessageBoxIcon.Information

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

MessageBoxIcon.Error

MessageBoxIcon.Exclamation

MessageBoxIcon.Question

Dear HawkEye Customers!

HawkEye Admin

HawkEye Logger Details

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

Dear HawkEye Customer!

This is a notification generated by

after successful injection of your server.

Best Regards
HawkEye Admin

************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

HawkEye_Keylogger_Recoveries_

HawkEye Keylogger | Recoveries |

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

Operating System Platform:

Operating System Version:

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Recoveries |

Dear HawkEye Customer!

HawkEye Keylogger | BitCoin Recoveries |

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Recoveries |

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keyboard

Keyboard Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

PTF://

HawkEye Keylogger | Keyboard Clipboards Records |

**************************************
Keyboard Records
**************************************

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://whatismyipaddress.com/

Stub.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\Google\Chrome\User Data\Default\Login Data

logins

origin_url

password_value

moz_logins

formSubmitURL

encryptedPassword

\Mozilla Firefox\

mozglue.dll

\sitemanager.xml

\recentservers.xml

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

port

password

C:\cftp\Ftplist.txt

\cftp\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

password = (?.*?)

hXXp://dyn.com/dns/

\Dyn\Updater\daemon.cfg

\Dyn\Updater\config.dyndns

hXXps://VVV.noip.com/

CKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Windows Update.exe_1596_rwx_00400000_00122000: