HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.PWS.OnlineGames.KBXH (B) (Emsisoft), Trojan.PWS.OnlineGames.KBXH (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: OnlineGames, Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a3667798ef8a9032143e80873f418683
SHA1: 3a6831e252652a870ac3bd6dac2c84f8523a2c2a
SHA256: 0c2c7629f7f2df7db284e04158857f4963941405daf138f2abcb419b3ee40a7b
SSDeep: 3072:NUuwpX3 TjDn2 JK5vvdiHm6xZ7Pcaes5R xHMS0WPcWLv53:akTPn2EK5GLZLV5R xHDPF
Size: 211255 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: ?? 2014 ClientConnect Ltd.
Created at: 2009-04-16 15:23:01
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:188
The Trojan injects its code into the following process(es):
Explorer.EXE:1572
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:188 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\olhrwef.exe (1281 bytes)
%System%\drivers\klif.sys (3 bytes)
%System%\nmdfgds0.dll (99 bytes)
The Trojan deletes the following file(s):
%System%\drivers\klif.sys (0 bytes)
Registry activity
The process %original file name%.exe:188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\System\CurrentControlSet\Services\KAVsys]
"Type" = "1"
"ImagePath" = "\??\%System%\drivers\klif.sys"
"ErrorControl" = "1"
The following driver will be automatically launched by the NT Native code (IoInitSystem method):
[HKLM\System\CurrentControlSet\Services\KAVsys]
"Start" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"cdoosoft" = "%System%\olhrwef.exe"
The Trojan deletes the following registry key(s):
[HKLM\System\CurrentControlSet\Services\KAVsys]
Dropped PE files
MD5 | File path |
---|---|
100dfca7a82d2ebed9f3d0461c95ca6d | c:\WINDOWS\system32\nmdfgds0.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:188
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%System%\olhrwef.exe (1281 bytes)
%System%\drivers\klif.sys (3 bytes)
%System%\nmdfgds0.dll (99 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"cdoosoft" = "%System%\olhrwef.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 45056 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.data | 49152 | 12288 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.idata | 61440 | 57344 | 57344 | 5.54257 | 546504875758cb651964017f230a2721 |
.rdata | 118784 | 86016 | 86016 | 5.54328 | 9f491d3e5d5052e5733e0d943285d9e8 |
.sdata | 204800 | 16384 | 14848 | 5.0176 | b7d2e8c0723a5b7b5b59e57d1f7eea36 |
.rsrc | 221184 | 4096 | 4096 | 0.601716 | d97cd3d4ba80f25274e7a95ac65503e5 |
0 | 0 | 0 | 0 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
Explorer.EXE_1572_rwx_02190000_00001000:
|%System%\nmdfgds0.dll
|%System%\nmdfgds0.dll
Explorer.EXE_1572_rwx_02341000_0002A000:
exefile.exe
exefile.exe
python25.dll
python25.dll
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d
pol.exe
pol.exe
polcore.dll
polcore.dll
app.dll
app.dll
explorer.exe
explorer.exe
\foool.dat
\foool.dat
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
maplestory.exe
maplestory.exe
%s?a=%s&s=%s&u=%s&p=%s&ss=%s&sp=%s
%s?a=%s&s=%s&u=%s&p=%s&ss=%s&sp=%s
SOUND/GAME.IMG/GAMEIN
SOUND/GAME.IMG/GAMEIN
\\.\npkcrypt
\\.\npkcrypt
%s?a=%s&s=%s&u=%s&p=%s&ss=%s&sp=%s&r=%s&l=%d&m=%d
%s?a=%s&s=%s&u=%s&p=%s&ss=%s&sp=%s&r=%s&l=%d&m=%d
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d&pc=%s
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d&pc=%s
hXXp://aoc-eu-update.live.ageofconan.com/upm
hXXp://aoc-eu-update.live.ageofconan.com/upm
hXXp://aoc-us-update.live.ageofconan.com/upm
hXXp://aoc-us-update.live.ageofconan.com/upm
localconfig.xml
localconfig.xml
ageofconan.exe
ageofconan.exe
%s?a=%s&s=%s&u=%s&p=%s
%s?a=%s&s=%s&u=%s&p=%s
rohanclient.exe
rohanclient.exe
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d&st=%d
%s?a=%s&s=%s&u=%s&p=%s&sp=%s&r=%s&l=%d&m=%d&st=%d
\fooolMJ.dat
\fooolMJ.dat
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
\The Lord of the Rings Online\lotroclient.log
\The Lord of the Rings Online\lotroclient.log
WindowsForms10.COMBOBOX.app3
WindowsForms10.COMBOBOX.app3
WindowsForms10.EDIT.app3
WindowsForms10.EDIT.app3
WindowsForms10.Window.8.app3
WindowsForms10.Window.8.app3
turbinelauncher.exe.config
turbinelauncher.exe.config
lotroclient.exe
lotroclient.exe
turbinelauncher.exe
turbinelauncher.exe
ws2_32.dll
ws2_32.dll
Kernel32.dll
Kernel32.dll
Urlmon
Urlmon
HttpQu-y9fo,3|`GOpenJ
HttpQu-y9fo,3|`GOpenJ
urlinfo
urlinfo
coc.exe
coc.exe
aaa.dat
aaa.dat
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL
Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
\explorer.exe
\explorer.exe
SoftWare\Microsoft\Windows\CurrentVersion\Run
SoftWare\Microsoft\Windows\CurrentVersion\Run
autorun.inf
autorun.inf
knightonline.exe
knightonline.exe
%s?a=%s&s=%s&u=%s&p=%s&sp=%s
%s?a=%s&s=%s&u=%s&p=%s&sp=%s
sro_client.exe
sro_client.exe
gamemon.des
gamemon.des
dekaron.exe
dekaron.exe
gameguard.des
gameguard.des
216.107.243.53
216.107.243.53
216.107.243.51
216.107.243.51
216.107.243.52
216.107.243.52
%s(%d)/
%s(%d)/
lin.bin
lin.bin
%s?a=%s&s=%s&u=%s&p=%s&pin=%s&r=%s&l=%d&m=%d
%s?a=%s&s=%s&u=%s&p=%s&pin=%s&r=%s&l=%d&m=%d
\WTF\config.wtf
\WTF\config.wtf
/safebox_password
/safebox_password
metin2.bin
metin2.bin
\channel.inf
\channel.inf
hXXp://VVV.metin2.org/game_signup.php
hXXp://VVV.metin2.org/game_signup.php
\patch.cfg
\patch.cfg
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
cabalmain.exe
cabalmain.exe
hXXp://hjyuw2.com/xmfx/help1.rar
hXXp://hjyuw2.com/xmfx/help1.rar
wow.exe
wow.exe
%WinDir%\Explorer.EXE
%WinDir%\Explorer.EXE
WS2_32.dll
WS2_32.dll
open=ej10fkdo.bat
open=ej10fkdo.bat
shell\open\Command=ej10fkdo.bat
shell\open\Command=ej10fkdo.bat
)>!%"-8)
)>!%"-8)
%>)/8#>5
%>)/8#>5
88>%.98)?
88>%.98)?
"8)> #/')(
"8)> #/')(
"/>)!)"8
"/>)!)"8
)/>)!)"8
)/>)!)"8
"%8%- %6)
"%8%- %6)
":%>#"!)"8
":%>#"!)"8
;?%"8*
;?%"8*
#>) >#9"(
#>) >#9"(
>%:% ) )
>%:% ) )
>%:% ) )?
>%:% ) )?
KERNEL32.DLL
KERNEL32.DLL
USER32.dll
USER32.dll
WININET.dll
WININET.dll
ADVAPI32.dll
ADVAPI32.dll
.code5
.code5
l32.dll
l32.dll
HttpQ
HttpQ
LIVESRV.EXE
LIVESRV.EXE
rosoft\Windows\Cur
rosoft\Windows\Cur
\\.\%s
\\.\%s
udpB6
udpB6
.tTa_
.tTa_
`.rd\aSN
`.rd\aSN
PSAPI.DLL
PSAPI.DLL
RegCloseKey
RegCloseKey
ANTIVM.dll
ANTIVM.dll
>r.iM
>r.iM
Bga.wLy
Bga.wLy
.roy.
.roy.
\O#.LK
\O#.LK
GetWindowsDirectoryA
GetWindowsDirectoryA
Explorer.EXE_1572_rwx_02380000_00080000:
.code
.code
Kernel32.dll
Kernel32.dll
Urlmon
Urlmon
HttpQu-y9fo,3|`GOpenJ
HttpQu-y9fo,3|`GOpenJ
LIVESRV.EXE
LIVESRV.EXE
*.dll(MOVE)
*.dll(MOVE)
*.exe(MOVE)
*.exe(MOVE)
VCRMON.EXE
VCRMON.EXE
Update.exe
Update.exe
CCSVCHST.EXE
CCSVCHST.EXE
ALUSCHEDULERSVC.EXE
ALUSCHEDULERSVC.EXE
luall.exe
luall.exe
ASHDISP.EXE
ASHDISP.EXE
avast.setup
avast.setup
setup.ovr
setup.ovr
AVP.EXE
AVP.EXE
prupdate.ppl
prupdate.ppl
AYAGENT.AYE
AYAGENT.AYE
AYUpdate.aye
AYUpdate.aye
UFSEAGNT.EXE
UFSEAGNT.EXE
SfFnUp.exe
SfFnUp.exe
UfUpdUi.exe
UfUpdUi.exe
AVGNT.EXE
AVGNT.EXE
preupd.exe
preupd.exe
update.exe
update.exe
VSTSKMGR.EXE
VSTSKMGR.EXE
vsupdate.dll
vsupdate.dll
mcupdate.exe
mcupdate.exe
AVGRSX.EXE
AVGRSX.EXE
avgupd.exe
avgupd.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ntdll.dll
ntdll.dll
\\.\%s
\\.\%s
%s%s\Security
%s%s\Security
%s%s\Enum
%s%s\Enum
\Registry\Machine\System\CurrentControlSet\Services\%s
\Registry\Machine\System\CurrentControlSet\Services\%s
\??\%s
\??\%s
System\CurrentControlSet\Services\%s
System\CurrentControlSet\Services\%s
\\.\%c:
\\.\%c:
\dllcache\cdaudio.sys
\dllcache\cdaudio.sys
\drivers\cdaudio.sys
\drivers\cdaudio.sys
\drivers\klif.sys
\drivers\klif.sys
NTDLL.DLL
NTDLL.DLL
GetWindowsDirectoryA
GetWindowsDirectoryA
RegCreateKeyA
RegCreateKeyA
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
rosoft\Windows\Cur
rosoft\Windows\Cur
udpB6
udpB6
.tTa_
.tTa_
`.rd\aSN
`.rd\aSN
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
PSAPI.DLL
PSAPI.DLL
USER32.dll
USER32.dll
ANTIVM.dll
ANTIVM.dll