Gen.Variant.Symmi.43349_0e7753f061 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Symmi.43349 (B) (Emsisoft), Gen:Variant.Symmi.43349 (AdAware), ZeroAccess.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0e7753f06128acb3d760aa72cfc9a0aa

SHA1: 9c3806e96e5362e2941de948f20a701365d71d10

SHA256: abb5b14a2db48467f6074f6f28f37998324978c168ca16d28ef46720a6aef76b

SSDeep: 98304:j6KiZHjksQeNHBqgImrxWdeBOceqabOnAFgoX:jJiZDseN3ImrxWEedbpF/

Size: 3298816 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-02-07 11:53:36

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe:844
%original file name%.exe:1328

The Trojan injects its code into the following process(es):

fGAwoYMM.exe:304
reIEcoQI.exe:324
NesIMIQs.exe:1696

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe:844 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\sas.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-2.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\preload-en-us.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\start-cb-hook.bat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\start.cmd (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvhk64.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_access_key.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\app_icon_16.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_collapsed.png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_expanded.png (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation2.png (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_1.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_2.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (172672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_alert.png (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_pinned_disconnected.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_3.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner.exe (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_actual_size.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality8.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\bomgar-scc.exe (259304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\settings-init.ini (695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_4.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_pinned_connected.png (777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ss_watermark.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\stop-cb-hook.bat.template (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\BF13227E-B446-4E12-913E-7E5FBBEE54F6 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_fit.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_not_present.png (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-1.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvhook.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\remove.exe (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\pinuninstall.bat (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation3.png (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation1.png (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\cbhook-x86.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-3.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-4.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\icon_exclamation.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvstub.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\winrtpxy.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_panic.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\app_icon_32.png (725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\embedhook-x64.exe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_5.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation4.png (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation0.png (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_viewing.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nudge.wav (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_team.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_present.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\uninstall.bat (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_private.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\embedhook-x86.exe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\server.lic (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\cbhook-x64.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_survey.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\spinner.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-5.bmp (61 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (0 bytes)

The process %original file name%.exe:1328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7713 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe (15021 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CwMUAwoY.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CwMUAwoY.bat (0 bytes)

Registry activity

The process fGAwoYMM.exe:304 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 9D 80 8F 87 65 FE 19 BB BD 95 12 83 C6 EF DA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 28 EB BC 3A D6 91 7A AE DF 91 2D 20 8C 1E 5A"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe:844 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 31 67 81 8E 1B F1 31 75 2B BB D9 1F CF AC 2E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso3.tmpspinner-1225160762]
"Start.cmd" = "start"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:1328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 0A FB 84 69 74 29 46 C1 3E B2 1B 1E 8A 69 7A"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process NesIMIQs.exe:1696 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 C3 6C 50 E5 2C BA F9 09 39 80 D3 45 81 C9 C6"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
0df437ec9c66916cc0cab4b943df8052	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
a5d8809a798b263f5336a5dcc15aed61	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
d301081198983ebfffb195fa0cc036ef	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
b49e59291f1c98e52f3fc9242af1b6a6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
fcda57ae9c2d660d9d611c7cb8800657	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
f7728174144fdea813f6d671ad6da06e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
9d7d0885ad0169077cea8ea44ef29273	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
d043ef976b6dadf955efa50109e87958	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
029388a9eef79f5c38319a37c1165a77	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
89f6f414236b4f807b7fedd8360a522e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
f1afa3579a53c98e4627ba423ece59c2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
e9b9d2a12c42fbb7a7760e54ffa3e9ff	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
6110df35a61829a0df2f0f78f98b4eec	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
3841c586eff79161d943cae0be42096e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
ea468b0dbad66f2fb59fe8c19fd5ef5d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
3c4f3986341cdc90d2e57ac7893427d1	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
1f8aaddd234fde4223b5991907aa555c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
647c7d9ded144afc637cdb5a90e0f519	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
2cde892213c044d41349cbf70a1694cd	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
94762bbe28eca5f93c35f8aa0863def8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
3db8168533e712f6b4039da4f21ce036	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
84d57d94f405c35550c04f0bab068bb3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
f4e20ace575f96ca7108b238904a0d64	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
446d4d743d3a99f518c3750aed49e06a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
59861fec91a5367f122c9f8cc5e1438e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
898981f520631ceccee371a0ff9d15a4	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
4a2c0d57001e8c4df6ea0536f613a251	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
b76460854d1927f38f5b560a7600a4b0	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
e4c4087771984da17ba0027d59b4162a	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
10a8daa37485a7f83c44b990d76e7a2d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
f4315c5563a0ecd21e91e3ffb5e30859	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
6a668e6788719f236bbc40deb44bf895	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
4cd579dcf00968f98802e99138766365	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
ecff30e8f776354c8de2471f3ae619e2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe
3ba4110ae5388089dff30ec6ec0f2862	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\bomgar-scc.exe
561f76f6437316bcc6b1fa69f731409b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\cbhook-x64.dll
3fb1496874bc9c962c6db704bffae297	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\cbhook-x86.dll
c11f47a41561cb50f252306bebbe5045	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\embedhook-x64.exe
ff06a1f424e69389b1f30922fb1bf66c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\embedhook-x86.exe
69a0f3dd8abad983d5d70dba949b2273	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\nstvhk64.dll
7a292a9ad7b55414c773af4bc4cc6697	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\nstvhook.dll
f94f97f6a562c3730ec1cc16f3843fbd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\nstvstub.exe
70eb017f48df535b62fa67cf283e74ba	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\remove.exe
0d176fb9734387d13f94be9f8671bfed	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\sas.dll
2cbade0eee3af7c839c2a1fe414e4458	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\spinner.exe
92d8f17df1cf78c11797514f75b0dc6a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpb\winrtpxy.dll
2cbade0eee3af7c839c2a1fe414e4458	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner.exe
e28efc1a2ed6e1343fd2fde9f9aa7473	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
d52699b04b4e1074115c0fdc55e491b6	c:\Perl\eg\IEExamples\ie_animated.gif.exe
93c7c8cbca42e60ff32b1c3c48df319a	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
41daecc7e829a907a8d79d426808dc1a	c:\Perl\eg\aspSamples\ASbanner.gif.exe
29022c5e49cd89a88b7e31427d07877e	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
e69108f3353a8a68240e6083db7168d3	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
eee728e3d497471be41943bb52b7991c	c:\Perl\html\images\AS_logo.gif.exe
5dd400dc29b9c0322561b89ed4459325	c:\Perl\html\images\PerlCritic_run.png.exe
70e6da5aeeefeb592646109e7e081ade	c:\Perl\html\images\aslogo.gif.exe
130aa1509ccd08824688f731f51ddd29	c:\Perl\html\images\ppm_gui.png.exe
b6d26353da23978b7a106d5c13ef5a56	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
481dc26a4b851725928710b80ce037ea	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
35c73c1caa05981fff13c6a8b9d878eb	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
52c10a2dc9055e7e35c8aaf168a787d4	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
19e526f982372d2ac6cbdfed41b59ba3	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
6c626fa79acae9c43d26cf1a8184aec3	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
ef90d891c3e72c676a4bc5f998e8e082	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
62281c636307a524fea6871496eba5f0	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
cef3ee45b75c9db7a674c7d144f0d45d	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
04012f79b0f7d948a2ce8040e289b0a5	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
80b2b768280990efa0ef19e028935dae	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
522fd89bdb03087974c7ab8e18850168	c:\totalcmd\TCMADMIN.EXE.exe
ae4db98726347bd682d9c34ddedc17ef	c:\totalcmd\TCMDX32.EXE.exe
c5d195ca3fbeb116962c59e1219c51b2	c:\totalcmd\TCUNINST.EXE.exe
fc51a6912045450f7e4583d73bb8001e	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe:844
%original file name%.exe:1328
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\sas.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-2.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\preload-en-us.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\start-cb-hook.bat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\start.cmd (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvhk64.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_access_key.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\app_icon_16.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_collapsed.png (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_expanded.png (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation2.png (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_1.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_2.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (172672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_sidebar_alert.png (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_pinned_disconnected.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_3.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner.exe (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_actual_size.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality8.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\bomgar-scc.exe (259304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\settings-init.ini (695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_4.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_pinned_connected.png (777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ss_watermark.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\stop-cb-hook.bat.template (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\BF13227E-B446-4E12-913E-7E5FBBEE54F6 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_fit.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_not_present.png (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-1.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvhook.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\remove.exe (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\pinuninstall.bat (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation3.png (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation1.png (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\cbhook-x86.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-3.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-4.bmp (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\icon_exclamation.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nstvstub.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\winrtpxy.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_panic.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\app_icon_32.png (725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\embedhook-x64.exe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\startup_animation_5.bmp (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation4.png (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_ft_animation0.png (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_viewing.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\nudge.wav (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_team.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\indicator_rep_present.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\uninstall.bat (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_private.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\embedhook-x86.exe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\server.lic (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\cbhook-x64.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_cb_survey.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\button_viewer_quality32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpb\spinner.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmpspinner-1225160762\spinner-5.bmp (61 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7713 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bomgar-scc-w0yc306y87jw5fi8x6w5z1i6g8gj1z7ddgihzzc40jc90.exe (15021 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CwMUAwoY.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	3293184	3291648	5.53425	690a9ab02a6b900886fd87338148bf76
.rdata	3297280	4096	512	2.12799	22346b41efff823df6cf7e2f48d8d1fa
.data	3301376	3	512	0.042395	cf15ae654da72da373d03ca3b8695c23
.rsrc	3305472	4444	4608	2.7249	2bebf34426c7d4551de5e9c37d564156

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.113.197

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=KbAJVZaEEOqk8wev7oCoCg

Content-Length: 262

Date: Wed, 18 Mar 2015 17:04:41 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=KbAJVZaEEOqk8wev7oCoCg">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=KbAJVZaEEOqk8wev7oCoCg..Content-Length: 262..Date: Wed, 18 Mar 2015 17:04:41 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=KbAJVZaEEOqk8wev7oCoCg">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J7AJVc68Duuk8we9s4G4Cg

Content-Length: 262

Date: Wed, 18 Mar 2015 17:04:39 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J7AJVc68Duuk8we9s4G4Cg">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J7AJVc68Duuk8we9s4G4Cg..Content-Length: 262..Date: Wed, 18 Mar 2015 17:04:39 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=J7AJVc68Duuk8we9s4G4Cg">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_304:

.text

.rdata

@.data

7.qU6

TNcMdI

vND.LOrg

.eH^\

w|.LV

QfC%d

dW0WaZ@%di

O%%Sg

[%dZr

l}9fT{

E!.Lg:

\D.vY

m.TpM

.WYky?

?%sn6

.wbK3

Am%foEW

%d[k#

k[w[.dx

Ho%sd^

.pgVM

.XU\:

.TU:67Y[

mre%s

Rx.AF{-F

.dA}R

9zE46}GF{-A}d8

Rx.AMb

Rx.AJ

Vy-A}y1

]~]{:&]{>

Mr.0M8.wM

F@%uF

5@.FJ

r|M-

9Q2.QD

s]{>EkAC.AZ?

]mYS_;-h}_/

%s>Ab

GcMd

7FZZZZ%

&aTF{-A}d8

Rx.AZu`\Vb)

Rx.AN~2

Rx.AF z

x.ASs)

Rx.AF{-6s z

]sc.Pu

).KQ>6V

yT%FZ

d?%x1

u2S.cp

~%m"%U

R.BFX7

.Cd"w

/1:,*-.1

#k%U,

:EW.yY

%cMV=

hC%x}7

.Gl^z

>fAd:%U

.cW a

]{.iA8

8=d0,.eJ

KV.eb

.CYf?a8

=Btcp

Mf.Ax

eZ.Ax

J>.eO

.eO=7)RA2

Microsoft Windows

lZ_.XZ>

7.cYZ

D/%XZ

=.KXZ

4n2I.ZZ

F.yZZ

h|8.XZ

ntdll.dll

user32.dll

kernel32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global 3 is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

fGAwoYMM.exe_304_rwx_00401000_000EA000: