Gen.Variant.Kazy.1750_a5f5785c10 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.1750 (B) (Emsisoft), Gen:Variant.Kazy.1750 (AdAware), ZeroAccess.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a5f5785c10c675631715d357a5cfc858

SHA1: 7257374498e1bec5b08155dad2b3cc34bddce226

SHA256: 6ee0dcd04047b4ee72874027c8644a2cba0bf2a8730a6c34a03df1030d832bce

SSDeep: 24576:EWMl9ebI2gXNd2ih/lSY7elaMFOgIM7MFYw SNzbetmFb3EYe78OoAkdj:Z4dyC/YHaMPIM7MF51zatmx3e7Xg

Size: 1048064 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-02-07 11:53:36

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1116

The Trojan injects its code into the following process(es):

fGAwoYMM.exe:172
reIEcoQI.exe:1532
NesIMIQs.exe:368

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:172 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:1116 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7785 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\airappinstaller.exe (54 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\togwUkoI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\togwUkoI.bat (0 bytes)

Registry activity

The process fGAwoYMM.exe:172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 FA CB AF 43 24 8A 61 FC 37 63 11 95 D9 2F 6D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:1532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 59 F4 FF 79 09 64 8E 94 58 E2 B3 D6 6A 7C B7"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process %original file name%.exe:1116 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 7E 57 A2 BC D5 93 E3 39 86 B6 EC 9B EE 65 21"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process NesIMIQs.exe:368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 77 26 D0 72 F3 37 D6 96 EB 16 23 44 36 5A FD"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
489da5a9c5e7ffb24a571bf6b43a6feb	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
1b8541cda8c6f9099df8c615899f3610	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
3c5f8d07e01ecddf70e08d93ef0e00b9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
12da91268c52aac7801080f40c26d5d9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
0a6f7c220b70e0df25bf8df61c1ea5d5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
6a37648c7025430cb61a3a21ad1f80ee	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
61d1a830fece3cf7bc05c96d66bfb80e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
b9572630ece0a0b5d918fd4632fde019	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
0dbbd2dfd7972b133edf5a6ffb32ab28	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
de42daea27c284c1375274d39aa4433e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
dec9294a97b312d41a087d96cf5c40bc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
784c84d9c11601e1f96f160dc856706e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
a3a45710351c55a6790aab0a46c4703e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
13d518deaae4675015665c43e4fc3743	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
1d359cc25021875f44f00b3504a7a97c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
2a46e15b25237b248d5c0174daa72a58	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
6bcf027bfe32fc83834cdc8c222d0ccb	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
e4c6f77ea5c7a8a9f0770adabbf647c9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
6f1ba44e08ecd493247a987cc72bec9d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
c45b1593df76ff83296f8442ef849df8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
ed8135484df5f83c3939c61d66eb35f6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
fe6f83cd6e1cc43acff28c45abea8270	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
a1a54174e9e157b9b62982833d9caee3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
8ca581dbffdbfb8962b7f34f5992b18a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
985946d13c06e212c1eac315f1607439	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
4ad90f946cacf114163ed458bb09a8a0	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
0f65edc5176b43dbaf6b913b2d72ccdb	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
a00a1cbd1da55715dac5800f7a33bde4	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
e1e1d93037e538caf8e13dcbbc698f03	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
75a87a7790fc8d53a21eb13dc81f977e	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
932205716ea67b1ed4813b84b5ecb12e	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
3850c5442dccf1c75a74f53325d9d2b8	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
f1384f94fa181755526474c9a9470a0d	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
f1546e6359715c3a87273760a935be8d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\airappinstaller.exe
ed6ac6ab7c1e63231fdf072b00322b7e	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
7cb81f7d881af675f87905c1949ca1a8	c:\Perl\eg\IEExamples\ie_animated.gif.exe
bd3521000e7572d1dc8b84d94fe8dfe6	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
9d2620dabcdb1d30b09317f76788b107	c:\Perl\eg\aspSamples\ASbanner.gif.exe
68f22c3a0438318e7e0d4a5cf70d2e71	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
caa0e0bea0e13aa6d3cbb4d3394828c5	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
d6eafe7685e1a45188d4c273a490d948	c:\Perl\html\images\AS_logo.gif.exe
c1d36ac3a0e846e37ec8465797cde33c	c:\Perl\html\images\PerlCritic_run.png.exe
a3ceb5642d2da2d07b4a5d6ae0508c8f	c:\Perl\html\images\aslogo.gif.exe
dba368357ec31e4a77573b23b2fdc9c3	c:\Perl\html\images\ppm_gui.png.exe
b3fcb0f3475b63b47b432ba6a7b97482	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
b264f8c223e4aa8d078d2c112f2357c3	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
00f20961304a43cbfd7fb3efc0ad69ac	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
4d1e75f758aab63fd9dc725797ef896d	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
7ab9c11ad0b860849961d9e56c7f5c8e	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
2ff43acac970fa7102feb382b4257cb4	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
4176180a2dcbd812bd4a943db8985ece	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
10700142f48d468d8e43e1d1e3102af5	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
b2f472142085209fc7d4d29a4a1d2f30	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
81821d1d423f284be829b379a9309a8c	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
95df8517647c7c99a79e80f98533ddf8	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
30da4fa10afc7581e7b9ddcabc3791bb	c:\totalcmd\TCMADMIN.EXE.exe
449c6526a840664d2cd5a10922f5b05e	c:\totalcmd\TCMDX32.EXE.exe
7dae5a72b7e1e6cd8884daf2110a9bc5	c:\totalcmd\TCUNINST.EXE.exe
4b26c0b5e4ec364a8025bc8a90629abd	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1116
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7785 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\airappinstaller.exe (54 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\togwUkoI.bat (4 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1044480	1043968	5.4707	7949a0ce97ee53b66fa1692019854cac
.rdata	1048576	4096	512	2.02235	f5342982db76db739311e8ffb70df087
.data	1052672	5	512	0.070639	28cada0d81a5e8b623746c81588d56a0
.rsrc	1056768	1372	1536	2.2015	a877c57c2100c35dbdfe9db54083a876

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.113.193

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r4IVYTXFMOk8wfyqID4BA

Content-Length: 262

Date: Tue, 17 Mar 2015 23:55:06 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r4IVYTXFMOk8wfyqID4BA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2r4IVYTXFMOk8wfyqID4BA..Content-Length: 262..Date: Tue, 17 Mar 2015 23:55:06 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=2r4IVYTXFMOk8wfyqID4BA">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2b4IVaGLI8uk8we7tIGQAw

Content-Length: 262

Date: Tue, 17 Mar 2015 23:55:05 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2b4IVaGLI8uk8we7tIGQAw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=2b4IVaGLI8uk8we7tIGQAw..Content-Length: 262..Date: Tue, 17 Mar 2015 23:55:05 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=2b4IVaGLI8uk8we7tIGQAw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_172:

.text

.rdata

@.data

7.qU6

TNcMdI

vND.LOrg

.eH^\

w|.LV

QfC%d

dW0WaZ@%di

O%%Sg

[%dZr

l}9fT{

E!.Lg:

\D.vY

m.TpM

.WYky?

?%sn6

.wbK3

Am%foEW

%d[k#

k[w[.dx

Ho%sd^

.pgVM

.XU\:

.TU:67Y[

mre%s

Rx.AF{-F

.dA}R

9zE46}GF{-A}d8

Rx.AMb

Rx.AJ

Vy-A}y1

]~]{:&]{>

Mr.0M8.wM

F@%uF

5@.FJ

r|M-

9Q2.QD

s]{>EkAC.AZ?

]mYS_;-h}_/

%s>Ab

GcMd

7FZZZZ%

&aTF{-A}d8

Rx.AZu`\Vb)

Rx.AN~2

Rx.AF z

x.ASs)

Rx.AF{-6s z

]sc.Pu

).KQ>6V

yT%FZ

d?%x1

u2S.cp

~%m"%U

R.BFX7

.Cd"w

/1:,*-.1

#k%U,

:EW.yY

%cMV=

hC%x}7

.Gl^z

>fAd:%U

.cW a

]{.iA8

8=d0,.eJ

KV.eb

.CYf?a8

=Btcp

L#%C?

Microsoft Windows

oleaut32.dll

ntdll.dll

kernel32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global 3 is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

fGAwoYMM.exe_172_rwx_00401000_000EA000: