Trojan.GenericKD.2182622_b1f71f2424 – Adaware

Trojan.MSIL.Kryptik.clv (Kaspersky), Trojan.GenericKD.2182622 (B) (Emsisoft), Trojan.GenericKD.2182622 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: b1f71f242489b282d8dbc2634cc70340

SHA1: 8c98ed4990a0ed48a12b90c47f2c00b722245fa1

SHA256: 474fd209cd31c2e8ce7e9688253c0f85ceddd127206423f83376b9642a49df94

SSDeep: 24576:PjICAOwBqdgEEKCqeE2OVhM e3QJ5rdGRR50uDJ0gIjFr7Hly/cmjGakvvZdb3T/:LICp25hOVhrkJQ8CaHqXPZu0dw8

Size: 1744560 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: StdLib

Created at: 2015-02-23 08:58:13

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

vbc.exe:2168
vbc.exe:2500
%original file name%.exe:856

The Trojan injects its code into the following process(es):

%original file name%.exe:1140

Mutexes

The following mutexes were created/opened:

ShimCacheMutexRasPbFile

File activity

The process vbc.exe:2168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)

The process vbc.exe:2500 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)

The process %original file name%.exe:856 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C0AF5F80AA0D55CA55AD4471DD73D761 (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\140B4CDED8ED877CDC65B54BA965BD39 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39 (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\0AE1A896B17983DA2D3F15114E2248F0 (7 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C0AF5F80AA0D55CA55AD4471DD73D761 (168 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\0AE1A896B17983DA2D3F15114E2248F0 (184 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process %original file name%.exe:1140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (11518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (39 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

Registry activity

The process vbc.exe:2168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 46 54 CC F8 4A 35 2B 62 28 10 68 ED C4 78 E0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process vbc.exe:2500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 8A F7 74 CA AC 7B 13 C9 37 81 33 CD F2 84 E5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 9E 5F AB 29 26 9C F5 D8 5D 1F 9E ED 6E 9D 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 6D 00 C0 25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"

The process %original file name%.exe:1140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\b1f71f242489b282d8dbc2634cc70340\DEBUG]
"Trace Level" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB D1 41 B2 24 0A 1C D9 B8 FC C4 AE 12 BA 35 7F"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\b1f71f242489b282d8dbc2634cc70340\DEBUG]
"Trace Level"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
vbc.exe:2168
vbc.exe:2500
%original file name%.exe:856
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C0AF5F80AA0D55CA55AD4471DD73D761 (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\140B4CDED8ED877CDC65B54BA965BD39 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\140B4CDED8ED877CDC65B54BA965BD39 (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\0AE1A896B17983DA2D3F15114E2248F0 (7 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C0AF5F80AA0D55CA55AD4471DD73D761 (168 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\0AE1A896B17983DA2D3F15114E2248F0 (184 bytes)
%Documents and Settings%\%current user%\Application Data\pid.txt (4 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (11518 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (39 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: SSH, Telnet and Rlogin client
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: SSH, Telnet and Rlogin clientComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	1734772	1735168	4.04154	65c2aac9aa9f30b952965e0703f31a5e
.rsrc	1744896	2360	2560	3.54763	b81e00ade0bf54d96e708e8a47450b86
.reloc	1753088	12	512	0.070639	90bebabdc542bfd46bf35c38fc7d3685

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.startssl.com/sfsca.crt	192.116.242.20
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://www.startssl.com/sfsca.crl	192.116.242.20
hxxp://a1603.g1.akamai.net/sfsca.crl
hxxp://a1603.g1.akamai.net/crtc2-crl.crl
hxxp://whatismyipaddress.com/	66.171.248.172
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	194.146.191.105
hxxp://crl.startssl.com/crtc2-crl.crl	194.146.191.113
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	194.146.191.105
hxxp://crl.startssl.com/sfsca.crl	194.146.191.113
mail.frezija.lt	5.199.161.25

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /sfsca.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.startssl.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 301 Moved Permanently

Date: Mon, 16 Mar 2015 06:33:43 GMT

Server: Apache/2.2.3 (StartCom)

Location: hXXp://crl.startssl.com/sfsca.crl

Cache-Control: max-age=3600

Expires: Mon, 16 Mar 2015 07:33:43 GMT

Content-Length: 324

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="hXXp://crl.startssl.com/sfsca.crl">here</a>.</p>.<hr>.<address>Apache/2.2.3 (StartCom) Server at VVV.startssl.com Port 80</address>.</body></html>...

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 16 Mar 2015 06:33:47 GMT

Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.30 mod_ssl/2.2.26 OpenSSL/0.9.8zc

Set-Cookie: pt=b7ed52fc979c579a2bae260856828015; expires=Tue, 17-Mar-2015 06:33:47 GMT

Cache-Control: max-age=15

MS-Author-Via: DAV

Vary: Accept-Encoding

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

20b2..<!doctype html>.<html lang="en">.<head>..<meta charset="windows-1252">..<meta name="robots" content="noarchive">..<title>What Is My IP Address? IP Address Tools and More</title>..<meta name="description" content="IP address lookup, location, proxy detection, email tracing, IP hiding tips, blacklist check, speed test, and forums. Find, get, and show my IP address.">..<meta name="keywords" content="my ip ,ip, address, adress, my, what, is, find, get, show, locate, change, location, how, do, i, ip address, proxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer, anonymize, changer, privacy, geolocation, geolocate, lookup, look up, locate, trace, track, email, source, headers">..<meta property="fb:admins" content="607824267"/>..<link rel="shortcut icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<link rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress.com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://plus.google.com/ whatismyipaddress">..<link rel="canonical" href="http://whatismyipaddress.com">..<link rel="alternate" hreflang="fr" href="hXXp://whatismyipaddress.com/fr/mon-ip">..<link rel="alternate" hreflang="de" href="hXXp://whatismyipaddress.com/de/meine-ip">..<link rel="alternate" hreflang="es" href="hXXp://whatismyipaddress.com/es/mi-ip">..<link rel="alternate" hreflang="tr" href="hXXp://whatismyipaddress.com/tr/ip-im">..<link rel="alternat

<<< skipped >>>

GET /sfsca.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.startssl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 16 Mar 2015 06:33:42 GMT

Server: Apache/2.2.3 (StartCom)

Last-Modified: Thu, 30 Nov 2006 01:24:01 GMT

ETag: "33d800-7cd-bcfd4e40"

Accept-Ranges: bytes

Content-Length: 1997

Cache-Control: max-age=2592000, must-revalidate

Expires: Wed, 15 Apr 2015 06:32:27 GMT

Age: 77

Connection: close

Content-Type: application/x509-ca-cert

0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0.."0...*.H.............0.............lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.......,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.........`.g:........r".................\R<...*s......`.z/...n.&0.....W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U........0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.startcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startcom.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.pdf0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at hXXp://cert.startcom.org/policy.pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[

<<< skipped >>>

GET /sfsca.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.startssl.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache/2.2.3 (StartCom)

Last-Modified: Mon, 16 Mar 2015 05:49:09 GMT

ETag: "5bd2c4-319-5116168a99f40"

Accept-Ranges: bytes

Content-Length: 793

Content-Type: application/pkcs7-crl

Cache-Control: must-revalidate, max-age=129600

Date: Mon, 16 Mar 2015 06:33:42 GMT

Connection: keep-alive

0...0..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority..150204005149Z..160204005149Z0P0.../..110319055235Z0...0..110319055246Z0...1..110401065531Z0...2..110401065546Z0...*.H.............6Sx...nz]#..D8%.R...zUk.q..1...d.:}R.%..?..%....!..y..6....T j ..T...MV..y[x.Q..*.k<.IG...^.....q9....\p.@....w..[........x..4......Y..g..m...-_s...N.....,....s.r.....&t..[E.Y..E....Zw....f...`....}2.... J.d".po<...#.......@..[q../,...UQ..E'..].. .i..4...0.....2...."&...be.}.Kb:...b....`.Q.&.....4..).....BA..Z)M........pMs..X.QgDn........}...).].%.m.9..s...NSNp6!.pT..`q...|.b...9V.....[..Q..v1,[@......wrX..r..].....D.h.7.j....@....#..*.H9..Z.7.....%...g....? .....,..sF..2u.UW.....QA...) .hZ.v........N......HTTP/1.1 200 OK..Server: Apache/2.2.3 (StartCom)..Last-Modified: Mon, 16 Mar 2015 05:49:09 GMT..ETag: "5bd2c4-319-5116168a99f40"..Accept-Ranges: bytes..Content-Length: 793..Content-Type: application/pkcs7-crl..Cache-Control: must-revalidate, max-age=129600..Date: Mon, 16 Mar 2015 06:33:42 GMT..Connection: keep-alive..0...0..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority..150204005149Z..160204005149Z0P0.../..110319055235Z0...0..110319055246Z0...1..110401065531Z0...2..110401065546Z0...*.H.............6Sx...nz]#..D8%.R...zUk.q..1...d.:}R.%..?..%....!..y..6....T j ..T...MV..y[x.Q..*.k<.IG...^.....q9....\p.@....w..[........x..4......Y.

<<< skipped >>>

GET /crtc2-crl.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.startssl.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache/2.2.3 (StartCom)

Last-Modified: Mon, 16 Mar 2015 06:09:07 GMT

ETag: "5bd217-1d87-51161b011a6c0"

Accept-Ranges: bytes

Content-Length: 7559

Content-Type: application/pkcs7-crl

Cache-Control: must-revalidate, max-age=129600

Date: Mon, 16 Mar 2015 06:33:42 GMT

Connection: keep-alive

0...0..k0...*.H........0..1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1806..U.../StartCom Class 2 Primary Intermediate Object CA..150316040118Z..150318040118Z0...0.......110426144123Z0....#..121011154918Z0....'..130115123251Z0....0..110513055152Z0....5..110514221542Z0....<..120202190303Z0....?..110612164411Z0....H..110524174533Z0....M..110525135627Z0....Q..110526122223Z0....X..110528132951Z0....j..120521121756Z0....k..130131212953Z0....m..110606150725Z0....{..110626121016Z0.......110626164106Z0.......110630125628Z0.......110715041302Z0.......120906180517Z0.......120223174425Z0.......110729115950Z0.......110728073104Z0.......110820070200Z0.......110827205122Z0.......120603111003Z0.......111103054758Z0.......120309112446Z0.......110902055536Z0.......130128152836Z0.......111204194653Z0.......110918192658Z0....'..110928203537Z0....0..111001160758Z0....:..111005000857Z0....G..111010163704Z0....J..111010063053Z0....Q..111012170744Z0....T..111013193603Z0....f..130307214128Z0....o..130722075734Z0....v..111101212259Z0.......111117230515Z0.......120624221138Z0.......111117183940Z0.......111120051327Z0.......120321203417Z0.......130716141444Z0.......111127231344Z0.......120428103802Z0.......120106143551Z0.......131011093051Z0.......120125144515Z0.......120125134731Z0.......120125223201Z0.......120131140451Z0....2..120209143717Z0....E..120416205239Z0....J..120608093908Z0....O..120313125510Z0....T..120228105714Z0....[..120228174821Z0....`..120522140615Z0....h..120306062015Z0....j..12

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT

Accept-Ranges: bytes

ETag: "05934e1494dd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Cache-Control: max-age=13816

Date: Mon, 16 Mar 2015 06:33:41 GMT

Connection: keep-alive

X-CCC: GR

X-CID: 2

1401D04D49E16F8687....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Feb 2015 00:36:45 GMT

Accept-Ranges: bytes

ETag: "804c50f7c94fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 49859

Cache-Control: max-age=6840

Date: Mon, 16 Mar 2015 06:33:41 GMT

Connection: keep-alive

X-CCC: GR

X-CID: 2

MSCF............,...................I.......#.........WFw. .authroot.stl.....08..CK...<.......m..dK.......D.d'....fW...RJe.).."...n.Ie.,E.RH...L....\...z.^...p.<g.9...~...=.d/.. ...H....8f|&x.N.d..p(....(....g.@ga0..4...E(.p`d. .....D.....g%.j..w.DF..GW .....*.@6....#.8....v..=T..^.G.G.!.A........_...r..3n...G.g\_.r.....Au..sw.3.....G.f. ..0..0.^.R".K|.....y...l..1.......t.(...0Y......4.,......x..ENY.`d..O.....!..9A~....^...H.2.-.jK.r.....m.q.....5.@.r...@....A.B.....e...x.).|.H...A.[.Q. D`.}YQvx.B`b.=....,X...-.5S..N..=x.....C.Mj^.H....5b...5........I...`..... ..l.n.:.....j...u2gA.hx.`%K.bw...\!o.........R....=..*...w..J....q.?^.PuA..W...>.._..O......9|.../......m.E.u.d...J2.U.e?....}h.S.zC^...<.c)...^c.b}.2..'X567.!.h. ......5.......S*.z%..%..e...R...C#p..k.[...3...jI.<.Z.GX.u.- ....ut{.&>...:.......f...f.)y.....5.../R.b.......r.!.4.-a.....!...P......Q'7.0.%[.~m_..v....;..:.X..~...,.......O....u|T.L....w....)5.bBs..W..r..u.......W......'G......y...h.. %. z?..............f.Nx./c...R...`..y.>....'......l=.O..#......... ..P..Q.......3.............M......%...v.:(...u..zU......G_.<ue...F.....6Xo......P.......@L#........4<....K.g:...3o.N..:..zb...5..,.5...C... .4..`Q0.....$9./.$1....WL)$.0F......^..k..D.*.#.L3. (}.,,.kd.<W.....[,.....Y.n.b.....4.Y)...c.g..`.y.........X..I? '.{Cb.GDh.d..F..2B...sT.^..!.L..}.P....C...?.......~.....d....5.j...1.y9^_K..g..pX.......^z.e)....yc......?..o...e......KJ..H.O..m......B27....?.~m ..xt...c...@b..S.......a(....f1...h.0.u4..(.........2b`....]..H.Ja..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1140:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

`.rdata

@.data

.rsrc

%UUUU3

tcPW

-4-4--567

%s%2.2X

Browser Password Dump

%s v%s by SecurityXploded

hXXp://securityxploded.com/browser-password-dump.php

BrowserPasswordDump

%s.exe [-h | -f ]

//Dump login passwords from all the Browsers to console

%s.exe

//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'

%s.exe -f "c:\passlist.txt"

%s.exe -h

pstorec.dll

http:/

https:/

abe2869f-9b47-4cd9-a358-c22904dba7f7

hXXps://%s

hXXp://%s

Cannot close vault. Error (%d)

Web Data

select * from logins where blacklisted_by_user=0;

\MapleStudio\ChromePlus\User Data\Default\

\Google\Chrome SxS\User Data\Default\

\Google\Chrome\User Data\Default\

Opera\Opera\

Opera\Opera\profile\

wand.dat

account

passwords

data

server

%s\Safari\Apple Application Support\plutil.exe

%s\Apple\Apple Application Support\plutil.exe

%s\%s\keychain.plist

%skeytest.tmp

"%s" -convert xml1 -s -o "%s" "%s"

Google Chrome

Opera Browser

Firefox

Chrome SXS

SeaMonkey

Browser: %s

Website: %s

Username: %s

Password: %s

vaultcli.dll

Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path

Browser Password Recovery Report

Website URL

Password

Produced by %s from hXXp://VVV.SecurityXploded.com

Tip: For more options type %s.exe -h

This is command-line application. Kindly Run it from the CMD Prompt

Press any key to exit....

SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

Mozilla\SeaMonkey

Mozilla\Firefox

\profiles.ini

select * from moz_logins;

/signons.txt

/signons2.txt

/signons3.txt

\signons.sqlite

nss3.dll

PK11_GetInternalKeySlot

PK11_CheckUserPassword

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

3.6.16

sqlite_version

RowKey

SQL logic error or missing database

large file support is disabled

sqlite_detach

sqlite_attach

d-d-d d:d:d

d:d:d

d-d-d

922337203685477580

%s\etilqs_

OsError 0x%x (%u)

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

sqlite3BtreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in header on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmented space is %d byte reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

%s-mjX

unable to use function %s in the requested context

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

database table is locked: %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

cannot open indexed column for writing

cannot open value of type %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

misuse of aggregate: %s()

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_trigger

%s OR name=%Q

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

SELECT idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

TABLE %s

%s AS %s

%s WITH INDEX %s

%s VIA MULTI-INDEX UNION

%s USING PRIMARY KEY

%s VIRTUAL TABLE INDEX %d:%s

%s ORDER BY

unable to close due to unfinished backup operation

no such vfs: %s

GetProcessWindowStation

operator

GetProcessHeap

KERNEL32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

CRYPT32.dll

GetCPInfo

OLEAUT32.dll

zcÃ

kernel32.dll

\StringFileInfo\xx\%s

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe

outlook.exe

msimn.exe

%Program Files%\Microsoft Office\Office\Outlook.exe

Email Password Dump

hXXp://securityxploded.com/email-password-dump.php

EmailPasswordDump

//Dump all the Email passwords to console

//Dump all the Email passwords to a file "c:\passlist.txt"

\.purple\accounts.xml

%s\%s

@gmail.com

@yahoo.com

Software\Paltalk\%s

Software\Google\Google Talk\Accounts\%s

Microsoft_WinInet_VVV.google.com:443

%sMiranda_Mirror_%d.bin

LoginPassword

LoginName

LoginServer

gmail.com

%s\%s\%s.dat

pop3password=

esmtpaccount=

esmtppassword=

smtphost=

SmtpPassword

ESMTPAccountKey

c:\Program Files\Foxmail\mail

%s\%s\Account.stg

%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat

PopPassword

SmtpAccount

SmtpServer

%s\%s\Accounts

%s\%s\Accounts\%s

Mozilla Thunderbird

Windows Live Mail

Windows Credential Manager

Application:%s

Email ID: %s

WindowsLive:name=*

Software\Microsoft\Windows Live Mail

hXXps://

00000050

.oeaccount

Software\Microsoft\IdentityCRL\Creds\%s

ps:password

Email Password Recovery Report

Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com

SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command

kpstorec.dll

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417e2d75-84bd-11d0-84bb-00c04fd43f8f

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

IMAP Password

IMAP Port

POP3 Password

POP3 Port

SMTP User

SMTP Password

SMTP Server

SMTP Port

HTTP User

HTTP Password

HTTP Server URL

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows Messaging Subsystem\Profiles

%s\%s\%s

%s\%s\%s\%s

SMTP Email Address

IMAP Password2

POP3 Password2

SMTP User Name

SMTP Password2

HTTPMail User Name

HTTPMail Password2

HTTPMail Server

LDAP Password2

Specified master password "%s" is wrong. Please try again with correct password

GetWindowsDirectoryA

RegEnumKeyExA

USERENV.dll

VERSION.dll

RPCRT4.dll

v2.0.50727

Stub.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

System.Xml

tapi32.dll

rtm.dll

user32.dll

ntdll.dll

Crypt32.dll

Stub.Form1.resources

Stub.Resources.resources

Stub.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.ctor

.cctor

System.Diagnostics

System.Threading

System.Runtime.CompilerServices

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

System.Reflection

ContainsKey

InvalidOperationException

MyWebServices

System.Runtime.InteropServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

fakeMSGholder

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

StealPasswords

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

System.Security

ProcessHandle

Stub.My.Resources

System.Resources

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

GoogleChrome

MozillaFirefox

loadCerts

FTPCommander

System.Text.RegularExpressions

WindowsKey

SQLite

SQLDataTypeSize

sqlite_master_entry

sql_statement

Passwords

PasswordSource

FtpCommander

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

12.0.0.0

My.Settings

$3e46a124-e015-4b12-9390-f16ac4d7ad53

1.0.0.0

_CorExeMain

mscoree.dll

{3C374A40-BAE4-11CF-BF7D-00AA006946EE}

{AFA0DC11-C313-11D0-831A-00C04FD5AE38}

hXXp://

Hmscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

Fkernel32.dll

USER32.DLL

hXXp://VVV.facebook.com/

hXXps://VVV.facebook.com/

hXXp://twitter.com/

hXXps://twitter.com/

hXXps://login.yahoo.com/config/login

hXXps://pinterest.com/login/

hXXp://VVV.linkedin.com/

hXXps://my.screenname.aol.com/_cqr/login/login.psp

hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153

hXXps://signin.ebay.com/ws/ebayisapi.dll

hXXps://accounts.google.com/servicelogin

hXXps://VVV.google.com/accounts/servicelogin

hXXp://digg.com

hXXp://VVV.myspace.com

hXXps://myspace.com

hXXps://VVV.amazon.com/gp/css/homepage.html

hXXp://VVV.stumbleupon.com/sign_up.php

hXXp://slashdot.org/bookmark.pl

hXXp://VVV.reddit.com/login

1200000

noftp

MessageBoxIcon.Information

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

MessageBoxIcon.Error

MessageBoxIcon.Exclamation

MessageBoxIcon.Question

Dear HawkEye Customers!

HawkEye Admin

HawkEye Logger Details

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

Dear HawkEye Customer!

This is a notification generated by

after successful injection of your server.

Best Regards
HawkEye Admin

************************************************************
HawkEye Keylogger's Detail
************************************************************
Server Name:

Keylogger Enabled:

Operating System:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

HawkEye_Keylogger_Recoveries_

HawkEye Keylogger | Recoveries |

****************************************************
Operating System Intel Recovery
****************************************************
PC Name:

Operating System Platform:

Operating System Version:

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Recoveries |

Dear HawkEye Customer!

HawkEye Keylogger | BitCoin Recoveries |

As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Recoveries |

As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keyboard

Keyboard Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

PTF://

HawkEye Keylogger | Keyboard Clipboards Records |

**************************************
Keyboard Records
**************************************

hXXp://192.99.212.64/WebPanel/log.php?username=

hXXp://whatismyipaddress.com/

Stub.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\Google\Chrome\User Data\Default\Login Data

logins

origin_url

password_value

moz_logins

formSubmitURL

encryptedPassword

\Mozilla Firefox\

mozglue.dll

\sitemanager.xml

\recentservers.xml

;Server=(?.*?);Port=(?.*?);Password=(?.*?);User=(?.*?);

port

password

C:\cftp\Ftplist.txt

\cftp\Ftplist.txt

\FTP Commander Deluxe\Ftplist.txt

password = (?.*?)

hXXp://dyn.com/dns/

\Dyn\Updater\daemon.cfg

\Dyn\Updater\config.dyndns

hXXps://VVV.noip.com/

CKey

SOFTWARE\Microsoft\Windows NT\CurrentVersion

%original file name%.exe_1140_rwx_00400000_00122000: