Trojan.Generic.1632854_e3c9d930fa

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:464

The Trojan injects its code into the following process(es):

rundll32.exe:1504

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rundll32.exe:1504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\drivers\etc\hosts (25 bytes)

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\gvsxrto.dll (169 bytes)

Registry activity

The process rundll32.exe:1504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B E0 B2 FC BB 34 4E D9 CF 90 84 09 5A CE E5 80"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
"(Default)" = "%System%\gvsxrto.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"DCOM Server 20509" = "{2C1CD3D7-86AC-4068-93BC-A02304B20509}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B20509}" = "DCOM Server 20509"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"DCOM Server"

Dropped PE files

MD5	File path
deea3b710b9d023f4092f50663246b9d	c:\WINDOWS\system32\gvsxrto.dll

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1698 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.trendmicro.com
127.0.0.1	rads.mcafee.com
127.0.0.1	customer.symantec.com
127.0.0.1	liveupdate.symantec.com
127.0.0.1	us.mcafee.com
127.0.0.1	updates.symantec.com
127.0.0.1	www.nai.com
127.0.0.1	secure.nai.com
127.0.0.1	dispatch.mcafee.com
127.0.0.1	download.mcafee.com
127.0.0.1	www.my-etrust.com
127.0.0.1	mast.mcafee.com
127.0.0.1	ca.com
127.0.0.1	www.ca.com
127.0.0.1	networkassociates.com
127.0.0.1	www.networkassociates.com
127.0.0.1	avp.com
127.0.0.1	www.kaspersky.com
127.0.0.1	www.avp.com
127.0.0.1	downloads4.kaspersky-labs.com
127.0.0.1	downloads3.kaspersky-labs.com
127.0.0.1	downloads2.kaspersky-labs.com
127.0.0.1	downloads1.kaspersky-labs.com
127.0.0.1	www.f-secure.com
127.0.0.1	viruslist.com
127.0.0.1	www.viruslist.com
127.0.0.1	liveupdate.symantecliveupdate.com
127.0.0.1	www.mcafee.com
127.0.0.1	sophos.com
127.0.0.1	www.sophos.com
127.0.0.1	securityresponse.symantec.com
127.0.0.1	www.symantec.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:464

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %System%\drivers\etc\hosts (25 bytes)
   %System%\gvsxrto.dll (169 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	24677	28672	4.29127	6ab331ba1fe7a9988a12d998db095986
.rdata	32768	2586	4096	2.72913	602bd63ca0ee43c0f08f17d299e6ef7e
.data	36864	179288	176128	5.49787	cf3c3f9e29f5431eba024084ac274321

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rundll32.exe_1504:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

rundll32.exe_1504_rwx_10001000_00D2B000:

.tTPV

.tTPV

^}•xy

^}•xy

FTPjK

FTPjK

FtPj;

FtPj;

F.PjRWj

F.PjRWj

u.WWj

u.WWj

u.VVj

u.VVj

portuguese-brazilian

portuguese-brazilian

user32.dll

user32.dll

zcÁ

zcÁ

- '%s'.

- '%s'.

GIF-LIB undefined error %d.

GIF-LIB undefined error %d.

GIF-LIB error: %s.

GIF-LIB error: %s.

%s: Null entry in quantized color map - that's weird.

%s: Null entry in quantized color map - that's weird.

GET /last2.php?id=%d HTTP/1.1

GET /last2.php?id=%d HTTP/1.1

Host: %s

Host: %s

EXCEPTION: addr=0xx, code=0xx; maindll base: 0xx, parent base: 0xx

EXCEPTION: addr=0xx, code=0xx; maindll base: 0xx, parent base: 0xx

ERROR: check_files failed (code %d)

ERROR: check_files failed (code %d)

ERROR: get_data_info failed (code %d)

ERROR: get_data_info failed (code %d)

ERROR: download_data failed (code %d)

ERROR: download_data failed (code %d)

NOTE: downloading %s

NOTE: downloading %s

hXXp://%s/%s

hXXp://%s/%s

NOTE: bases are ok (age: %d)

NOTE: bases are ok (age: %d)

maindll.dll

maindll.dll

riched20.dll

riched20.dll

81.95.148.188

81.95.148.188

66.197.156.5

66.197.156.5

81.95.149.10

81.95.149.10

81.95.149.2

81.95.149.2

65.111.175.129

65.111.175.129

%u.%u.%u.%u.IN-ADDR.ARPA

%u.%u.%u.%u.IN-ADDR.ARPA

PIPELINING

PIPELINING

EHLO %s

EHLO %s

HELO %s

HELO %s

RCPT TO:

RCPT TO:

MAIL FROM:

MAIL FROM:

aol.com

aol.com

verizon.net

verizon.net

ameritech.net

ameritech.net

cox.net

cox.net

rr.com

rr.com

adelphia.net

adelphia.net

comcast.net

comcast.net

optonline.net

optonline.net

=X

=X

[%d-%d]

[%d-%d]

NUMBER(%d-%d)

NUMBER(%d-%d)

STR_RNDLEN(%d-%d)

STR_RNDLEN(%d-%d)