Skip to main content

Gen.Variant.Symmi.5363_f4d056f12e


HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Symmi.5363 (B) (Emsisoft), Gen:Variant.Symmi.5363 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: f4d056f12ec2e405a27b4c7226248f7e

SHA1: acdd87ff378b5f2e0d505d331ace59f14d06f51d

SHA256: 2b355c0a3f75c50b90076f8d7a1ab22424a94c2506ae86f3288c7ddb47519a47

SSDeep: 1536:dBOQugTGG3VaO2u8Z68vvWfhoBQ3Ob4lhlwLkgpYEtDLonouy8:/OQuIGG3Qy8Z68vvMTheLkg9DMout

Size: 1080832 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: no certificate found

Created at: 2011-07-26 08:31:19

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

MD5 File path
fd8bd221f53eeed97073a68b37a16e6dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
7805e5fd154a06c713fe9c6e3d4f02c9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\{018045A8-6104-43FF-B749-0E3F8766D8CA}\fpb.tmp
87a49bdb8cc20c34e735f2383d55ba8ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\{5E929924-F22A-4960-A0EE-FC487A6C136C}\InstallFlashPlayer.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 23831 bytes in size. The following strings are added to the hosts file listed below:

184.168.105.79viabcp.com
184.168.105.79www.viabcp.com
184.168.105.79bcpzonasegura.viabcp.com
184.168.105.79bn.com.pe
184.168.105.79www.bn.com.pe
184.168.105.79zonasegura1.bn.com.pe
184.168.105.79bbvabancocontinental.com
184.168.105.79www.bbvabancocontinental.com
184.168.105.79peb1.bbvanetlatam.com
184.168.105.79www.peb1.bbvanetlatam.com
184.168.105.79scotiabank.com.pe
184.168.105.79www.scotiabank.com.pe
184.168.105.79scotiaenlinea.scotiabank.com.pe
74.63.223.176www.colmena.com.co
74.63.223.176colmena.com.co
74.63.223.176www.bancocajasocial.com.co
74.63.223.176bancocajasocial.com.co
74.63.223.176www.colpatria.com
74.63.223.176colpatria.com
74.63.237.36www.citibank.com.pe
74.63.237.36citibank.com.pe
204.197.241.82bancoguayaquil.com
204.197.241.82www.bancoguayaquil.com
204.197.241.82www.personas.santanderrio.com.ar
204.197.241.82personas.santanderrio.com.ar
204.197.241.82www.santanderrio.com.ar
204.197.241.82santanderrio.com.ar
204.197.241.82www.mibanco.com.pe
204.197.241.82mibanco.com.pe
5.239.183.28iniciorapido.info
237.191.3.54www.iniciorapido.info
226.224.161.94buscalo.in
228.82.144.214www.buscalo.in
123.209.139.159buscafacil.com
31.228.216.186www.buscafacil.com
20.5.117.225emsisoft.com
90.119.100.157ahnlab.com
173.246.95.103antivir.es
149.198.172.61antiy.net
138.230.74.168authentium.com
140.88.244.33avast.com
35.27.52.234avg.com
199.235.128.192bitdefender.com
188.12.30.43quickheal.com
2.125.200.164clamav.net
86.252.8.109comodo.com
250.16.84.135drweb.com
239.49.242.175aladdin.com
53.163.157.39ca.com
204.34.220.240f-prot.com
112.241.41.11f-secure.com
101.86.198.50fortinet.com
171.132.113.170gdata.es
254.71.176.116ikarus.at
162.23.253.142jiangmin.com
151.55.155.181kaspersky.com
221.169.69.114mcafee.com
116.108.133.247microsoft.com
24.60.209.17eset.es
13.93.111.124norman.com
83.206.25.245nprotect.com
166.77.89.190pandasecurity.com
75.97.165.148pctools.com
64.130.255.0prevx.com
134.176.238.120rising-global.com
217.115.233.65sophos.com
193.66.122.92sunbeltsoftware.com
182.99.211.131symantec.com
184.213.194.251hacksoft.com.pe
79.152.189.197trendmicro.com
243.104.78.223anti-virus.by
232.136.168.6hauri.net
46.250.150.127virusbuster.hu
129.121.146.72www.emsisoft.com
105.141.222.98www.ahnlab.com
94.174.124.137www.antivir.es
96.219.106.2www.antiy.net
247.158.102.203www.authentium.com
156.110.178.229www.avast.com
145.143.80.81www.avg.com
215.1.63.201www.bitdefender.com
42.196.58.146www.quickheal.com
206.147.135.105www.clamav.net
195.180.36.212www.comodo.com
9.38.19.76www.drweb.com
160.165.14.22www.aladdin.com
68.185.91.236www.ca.com
57.217.249.87www.f-prot.com
127.75.231.208www.f-secure.com
210.202.227.153www.fortinet.com
118.154.47.179www.gdata.es
107.187.205.218www.ikarus.at
177.44.187.83www.jiangmin.com
5.239.183.28www.kaspersky.com
237.191.3.54www.mcafee.com
226.224.161.94www.microsoft.com
228.82.144.214www.eset.es
123.209.139.159www.norman.com
31.228.216.186www.nprotect.com
20.5.117.225www.pandasecurity.com
90.119.100.157www.pctools.com
173.246.95.103www.prevx.com
149.198.172.61www.rising-global.com
138.230.74.168www.sophos.com
140.88.244.33www.sunbeltsoftware.com
35.27.52.234www.symantec.com
199.235.128.192www.hacksoft.com.pe
188.12.30.43www.trendmicro.com
2.125.200.164www.anti-virus.by
86.252.8.109www.hauri.net
250.16.84.135www.virusbuster.hu
239.49.242.175www.emsisoft.com
53.163.157.39www.anti-trojan.net
204.34.220.240malwarescan.emsisoft.com
112.241.41.11forum.emsisoft.com
101.86.198.50www.emsisoft.net
171.132.113.170www.emsisoft.it
254.71.176.116www.emsisoft.de
162.23.253.142www.anti-trojan-software.net
151.55.155.181mamutu.com
221.169.69.114www.emsisoft.es
84.76.101.215malwarescan.emsisoft.de
248.28.177.241ww.emsisoft.com
237.61.79.93www.emsisoft.fr
52.175.249.213www.emsisoft.nl
135.45.57.158onlinecheck.emsisoft.com
43.65.134.116onlinecheck.emsisoft.de
32.98.223.224www.emsisoft.org
102.144.206.88scan.anti-trojan.net
185.83.201.33www.trojaner.info
161.34.90.60onlinecheck.emsisoft.org
150.67.179.99onlinecheck.emsisoft.net
152.181.162.219blitzblank.com
47.120.158.165www.emsisoft.at
211.72.46.191www.emsisoft.jp
200.105.136.230www.mamutu.com
14.218.118.95malwarescan.emsisoft.es
97.89.114.40www.mamutu.de
73.109.190.66download5.emsisoft.com
62.142.92.106download1.emsisoft.com
65.188.74.226download4.emsisoft.com
216.126.70.171global.ahnlab.com
124.78.147.197www.hackshields.com
113.111.48.49www.internationalservicecheck.com
183.225.31.169www.irangoals.com
10.164.26.114ixomodels.com
174.115.103.73www.indielisboa.com
163.148.4.180www.latin-mass-society.org
233.6.243.44www.arpia.be
128.133.238.246www.owen.org
36.153.59.204www.prdouglas.co.uk
25.186.217.55www.zarya.info
95.43.199.176www.willsee.com
178.170.195.121halmapr.com
86.122.15.147karuna-shechen.org
75.155.173.187www.barder.com
146.13.155.51www.antivir.es
229.207.151.252www.buraka.tv
205.159.228.22www.dr-bull.com
194.192.129.62www.manchester-offices.co.uk
196.50.112.182saverssite.com
91.177.107.127canada.karuna-shechen.org
255.196.184.154developmentdrums.org
244.229.85.193www.imddomains.co.uk
58.87.68.125cutlines.org
141.214.63.71elblogdemanu.com
117.166.140.29ruben.bzin.net
106.199.42.136welkam.co.jp
108.56.212.1www.cambridge-steiner-school.co.uk
3.251.20.202naturesimages.net
167.203.96.160www.1stavenuelimousines.co.uk
156.236.254.12www.mtr-design.com
227.94.168.132dev.depeuter.org
54.220.232.77www.emeraldclassic.co.uk
218.240.53.103www.peterhearnwaste.co.uk
207.17.210.143etrr.co.uk
21.131.125.7www.avoncourt.com
172.2.188.208sarahmcconnellphotography.net
80.209.9.235www.ixomodels.com
69.54.166.18natsko.com
139.100.81.138www.nottinghampoetryseries.com
222.39.144.84www.sheffieldmind.co.uk
130.247.221.110ixostore.ixomodels.com
119.24.123.149www.flairweddings.co.uk
189.137.37.82www.fimasys.com
84.76.101.215cohartuk.com
248.28.177.241qqjkw.net
237.61.79.93vivo-austin.com
52.175.249.213www.freeality.com
135.45.57.158bestofewan.com
43.65.134.116www.handwritingforkids.com
127.194.63.64cowsmo.com
197.240.45.184www.2xlgames.com
25.178.41.129kimzimmer.net
1.130.186.155basetendencies.com
246.163.19.195trackingtheworld.com
248.21.2.59www.reviewsofbooks.com
143.216.253.4www.collectedcurios.com
51.167.142.31www.renningers.com
40.200.231.70ccslaughterspdx.com
110.58.214.190www.briarhurst.com
193.185.209.136www.smf.org
169.205.30.162ribbonwarehouse.com
158.237.188.201www.garryowen.com
160.27.170.6645pounds.com
55.222.166.11isotopecomics.com
219.174.242.37roysephotos.com
208.207.144.145www.stadiumpage.com
22.65.126.9www.elvis-express.com
106.3.122.210www.tomorrowsedge.net
14.211.199.168www.beautybar.com
3.244.100.20pineleafboys.com
73.102.83.140www.mountainlakeslodge.com
4.9.114.121pvtc.org
168.28.191.80bhsbees.com
157.61.92.187baristamagazine.com
227.175.75.51www.gokidding.com
54.46.71.253defalcos.com
218.254.147.23www.celticmerchant.com
207.31.49.62www.hxproduction.com
21.144.31.183www.wellgousa.com
104.83.27.128blog.titanium-jewelry.com
80.35.103.154www.brightoctober.com
70.68.5.194hishomeforchildren.com
72.182.243.58www.phoenixtrikeworks.com
223.52.239.3www.professorbeyer.com
131.72.60.30www.secondchanceboxer.com
120.105.217.69www.residentphotography.com
190.219.200.1woottonfootball.com
17.90.195.202www.deborahshelton.net
249.42.16.161bobbondart.com
238.74.173.12www.authentium.com
240.188.88.132asap.authentium.com
135.127.152.78www.authentium.com.au
43.79.228.36avast.com
32.112.130.143www.avast.com
102.225.44.8files.avast.com
185.96.108.209download535.avast.com
93.116.184.235avg.com
83.149.86.19www.avg.com
153.7.0.139grisoft.com
48.133.64.84www.grisoft.com
212.85.141.111antivirus-tools.com
201.186.42.150archive.bitdefender.com
15.232.213.14avx.rob-have.net
98.171.20.215b-have.orgbitdefender-ar.com
6.123.97.242bitdefender.com
251.155.254.25bitdefender.org
65.13.169.213bitdefenderchina.com
216.208.233.91bitdefenderguatemala.com
124.160.53.117bitdefendermalaysia.com
113.193.211.224bitdefendertaiwan.com
183.50.125.89bitdefenderuruguay.com
10.177.189.34bitdefenderusa.com
174.197.9.248buy.bitdefender-es.com
164.230.99.100buy.bitdefender.com
234.20.81.220buy.bitdefender.de
61.214.77.165de.bitdefender.com
37.166.222.192fr.bitdefender.com
26.199.55.231futurenow.bitdefender.com
28.57.38.95it.bitdefender.com
179.252.33.40jobs.bitdefender.com
87.203.178.67kb.bitdefender.com
76.236.11.106kb.bitdefender.de
146.94.250.226kb.bitdefender.us
229.221.246.172latin.bitdefender.com
205.241.66.198linux.bitdefender.com
194.18.224.237malwarecity.com
196.63.206.102malwarecity.netmalwarecity.org
91.2.202.47malwarepedia.com
255.210.22.73neunet.orgnews.bitdefender.com
245.243.180.181nl.bitdefender.com
59.101.162.45renewals.bitdefender.com
142.39.158.246sales.bitdefender.com
50.247.235.205square.bitdefender.com
39.24.136.56store.bitdefender.com
109.138.119.176store.de.bitdefender.com
4.9.114.121us.bitdefender.com
168.28.191.80virusscanonline.net
157.61.92.187wedoantivirus.com
227.175.75.51www.antivirus-tools.com
54.46.71.253www.avx.ro
218.254.147.23www.bit-defender.de
207.31.49.62www.bitdefende.de
21.144.31.183www.bitdefender-es.com
104.83.27.128www.bitdefender.be
80.35.103.154www.bitdefender.cl
70.68.5.194www.bitdefender.co.uk
72.182.243.58www.bitdefender.com
223.52.239.3www.bitdefender.com.au
131.72.60.30www.bitdefender.com.sg
120.105.217.69www.bitdefender.com.tw
190.219.200.1www.bitdefender.com.vn
17.90.195.202www.bitdefender.de
249.42.16.161www.bitdefender.es
238.74.173.12www.bitdefender.fr
240.188.88.132www.bitdefender.hk
135.127.152.78www.bitdefender.us
43.79.228.36www.bitdefenderme.com
32.112.130.143www.malwarecity.com
102.225.44.8www.malwarecity.fr
185.96.108.209quickheal.com
120.143.211.6www.quickheal.com
110.176.113.46www.clamav.net
180.34.27.166cgi.clamav.net
75.160.91.111lurker.clamav.net
239.112.168.138wwws.clamav.net
228.213.69.177lists.clamav.net
42.3.240.41bugs.clamav.net
125.198.47.242system-cleaner.comodo.com
33.149.124.13backup.comodo.com
22.182.25.52www.comodoantispam.com
92.40.196.240easy-vpn.comodo.com
243.235.4.118www.trustlogo.com
151.187.80.144ztl.comodo.com
140.220.238.251www.livepcsupport.com
210.77.152.116www.whichssl.com
37.204.216.61www.trustix.com
201.224.36.19disk-encryption.comodo.com
190.1.126.127speedtest.comodo.com
5.47.108.247www.contentverification.com
88.241.104.192idauthority.com
64.193.249.219www.comodo.tv
53.226.82.2online-backup.comodo.com
55.84.65.122www.testmypcsecurity.com
206.23.60.67www.ccssforum.org
114.230.173.62i-vault.comodo.com
71.231.7.101internetsecurity.comodo.com
141.89.245.221www.comodopartners.com
224.216.241.167timestamp.comodoca.com
200.236.61.193secure-email.comodo.com
189.13.219.232timestamp.wosign.com
191.58.201.97rover800.gaima.co.uk
86.253.197.42www.nsclean.com
251.205.17.68www.contentverification.com
240.238.175.176new-estore.drweb.com
54.96.158.40support.drweb.com
137.35.153.241pda.drweb.com
45.242.230.200updates.drweb.com
34.19.131.51drweb.com
104.133.114.171vms.drweb.com
255.4.109.117solutions.drweb.com
163.24.186.75news.drweb.com
152.56.87.182my.drweb.com
222.170.70.46buy.drweb.com
49.41.66.248products.drweb.com
213.249.142.18new-support.drweb.com
202.26.44.57promotions.drweb.com
16.139.26.178network.drweb.com
99.78.22.123customers.drweb.com
76.30.98.149store.drweb.com
65.63.0.189company.drweb.com
67.177.239.53training.drweb.com
218.48.234.254license.drweb.com
221.163.150.120cureit.ru
211.196.52.160free.drweb.com
25.54.35.92info.drweb.com
108.180.30.37new-partners.drweb.com
84.132.107.252drweb.net
73.165.8.103new-company.drweb.com
75.23.179.223new-beta.drweb.com
226.218.242.169new-forum.drweb.com
134.170.63.127secure.av-desk.com
123.202.220.234www.av-desk.com
193.60.135.98new-solutions.drweb.com
20.187.199.44new-www.drweb.com
184.207.19.70www.freedrweb.ru
173.240.177.109daniloff.net
243.97.91.230drweb-inside.com
138.224.155.175drwebinside.com
46.176.231.201aladdin.com
36.21.133.241alladdin.ru
106.67.48.105chickensroamfree.com
157.230.79.18ealaddin.net
65.181.156.45ealaddin.orgeshop.aladdin.com
54.214.57.84secureme.com
124.72.228.16www.aks.com
19.11.35.150www.aladdin.com
183.219.112.176www.ealaddin.com
172.251.14.27www.ealaddin.com
242.109.184.148auwww.ealaddin.nl
69.236.248.93www.esafe.com
233.0.68.51www.hasp.se
222.33.158.158www.safenet-inc.com
36.79.140.23www3.safenet-inc.com
216.114.232.65www.ca.com
192.66.121.91cacomvip.ca.com
181.98.211.130www.netegrity.com
183.212.193.251search.ca.com
78.151.189.196cai.com
242.103.77.222www.f-prot.com
231.136.167.5frisk-software.com
45.249.149.126www.frisk.is
97.88.113.39www.frisk-software.com
73.108.190.65f-secure.com
62.141.91.105f-secure.frf-secure.hk
64.187.74.225f-secure.nlfsecure.com
215.126.69.170fsecure.nlwebyard.com
123.77.146.197www.f-secure.com
112.110.47.48www.fsecure.com
182.224.30.168www.virus.fi
9.163.25.114fortihero.com
173.115.102.72fortilog.com
162.148.4.19fortinet.co.at
72.101.82.139fortinet.com
223.228.77.85fortiprotect.com
131.248.154.43fortiwifi.com
120.24.56.150www.apsecure.com
190.138.38.15www.fortifed.com
17.9.34.216www.fortiid.com
181.217.110.242www.fortimail.com
170.250.12.26www.fortinet-apac.com
21.144.30.182www.fortinet.ch
104.82.26.127www.fortinet.co.il
80.34.103.154www.fortinet.com
69.67.4.193www.fortinet.com
71.181.243.57arwww.fortinet.cz
222.52.238.2www.fortinet.net
130.71.59.29www.fortinet.nl
119.104.216.68www.fortinet.sg
189.218.199.0www.fortinetuk.com
16.89.195.202www.secure-elements.com
248.41.15.160gdata.es
237.74.173.11www.gdata.es
13.217.117.162ikarus.at
164.156.181.107www.ikarus.at
72.108.1.65global.jiangmin.com
61.141.159.173jiangmin.com.cn
132.255.73.37jiangmin.com
215.125.137.238www.jiangmin.com.cn
123.145.214.9www.kaspersky.com
112.178.115.48forum.kaspersky.com
150.4.254.136support.kaspersky.co
45.131.61.82usa.kaspersky.com
209.83.138.108brazil.kaspersky.com
198.183.39.147latam.kaspersky.com
12.229.210.11kaspersky.com
95.168.18.213me.kaspersky.com
3.120.94.239images.kaspersky.com
248.153.252.22www.mcafee.com
62.10.166.211support.mcafee.com
213.205.230.88msr.mcafee.com
122.157.50.114home.mcafee.com
111.190.48.61networkassociates.com
20.143.218.182us.mcafee.com
103.14.26.127tr.mcafee.com
11.34.102.85au.mcafee.com
1.67.192.193mx.mcafee.com
71.113.175.57networkassociates.nai.com
154.51.170.2go.mcafee.com
130.3.59.253fr.mcafee.com
87.4.116.36uk.mcafee.com
89.118.99.156de.mcafee.com
240.57.94.102obscgi.mcafee.com
148.9.239.128nai.com
137.41.73.167www.entercept.com
207.155.55.32jp.mcafee.com
34.26.51.233mcafeeb2b.com
10.46.127.3cn.mcafee.com
255.79.29.42service.mcafee.com
1.125.11.163br.mcafee.com
153.63.7.108www.mcafee.at
61.15.84.134mcafeeretail.com
146.144.82.82it.mcafee.com
216.2.64.203tw.mcafee.com
43.197.60.148privacy.microsoft.com
207.149.136.106tempuri.org
196.182.38.213schemas.xmlsoap.org
10.39.20.78www.microsoft.com
161.166.16.247specs.xmlsoap.org
38.154.61.205www.eugrantsadvisor.ie
27.187.218.57schemas.microsoft.com
97.45.201.177encarta.msn.com
180.172.196.122www.sysinternals.com
88.123.17.149grv.microsoft.com
77.156.174.188www.xmlsoap.org
147.14.157.52www.eugrantsadvisor.se
230.209.152.254www.eugrantsadvisor.com
206.161.229.24research.microsoft.com
195.194.226.159www.engyro.com
37.147.209.23www.exchangeyourcareer.com
188.18.204.225www.eugrantsadvisor.de
96.38.25.251exchangeyourcareer.net
85.70.183.34eugrantsadvisor.de
155.184.165.223eugrantsadvisor.cz
238.55.161.168www.eset.es
214.7.237.126demos.eset.es
240.76.175.14descargas.eset.es
242.190.89.134blogs.protegerse.com
137.128.153.79eos.eset.es
45.80.230.38pedidos.protegerse.com
34.113.131.145reg-int.nod32-es.com
104.227.46.9reg.eset.es
187.98.109.210vicentevirtual.com
95.117.186.237cou85.com
84.150.87.20www.norman.com
154.8.2.140fsc.norman.com
49.135.66.86nprobeta.norman.com
213.87.142.112register.norman.com
202.188.44.151webadmin.norman.no
16.233.214.16sandbox.norman.com
99.172.22.217www.nprotect.com
7.124.98.243global.nprotect.com
253.157.0.27www.nprotect.co.kr
67.15.170.215www.npin.co.kr
218.209.234.92siren24.nprotect.com
126.161.55.11915660808.co.kr
115.194.212.226biz.nprotect.com
212.79.154.117nprotect.net
39.206.217.62www.nprotect.com.br
203.225.38.21liveprotect.net
192.2.127.128nprotect.seoul.go.kr
6.48.110.248chollian.nprotect.co.kr
89.243.106.194www.pandasecurity.com
65.195.250.220research.pandasecurity.com
54.228.84.3support.pandasecurity.com
56.85.66.124pandalabs.pandasecurity.com
207.24.62.69pandasecurity.com
115.232.206.95mop.pandasecurity.com
104.9.40.135timeforyourbusi.pandasecurity.com
175.123.22.255cybercrime.pandasecurity.com
2.249.18.200free.pandasecurity.com
234.13.95.227cloudprotection.pandasecurity.com
223.46.252.10shop.pandasecurity.com
225.92.235.130soporte.pandasecurity.com
120.31.230.75together.pctools.com
28.238.51.102www.prevx.com
17.15.208.209info.prevx.com
87.129.191.73free.prevx.com
170.68.187.19spywarefiles.prevx.com
78.20.7.233spywaredlls.prevx.com
35.21.133.52shield.prevx.com
105.134.115.173www.prevx1.com
0.5.111.118howsafeismypc.com
165.25.187.76www.retento.com
154.58.89.184www.freerav.com
224.172.72.48www.rising-global.com
51.43.67.249www.risingav.com.au
215.250.144.20support.rising-global.com
204.27.45.59superboy2010.com.au
18.141.28.179www.sophos.com
101.80.23.125feeds.sophos.com
77.32.100.151esp.sophos.com
66.64.1.190cn.sophos.com
68.178.240.54tw.sophos.com
219.49.236.0kr.sophos.com
127.69.56.26sophos.com
116.102.214.65podcasts.sophos.com
186.215.196.254www.sunbeltsoftware.com
13.86.192.199go.sunbeltsoftware.com
246.38.12.157oem.sunbeltsoftware.com
235.71.170.9antispam.sunbeltsoftware.com
237.185.85.129antispyware.sunbeltsoftware.com
132.124.148.74antivirus.sunbeltsoftware.com
40.75.225.33sunbeltsoftware.com
29.108.126.140shop.sunbeltsoftware.com
99.222.41.4live.sunbeltsoftware.com
182.93.104.206firewall.sunbeltsoftware.com
90.113.181.232www.symantec.com
79.145.82.15security.symantec.com
149.3.253.135securityrespons.symantec.com
44.130.61.81service1.symantec.com
48.178.233.203enterprisesecur.symantec.com
37.22.134.242eval.symantec.com
107.68.49.106symantec.com
190.7.113.52definitions.symantec.com
98.215.189.78investor.symantec.com
87.248.91.117et.symantec.com
157.105.5.50sfdoccentral.symantec.com
52.44.69.183servicenews.symantec.com
216.252.145.209securityrespons.symantec.com
206.29.47.61sea.symantec.com
20.143.218.181go.symantec.com
103.13.25.126dell.symantec.com
11.33.102.85sun.symantec.com
0.66.191.192marian.symantec.com
70.112.174.56tms.symantec.com
153.51.169.2securitycheck.symantec.com
129.3.58.28smallbiz.symantec.com
118.35.147.67www.symantec.com
120.149.130.187visualtracking.symantec.com
15.88.126.133search.symantec.com
179.40.14.159liveupdate.symantec.com
168.73.104.198sitedirector.symantec.com
238.186.86.63edm.symantec.com
65.57.82.8hostedmailsecur.symantec.com
41.77.158.34www4.symantec.com
255.78.28.42education.symantec.com
1.124.11.162vos.symantec.com
152.63.6.107www.hacksoft.com.pe
60.14.83.134hacksoft.pe
49.47.240.241www.hacksoft.pe
119.161.223.105housecall.trendmicro.com
202.100.218.51www.trendmicro.com
110.52.39.9housecall65.trendmicro.com
99.84.197.116us.trendmicro.com
169.198.179.237blog.trendmicro.com
64.69.175.182emea.trendmicro.com
228.89.251.140housecall60.trendmicro.com
217.122.153.247jp.trendmicro.com
31.236.135.112de.trendmicro.com
115.106.131.57it.trendmicro.com
23.58.207.83itw.trendmicro.com
108.187.206.219esupport.trendmicro.com
178.45.188.84es.trendmicro.com
5.240.184.29br.trendmicro.com
237.192.4.55tw.trendmicro.com
226.225.162.94la.trendmicro.com
228.82.144.215uk.trendmicro.com
123.209.140.160ru.trendmicro.com
32.229.216.186smbstore.trendmicro.com
21.6.118.226apac.trendmicro.com
91.120.101.158store.trendmicro.com
174.247.96.103training.trendmicro.com
150.198.173.62trial.trendmicro.com
139.231.74.169ushousecall02.trendmicro.com
141.89.245.33subwiz.trendmicro.com
36.28.52.235go.trendmicro.com
200.236.129.193feeds.trendmicro.com
189.12.31.44channelpartner.trendmicro.com
3.126.201.165wtc.trendmicro.com
86.253.9.110shop.trendmicro.com
250.17.85.136fr.trendmicro.com
239.50.243.175threatinfo.trendmicro.com
53.163.157.40newsletters.trendmicro.com
204.34.221.241www.anti-virus.by
113.242.41.11bg.virusblokada.com
102.87.199.51www.vba.com.by
172.133.114.171beta.anti-virus.by
255.72.177.116www.bg.virusblokada.com
163.23.254.143www.hauri.net
152.56.155.150www.hauri.co.kr
190.138.38.82company.hauri.net
85.77.101.216www.globalhauri.com
249.29.178.242shop.hauri.co.kr
238.62.80.93hauri.co.kr
52.175.250.214pg.hauri.net
135.46.58.159esecurity.livecall.co.kr
43.66.134.117mall.hauri.co.kr
32.99.224.225company.hauri.co.kr
103.145.206.89haurijapan.com
186.83.202.34virobot.co.kr
162.35.91.60www.virusbuster.hu
246.164.20.196virusbuster.hu
249.22.2.60scanner.novirusthanks.org
144.216.254.5scanner2.novirusthanks.or
52.168.143.31novirusthanks.org
41.201.232.71www.novirusthanks.org
111.59.215.191virustotal.com
194.186.210.136www.virustotal.com
170.205.31.163virscan.org
159.238.188.202www.virscan.org
161.28.171.66virusscan.jotti.org
56.223.166.12jotti.org
220.175.243.38www.jotti.org
209.207.145.145viruschief.com
23.65.127.10www.viruschief.com
106.4.123.211scanner.virus.org
14.212.199.169virus.org
3.245.101.21www.virus.org
110.139.119.177scan4you.net
5.9.115.122www.scan4you.net
169.29.192.81avhide.com
158.62.93.188www.avhide.com
228.176.76.52anubis.iseclab.org
55.47.71.253iseclab.org
219.255.148.24www.iseclab.org
208.31.49.63threatexpert.com
22.145.32.183www.threatexpert.com
105.84.28.129forospyware.com
81.36.104.155www.forospyware.com
70.69.6.194in.answers.yahoo.com
96.206.12.83es.answers.yahoo.com
247.77.8.28kioskea.net
155.97.84.54www.kioskea.net
144.130.242.94es.kioskea.net
215.244.224.26mygeekside.com
42.114.220.227www.mygeekside.com
18.66.41.186www.tecniservicioslys.com
7.99.198.37tecniservicioslys.com
9.213.113.157virusfreezone.info
160.152.176.102www.virusfreezone.info
68.103.253.61intranet.cidiroax.ipn.mx
57.136.154.168spycheck.es
127.250.69.32www.spycheck.es
210.121.133.234antivirus.hispavista.com
118.141.209.4computing.net
107.174.111.43www.computing.net
177.31.25.164spycheck.co.uk
40.126.57.77www.spycheck.co.uk
205.78.133.103midescargas.com
194.179.35.143www.midescargas.com
8.225.206.7static.yoreparo.com
91.164.13.208softfaq.com
255.115.90.235www.softfaq.com
244.148.247.18configurarequipos.com
58.6.162.206www.configurarequipos.com
209.201.225.84seasonsecurity.com
117.153.46.110www.seasonsecurity.com
106.185.203.217removetrojanvirus.org
176.43.118.81www.removetrojanvirus.org
99.10.21.123ibusca.me
7.30.98.81www.ibusca.me
252.62.187.188busco.in
66.108.170.52www.busco.in
149.47.166.254inicioid.com
125.255.54.24www.inicioid.com


Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Delete the original Trojan file.
  2. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  3. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  4. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
409620070400d41d8cd98f00b204e9800998ecf8427e
20480077824742405.5353d2cef4d41f4f9dd2a9429f5018e34d1a
28262440965122.4457415635006b89365a5a6fc7ac61f19d3c3

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 637
94b4fdbf29e0f8472d11604ca95455c6
4be1a3488fc85a44abdcf8bdb0f58ca2
5971a956598ed43e808e6b336c9f55c7
1567b96a6bc432d19192862d6235511f
6e7494ad1e335a2310e75ff0051e4ce8
2a5ecbf9deb640531a73d088f04a3a0c
e30b8a72d74876ace102eea06185625d
87a235f68f169eea463fa65a763d83a2
ce1e121b286f0915d608e495176f066b
aecbe789e4f0459490eb37f4bd89261d
a26e008fdc8590851a4ad5e30a8a38a2
eb1bd68322332dc1d3196144691f15fd
4f3f6ce7266634ae15529fa088e7497d
ceaf11c9d10291b97314aaff8238eb5f
2151c7eade1087765c716e1c94355773
8fc90024e949008f2c0681ac2246aa6d
ce23eb259f220c9bd4a0fe79c5669ae5
850e58b9ab90172d0d0acc1962d7dd79
a3cf4be1526752d8591859f15733b789
352453eaffb440e084c9b20b19ffee85
6fc9d34ffb3abda4a7d1a82c6b8edf70
0c6be81adddc312409820354979b8b69
0c5aaea1dd8c09fc9a80fa1f2d92d69a
3a115f585549f0c79fa62e514aa7efee
2bb0ac0568540041a3993893028e538e
b78c447744c0bc6e72cb45d49985e7fe

Network Activity

URLs

URL IP
hxxp://www.kuigames.com/templates/indigo/images/main_background.png141.101.118.57
hxxp://www.kuigames.com/games/images/Liberate-the-Angels.jpg141.101.118.57
hxxp:///iframe3?ndFKGzVsXgBZJ6gBAAAAADAAdgAAAAAAAwAAAAAAAAAAAP8AAAAFF3UhkgAAAAAARJMsAAAAAAAzy5EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvjhwAAAAAAAICAwAAgD8AAAAAAAAAAAAAADjQPaGYPwAAAAAAAAAAAAA40D2hqD8AAAAAAAAAAAAA.Po0HLI.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGvptneApSELj9ucrBKETiiMMhk7L8E0CZ69oyAAAAAA==,,http://ads.kuigames.us/pop.html,B=10&H=&M=5&Z=0x0&_salt=2038240574&r=0&s=6188085&y=28,ffa248e4-34a7-11e4-8fe7-3cd92bff92de,1409885688096
hxxp://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&section=6188085&pub_url=${PUB_URL}98.138.49.43
hxxp://www.kuigames.com/games/images/Catchem-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/CycloManiacs-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Red-Fluxion.jpg141.101.118.57
hxxp://sstatic1.histats.com/0.gif?1568213&101208.43.241.181
hxxp://www.kuigames.com/games/images/Starcom.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Crabs-Hunt.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/forums/images/topic_search_button.png141.101.118.57
hxxp://sstatic1.histats.com/0.gif?1568494&101208.43.241.181
hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab207.108.220.195
hxxp://594275355.qseach.com/redir.php192.121.167.58
hxxp://www.kuigames.com/games/images/Zoe-Hand-Doctor.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Platform-Racing-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Polar-PWND-2.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/main_menu.png141.101.118.57
hxxp://584q2ap5o892pv8r7wm64zo363pc8i.ipgreat.com/192.121.167.58
hxxp://ads.yahoo.com/st?ad_type=iframe&ad_size=160x600&section=6188085&pub_url=${PUB_URL}98.138.49.43
hxxp://www.kuigames.com/games/images/Sofia-And-Newborn-Sister.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Orb-Avoidance-2.jpg141.101.118.57
hxxp://ads.kuigames.us/160x600.html104.28.6.118
hxxp://www.kuigames.com/templates/indigo/images/module_heart.png141.101.118.57
hxxp://www.kuigames.com/games/images/CycloManiacs.jpg141.101.118.57
hxxp://ads.yahoo.com/rw?title=&qs=iframe3?ndFKGzVsXgBZJ6gBAAAAADAAdgAAAAAAAwAAAAAAAAAAAP8AAAAFF3UhkgAAAAAARJMsAAAAAAAzy5EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvjhwAAAAAAAICAwAAgD8AAAAAAAAAAAAAADjQPaGYPwAAAAAAAAAAAAA40D2hqD8AAAAAAAAAAAAA.Po0HLI.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGvptneApSELj9ucrBKETiiMMhk7L8E0CZ69oyAAAAAA==,,http%3A%2F%2Fads.kuigames.us%2Fpop.html,B%3D10%26H%3D%26M%3D5%26Z%3D0x0%26_salt%3D2038240574%26r%3D0%26s%3D6188085%26y%3D28,ffa248e4-34a7-11e4-8fe7-3cd92bff92de,140988568809698.138.49.43
hxxp://evcs-crl.ws.symantec.com/evcs.crl23.9.117.163
hxxp://www.kuigames.com/games/images/GhostBall.jpg141.101.118.57
hxxp://ads.yahoo.com/imp?Z=160x600&s=6188085&T=3&_salt=1796922812&B=10&H=http://ads.kuigames.us/160x600.html&u=http://ads.kuigames.us/160x600.html&M=4&r=098.138.49.43
hxxp://www.kuigames.com/games/images/Gravitex-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Warlords-Call-to-Arms.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/module_header.png141.101.118.57
hxxp://www.kuigames.com/games/images/Galaxy-Wars-For-the-Sake-Of-the-Universe.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Fruits-Couple-Dress-Up.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/blank.gif141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/module_user.png141.101.118.57
hxxp://www.kuigames.com/games/images/Zoes-Messy-House.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Zodiac-Reactor.jpg141.101.118.57
hxxp://ads.yahoo.com/imp?Z=468x60&s=6188085&T=3&_salt=4054896393&B=10&H=http://ads.kuigames.us/468x60.html&u=http://ads.kuigames.us/468x60.html&M=4&r=098.138.49.43
hxxp://www.kuigames.com/templates/indigo/images/module_popular.png141.101.118.57
hxxp://ads.kuigames.us/300x250.html104.28.6.118
hxxp://www.kuigames.com/games/images/The-Endless-Drop.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Drift-Runners-2.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/module_star.png141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/home_cat_header.png141.101.118.57
hxxp://252709031.qseach.com/redir.php192.121.167.58
hxxp://c.statcounter.com/7040553/0/edbb565e/1/67.215.253.140
hxxp://www.kuigames.com/templates/indigo/images/searchbox.png141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/logo.png141.101.118.57
hxxp://www.kuigames.com/games/images/Inner-Demon.jpg141.101.118.57
hxxp://www.kuigames.com/uploads/avatars/default.png141.101.118.57
hxxp://www.kuigames.com/games/images/Enigmata-2-Genus-Revenge.jpg141.101.118.57
hxxp://ads.yahoo.com/imp?Z=120x600&s=6188085&T=3&_salt=1166147371&B=10&H=http://ads.kuigames.us/120x600.html&u=http://ads.kuigames.us/120x600.html&M=4&r=098.138.49.43
hxxp://www.kuigames.com/templates/hightek/images/anon.png141.101.118.57
hxxp://www.kuigames.com/games/images/Pyro.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Super-Fishing.jpg141.101.118.57
hxxp://content.yieldmanager.com/ak/p.gif199.117.103.59
hxxp://www.kuigames.com/games/images/Monkey-Talent.jpg141.101.118.57
hxxp://content.yieldmanager.edgesuite.net/atoms/38/3b/c3/5a/383bc35a07d9cef4d21a25cb8636c781.swf?clickTag=http://ads.yahoo.com/clk?3,eJyljdFuwjAMRb-Gt6pKY7cLqvaQAqkQtBtSmBbe2mQkrGSb1LKOff0KVPzAjizfK.tajiDVQMDUCSRIqz3saRohQ6h1HKEOSJqmFAEfWDyNpsGHEav896V9tbN4lX9m.MKiUbXlN666uflndulCwNY1456emRyTzqDm.-D73fWjXXI-WDtnw7OcbYjN7ql855XkUPptv5YFUVJ3hRTHckbwSWZ-LTXupGkKqc7lfElUf798DALXdV8T4BMqhqpMGzang638Wxue2mGCCftJSOg6f.wDgolc6g==,23.67.244.10
hxxp://www.kuigames.com/games/images/Bubblequod-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Sprout.jpg141.101.118.57
hxxp://ads.yahoo.com/get-user-id?ver=2&s=6188085&ts=1409885688&sig=f649a3b6311803b298.138.49.43
hxxp://www.kuigames.com/games/images/Reincarnation--A-Taste-Of-Evil.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Conquerium.jpg141.101.118.57
hxxp://ads.kuigames.us/120x600.html104.28.6.118
hxxp://ads.yahoo.com/get-user-id?ver=2&s=6188085&ts=1409885687&sig=61cb7a3de0b4d59d98.138.49.43
hxxp://ads.yahoo.com/st?ad_type=iframe&ad_size=468x60&section=6188085&pub_url=${PUB_URL}98.138.49.43
hxxp://www.kuigames.com/games/images/Deadly-Neighbours.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Captain-Steelbounce.jpg141.101.118.57
hxxp://ads.yahoo.com/imp?Z=728x90&s=6188085&T=3&_salt=2368955277&B=10&H=http://ads.kuigames.us/728x90.html&u=http://ads.kuigames.us/728x90.html&M=4&r=098.138.49.43
hxxp://www.kuigames.com/141.101.118.57
hxxp://c.statcounter.com/7040548/0/9a85091e/1/67.215.253.140
hxxp://www.kuigames.com/games/images/Blocked-Out.jpg141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/pages_menu_item_border.png141.101.118.57
hxxp://crl.verisign.com/pca3-g5.crl23.7.69.163
hxxp://content.yieldmanager.edgesuite.net/atoms/71/ca/f5/7e/71caf57efe61cc3184a879d13e20aca3.swf?clickTag=http://ads.yahoo.com/clk?3,eJyljWFPwjAQhn8N3-ZypWW0afzQASWTbagpU.nGOumwVElaxPjr3TKiP8Anl8uTuzd3CPOaJGzP9jqZIEZZPeWIUIJrPQHQEXDOxwhNGSEM4ei9kavld-WfTRrIyqaiZ52WjREDF7EQ4mPwe9p3KfGmtdf9413hB5vF-SkT.-Dzrb1cNev.CjOnAhY39AFM-ptabl3pKreebyBXBbwoHQolj-UMHUqX4VxpslWNLVSXeaps-Xf.NoraEE4jLEZj2dWu8bE9H8zOvfr47LsJSuArAYjb4I4.23hdAQ==,23.67.244.10
hxxp://www.kuigames.com/games/images/Sproing-Reloaded.jpg141.101.118.57
hxxp://www.directorio-w.com/192.121.167.58
hxxp://www.kuigames.com/games/images/Cardinal-Quest.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/P.O.D..jpg141.101.118.57
hxxp://content.yieldmanager.edgesuite.net/atoms/5e/5e/48/47/5e5e48471469e5535a6811552a398d35.swf?clickTag=http://ads.yahoo.com/clk?3,eJyljd1ugkAQhZ.GO0pmf6RLNr0A6xKVXWuDtnoHbl0UtjFZLLZPXyjGF-jJ5OTLzJwcRLjOdUGDAtEOWIBDjiijpNjTA0UecM4xC9kjA8RC71OLRfKzce8mdnRRxVGvZay0iQa1vU0HfmG9C0HWZXW7v86lG2jip-dZ9A99ncr2hrO.XvPc9cEDW4GJ71.Jzqpkd1RWQppJ2Gb7RmaiVhMYK7yp00ydVDIdS7sm6k1-b9t78snzyqY5j0g0wqKbXDu.uhxNbj-cf3HdBmG4BgB-2dj6Fz08XPw=,23.67.244.10
hxxp://ads.yahoo.com/imp?Z=0x0&y=28&s=6188085&_salt=2038240574&B=10&H=&u=http://ads.kuigames.us/pop.html&M=5&r=098.138.49.43
hxxp://ads.kuigames.us/468x60.html104.28.6.118
hxxp://ads.yahoo.com/imp?Z=300x250&s=6188085&T=3&_salt=4003166706&B=10&H=http://ads.kuigames.us/300x250.html&u=http://ads.kuigames.us/300x250.html&M=4&r=098.138.49.43
hxxp://180730105.qseach.com/redir.php192.121.167.58
hxxp://ads.yahoo.com/st?ad_type=iframe&ad_size=728x90&section=6188085&pub_url=${PUB_URL}98.138.49.43
hxxp://www.kuigames.com/templates/indigo/images/left_arrow.png141.101.118.57
hxxp://kuigames.com/141.101.118.56
hxxp://www.kuigames.com/templates/indigo/style.css141.101.118.57
hxxp://3e36y22v93d34l85tj4vs012m5r884.ipcheker.com/192.121.167.58
hxxp://www.kuigames.com/games/images/Epic-War-Saga.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Legend-of-the-Void.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Zoe-Animals-Doctor.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Indiana-Jones.jpg141.101.118.57
hxxp://content.yieldmanager.edgesuite.net/atoms/b6/11/29/55/b6112955568fc2e8d1197b57b15f6a43.swf?clickTag=http://ads.yahoo.com/clk?3,eJydjd1ugkAQRp.GO0L2j7LNpheDiCEq1HSlwp0suOC6bROwLX36YrA-QE8mky8n32QwFbViStW-V.oVV0f1IDDjjJbKQwo7SAhBKPN8TJFHnLcqWi1.sm6vIdsTFsCVeJGWXzChYQGQT.mZX3cU0V1j9KTIwOWt-dK-3-T.-Dw1f09jgDHqkEON53yLdHBvLQubhmbIbXFayw3Kpeo3Mjonc9wWr.GwlpVNwhilMjNJGJh8e798cpym7z9mFGYkGudQda65tPpg6869dKPxCf9-RG7T2.MvjvleIA==,23.67.244.10
hxxp://ads.yahoo.com/st?ad_type=iframe&ad_size=120x600&section=6188085&pub_url=${PUB_URL}98.138.49.43
hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab96.17.227.191
hxxp://www.kuigames.com/games/images/Sam-Bike-Accident.jpg141.101.118.57
hxxp://content.yieldmanager.edgesuite.net/flash_activate.js23.67.244.10
hxxp://www.kuigames.com/games/images/Shameless-Clone-2.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Distopix.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Amberial-Nebulosa-Realms.jpg141.101.118.57
hxxp://ads.yahoo.com/imp?Z=300x250&s=6188085&T=3&_salt=3230503250&B=10&H=http://ads.kuigames.us/300x250.html&u=http://ads.kuigames.us/300x250.html&M=4&r=098.138.49.43
hxxp://ads.yahoo.com/st?ad_type=pop&ad_size=0x0&section=6188085&banned_pop_types=28&pop_times=1&pop_frequency=21600&pub_url=${PUB_URL}98.138.49.43
hxxp://www.kuigames.com/games/images/Wigman-Big-Run.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Planet-Juicer.jpg141.101.118.57
hxxp://www.kuigames.com/includes/jquery-1.8.2.js141.101.118.57
hxxp://www.kuigames.com/games/images/Pirate-tresaure.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Wheel-of-Misfortune.jpg141.101.118.57
hxxp://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_cab_ax_sgn.z23.194.155.238
hxxp://ads.kuigames.us/728x90.html104.28.6.118
hxxp://ads.kuigames.us/pop.html104.28.6.118
hxxp://www.kuigames.com/games/images/Heat-Rush-USA.jpg141.101.118.57
hxxp://www.kuigames.com/includes/avarcade.js141.101.118.57
hxxp://www.kuigames.com/games/images/Dungeon-Defender.jpg141.101.118.57
hxxp://content.yieldmanager.edgesuite.net/atoms/6c/0e/12/64/6c0e1264dba660d9b65103bbe5ec3ce6.png23.67.244.10
hxxp://www.kuigames.com/games/images/Baby-Elsa-Skin-Allergy.jpg141.101.118.57
hxxp://www.kuigames.com/games/images/Bubble-Harm.png141.101.118.57
hxxp://www.kuigames.com/templates/indigo/images/right_arrow.png141.101.118.57
hxxp://www.kuigames.com/images/overlay.png141.101.118.57
30324460.qseach.com192.121.167.58
y1263nz903ui77u71n67v05swp4jah.ipcheker.com192.121.167.58

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps


Related articles