Trojan.Agent.BDSY_a23bf1a789 – Adaware

Trojan.Win32.Yakes.ffxp (Kaspersky), Trojan.Agent.BDSY (B) (Emsisoft), Trojan.Agent.BDSY (AdAware)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a23bf1a789fd7f3c72023fc6d658609e

SHA1: 211e32e6a9d254846f6b9b09e5104d235cd54f2e

SHA256: 8768af0f39f4d6bea92aff92576e54115bc0a0d9616a894561a8703d24a3c8e3

SSDeep: 3072:yYh0Va4zYOVLPwSaJLZ2 3rsHutcYTqvki1:V0VaHOVrwSaJiv/

Size: 131072 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: no certificate found

Created at: 2014-06-28 10:03:06

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:856

Mutexes

The following mutexes were created/opened:

2GVWNQJz2

File activity

No files have been created.

Registry activity

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	51900	53248	4.51912	05b38382d813f6263a62c4e1606a35a2
.rdata	57344	6028	8192	3.03538	367bc42138432b9b33a0667e9c1be661
.data	65536	65500	61440	4.19697	9622dcdebf5edc568546a1f7728655dd
.reloc	131072	3676	4096	4.28567	2659dda148e0745907980d19f9eb7dad

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_856:

.text

.reloc

advapi32.dll

Software\Microsoft\Windows NT\CurrentVersion

ntdll.dll

svchost.exe

Software\Microsoft\Windows\CurrentVersion\Run

C:\Users\DmitryHELL\Documents\SysIQUA\loader_1.4 u2\loader_v4\loader_v3\Release\loader_v3.pdb

l.dlf

`.rdata

@.data

http://

http://%[^:]:%d/%s

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

Content-Type: application/x-www-form-urlencoded

24[^=]=24[^;]

/index.php?r=gate

RAW Request Result: %s

%[^:]:%d

%d.%d x%d

wireshark.exe

iptools.exe

TSystemExplorerTrayForm.UnicodeClass

ProcessHacker

99929D61-1338-48B1-9433-D42A1D94F0D2-x64

99929D61-1338-48B1-9433-D42A1D94F0D2-x32

99929D61-1338-48B1-9433-D42A1D94F0D2

vmtoolsd.exe

prl_cc.exe

prl_tools.exe

SharedIntApp.exe

VBoxTray.exe

VBoxService.exe

vmusrvc.exe

vmsrvc.exe

GetProcessHeap

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

RegEnumKeyExA

RegOpenKeyA

RegCreateKeyA

RegDeleteKeyA

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

WININET.dll

MSVCRT.dll

CryptImportPublicKeyInfo

CRYPT32.dll

dll.dll

C:\Users\DmitryHELL\Documents\SysIQUA\loader_1.4 u2\loader_v4\loader_v3\Release\dll.pdb

>y-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

1.0.6, 6-Sept-2010

4)4;4]4{4

8€8x8

3!3 363<3><pre>c:\%original file name%.exe</pre><b>%original file name%.exe_856_rwx_00400000_00016000:</b><pre>.text</pre><pre>.reloc</pre><pre>advapi32.dll</pre><pre>Software\Microsoft\Windows NT\CurrentVersion</pre><pre>ntdll.dll</pre><pre>svchost.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>C:\Users\DmitryHELL\Documents\SysIQUA\loader_1.4 u2\loader_v4\loader_v3\Release\loader_v3.pdb</pre><pre>l.dlf</pre><pre>`.rdata</pre><pre>@.data</pre><pre>http://</pre><pre>http://%[^:]:%d/%s</pre><pre>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>24[^=]=24[^;]</pre><pre>/index.php?r=gate</pre><pre><knock><id>%s</id><group>%s</group><src>%d</src><transport>%d</transport><time>%d</time><version>%d</version><status>%d</status><debug>%s</debug></knock></pre><pre>RAW Request Result: %s</pre><pre>%[^:]:%d</pre><pre>%d.%d x%d</pre><pre>wireshark.exe</pre><pre>iptools.exe</pre><pre>TSystemExplorerTrayForm.UnicodeClass</pre><pre>ProcessHacker</pre><pre>99929D61-1338-48B1-9433-D42A1D94F0D2-x64</pre><pre>99929D61-1338-48B1-9433-D42A1D94F0D2-x32</pre><pre>99929D61-1338-48B1-9433-D42A1D94F0D2</pre><pre>vmtoolsd.exe</pre><pre>prl_cc.exe</pre><pre>prl_tools.exe</pre><pre>SharedIntApp.exe</pre><pre>VBoxTray.exe</pre><pre>VBoxService.exe</pre><pre>vmusrvc.exe</pre><pre>vmsrvc.exe</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>RegEnumKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegCreateKeyA</pre><pre>RegDeleteKeyA</pre><pre>ADVAPI32.dll</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>WS2_32.dll</pre><pre>InternetOpenUrlA</pre><pre>HttpSendRequestA</pre><pre>HttpOpenRequestA</pre><pre>WININET.dll</pre><pre>MSVCRT.dll</pre><pre>CryptImportPublicKeyInfo</pre><pre>CRYPT32.dll</pre><pre>dll.dll</pre><pre>C:\Users\DmitryHELL\Documents\SysIQUA\loader_1.4 u2\loader_v4\loader_v3\Release\dll.pdb</pre><pre>>y-----BEGIN PUBLIC KEY-----</pre><pre>-----END PUBLIC KEY-----</pre><pre>1.0.6, 6-Sept-2010</pre><pre>4)4;4]4{4</pre><pre>8€8x8</pre><pre>3!3 363<3><b>%original file name%.exe_856_rwx_008D0000_00001000:</b><pre>RegOpenKeyExA</pre><pre>RegCloseKey</pre><pre>GetSystemWindowsDirectoryA</pre><pre>KERNEL32.DLL</pre><pre>advapi32.dll</pre><pre>user32.dll</pre></3></pre></3>