Skip to main content

Trojan.Win32.Sasfis_a1155573bb


HEUR:Trojan.Win32.Generic (Kaspersky), Worm.Generic.294759 (B) (Emsisoft), Worm.Generic.294759 (AdAware), Trojan.Win32.Sasfis.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a1155573bb7398fdf486feae5453ba12

SHA1: 0e46ce8f5eacaf4a6a7147aca1c13ede8b0208e8

SHA256: 61b21fb69fae0c5f23a6d41c08bb5e02e427be0c945b1849d524e831aee54ec6

SSDeep: 3072:M1abGWGT2TK1dbzlF9OVtSZjCw8geIr/QAuCgNVfpxICuQsKUIZn:9bpGtfoVtScw2RCgrzItQB

Size: 173492 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6

Company: no certificate found

Created at: 1992-06-20 01:22:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

%original file name%.exe:1096

The Trojan injects its code into the following process(es):

HKF.EXE:800

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1096 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\OAG.EXE (173 bytes)
%Documents and Settings%\HNV.EXE (173 bytes)
C:\filedebug (633 bytes)
C:\System Volume Information\GRTSH.EXE (174 bytes)
C:\totalcmd\OWIKOI.EXE (173 bytes)
%Documents and Settings%\ACZ.EXE (173 bytes)
C:\System Volume Information\ZEHPN.EXE (174 bytes)
C:\totalcmd\VKTNIL.EXE (174 bytes)
%Documents and Settings%\ZFP.EXE (173 bytes)
C:\System Volume Information\OCOJF.EXE (174 bytes)

The process HKF.EXE:800 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\filedebug (80 bytes)
C:\System Volume Information\UGASK.EXE (174 bytes)

Registry activity

The process %original file name%.exe:1096 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 07 EA 5D 48 54 8B EC D9 58 24 FF 0A 16 F9 44"

[HKCR\QQQ.file\shell\open\command]
"(Default)" = "%Documents and Settings%\HNV.EXE %1"

[HKCR\txtfile\shell\open\command]
"(Default)" = "C:\totalcmd\VKTNIL.EXE %1"

[HKCR\inffile\shell\open\command]
"(Default)" = "C:\System Volume Information\ZEHPN.EXE %1"

[HKCR\QQQfile\shell\open\command]
"(Default)" = "%Documents and Settings%\ACZ.EXE %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
"workfile" = "QzpcUGVybFxIS0YuRVhF"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GRTSH.EXE" = "%Documents and Settings%\ZFP.EXE"

The process HKF.EXE:800 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 06 96 C4 9E 4A C6 39 4E FD 43 BD CE 5E 71 2C"

[HKCR\exefile\shell\open\command]
"(Default)" = "C:\System Volume Information\UGASK.EXE %1 %*"

Dropped PE files

MD5 File path
a5701a767e684ef3789e63cd92ec6442c:\Documents and Settings\ACZ.EXE
25bfde10311ee8d106eed8b23402f790c:\Documents and Settings\HNV.EXE
473c522a37a498a481f0c3ea0b571f07c:\Documents and Settings\OAG.EXE
043c2d9687c985d17b8f9dc9070d504ac:\Documents and Settings\ZFP.EXE
c62fb84659bd703dd8fb6fe73a4f4fe7c:\Perl\HKF.EXE
679b573c798eee4c0b6c01739fe07908c:\System Volume Information\GRTSH.EXE
e9312e46311bf601d0c692b2eb8986eac:\System Volume Information\OCOJF.EXE
ba0241f25e639a97dcddc545787834dec:\System Volume Information\UGASK.EXE
fe92098dd79eec6c613e312f6ae4fa59c:\System Volume Information\ZEHPN.EXE
64485d6b0ee01da93aa27f71debb8ff9c:\totalcmd\OWIKOI.EXE
10843d9d366d6ac131d4abf980d9b853c:\totalcmd\VKTNIL.EXE

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1096

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\OAG.EXE (173 bytes)
    %Documents and Settings%\HNV.EXE (173 bytes)
    C:\filedebug (633 bytes)
    C:\System Volume Information\GRTSH.EXE (174 bytes)
    C:\totalcmd\OWIKOI.EXE (173 bytes)
    %Documents and Settings%\ACZ.EXE (173 bytes)
    C:\System Volume Information\ZEHPN.EXE (174 bytes)
    C:\totalcmd\VKTNIL.EXE (174 bytes)
    %Documents and Settings%\ZFP.EXE (173 bytes)
    C:\System Volume Information\OCOJF.EXE (174 bytes)
    C:\System Volume Information\UGASK.EXE (174 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "GRTSH.EXE" = "%Documents and Settings%\ZFP.EXE"

  5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0409628262400d41d8cd98f00b204e9800998ecf8427e
UPX12867201597441597445.48724c548a5f876acea2455592813a0ae6bcf
.rsrc446464409625602.04725954ae2d3ba2d2c5b5bc9c8da95e79ac6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

HKF.EXE_800:

.rsrc

.rsrc

Portions Copyright (c) 1983,99 Borland

Portions Copyright (c) 1983,99 Borland

kernel32.dll

kernel32.dll

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

EInvalidOperation

EInvalidOperation

%s[%d]

%s[%d]

%s_%d

%s_%d

EInvalidGraphicOperation

EInvalidGraphicOperation

USER32.DLL

USER32.DLL

comctl32.dll

comctl32.dll

PasswordCharXSC

PasswordCharXSC

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp

OnKeyUp

OnKeyUpx

OnKeyUpx

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

crSQLWait

crSQLWait

%s (%s)

%s (%s)

IMM32.DLL

IMM32.DLL

TContainedActionh%C

TContainedActionh%C

AutoHotkeys

AutoHotkeys

:].tJ

:].tJ

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreviewxPC

KeyPreviewxPC

WindowState

WindowState

UhG%D

UhG%D

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

vcltest3.dll

Password

Password

OnExecute

OnExecute

Port<</pre><pre>ReportLevel</pre><pre>Max Udp pack size=</pre><pre>Initializaton of windows sockets failed</pre><pre>Invalid seek origin = %d</pre><pre>NMsmtp</pre><pre>TNMSMTP</pre><pre>NMSMTP1</pre><pre>NMSMTP1Connect</pre><pre>NMSMTP1SendStart</pre><pre>AUTH LOGIN</pre><pre>PassWord_ThreadU</pre><pre>Kernel32.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Setup</pre><pre>qqpass7</pre><pre>Msread.dt</pre><pre>smtp_fuwuqi</pre><pre>kav9x.exe</pre><pre>kavsvc9x.exe</pre><pre>kavsvcui.exe</pre><pre>kav32.exe</pre><pre>smenu.exe</pre><pre>ravmon.exe</pre><pre>passwordguard.exe</pre><pre>vpc32.exe</pre><pre>watcher.exe</pre><pre>autorun.inf</pre><pre>QQQ.file\shell\open\command</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>Notepad.exe</pre><pre>HH.exe</pre><pre>regedit.exe "</pre><pre>c:\filedebug</pre><pre>netapi32.dll</pre><pre>svrapi.dll</pre><pre>FTPF0</pre><pre>Operation would block</pre><pre>Operation now in progress</pre><pre>Operation already in progress</pre><pre>Socket operation on non-socket</pre><pre>Protocol not supported</pre><pre>Socket type not supported</pre><pre>!Operation not supported on socket</pre><pre>Protocol family not supported</pre><pre>/Address family not supported by protocol family</pre><pre>#Incompatible version of WINSOCK.DLL</pre><pre>KWindows</pre><pre>.ScktComp</pre><pre>UrlMon</pre><pre>.StopFireW_Thread</pre><pre>getpass_Thread</pre><pre>Font.Charset</pre><pre>Font.Color</pre><pre>Font.Height</pre><pre>Font.Name</pre><pre>Font.Style</pre><pre>Port</pre><pre>%Copyright ?1996-1998 NetMasters L.L.C</pre><pre>1-888-2-GET-WEB (In USA)</pre><pre>E-mail info@netmastersllc.com</pre><pre>http://www.netmastersllc.com</pre><pre>! Obtain Support and Source Code</pre><pre>,Version: 5.3.0 Build:1055 Date:5/26/99</pre><pre>Submit Bug Report</pre><pre>WinExec</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegCloseKey</pre><pre>ReportEventA</pre><pre>RegFlushKey</pre><pre>RegCreateKeyExA</pre><pre>SetViewportOrgEx</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExA</pre><pre>MsgWaitForMultipleObjects</pre><pre>MapVirtualKeyA</pre><pre>LoadKeyboardLayoutA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutList</pre><pre>GetKeyboardLayout</pre><pre>GetKeyState</pre><pre>GetKeyNameTextA</pre><pre>EnumWindows</pre><pre>EnumThreadWindows</pre><pre>ActivateKeyboardLayout</pre><pre>GetKeyboardType</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>Web }</pre><pre>bu%sA&4u</pre><pre>KERNEL32.DLL</pre><pre>advapi32.dll</pre><pre>gdi32.dll</pre><pre>ole32.dll</pre><pre>oleaut32.dll</pre><pre>user32.dll</pre><pre>wsock32.dll</pre><pre>- Dock zone has no control%List does not allow duplicates ($0%x)</pre><pre>Failed to get data for '%s'/Menu '%s' is already being used by another form</pre><pre>Service failed on %s: %s</pre><pre>shutdown(Service failed in custom message(%d): %s</pre><pre>Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"</pre><pre>Unable to insert a line Clipboard does not support Icons</pre><pre>Invalid data type for '%s'</pre><pre>Failed to set data for '%s'</pre><pre>Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window</pre><pre>%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name</pre><pre>A class named %s already exists</pre><pre>Error reading %s%s%s: %s</pre><pre>Ancestor for '%s' not found</pre><pre>Unsupported clipboard format</pre><pre>Cannot assign a %s to a %s</pre><pre>Cannot create file %s</pre><pre>Cannot open file %s</pre><pre>Class %s not found</pre><pre>Resource %s not found</pre><pre>List index out of bounds (%d) List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d) Operation not allowed on sorted string list</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>Win32 Error. Code: %d.</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction%Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'</pre><pre>Invalid variant operation"Variant method calls not supported</pre><pre>!'%s' is not a valid integer value</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre><b>HKF.EXE_800_rwx_00401000_0006B000:</b><pre>Portions Copyright (c) 1983,99 Borland</pre><pre>kernel32.dll</pre><pre>MSWHEEL_ROLLMSG</pre><pre>MSH_WHEELSUPPORT_MSG</pre><pre>MSH_SCROLL_LINES_MSG</pre><pre>EInvalidOperation</pre><pre>%s[%d]</pre><pre>%s_%d</pre><pre>EInvalidGraphicOperation</pre><pre>USER32.DLL</pre><pre>comctl32.dll</pre><pre>PasswordCharXSC</pre><pre>OnKeyDown</pre><pre>OnKeyPress</pre><pre>OnKeyUp</pre><pre>OnKeyUpx</pre><pre>TKeyEvent</pre><pre>TKeyPressEvent</pre><pre>crSQLWait</pre><pre>%s (%s)</pre><pre>IMM32.DLL</pre><pre>TContainedActionh%C</pre><pre>AutoHotkeys</pre><pre>:].tJ</pre><pre>ssHotTrack</pre><pre>TWindowState</pre><pre>poProportional</pre><pre>TWMKey</pre><pre>KeyPreviewxPC</pre><pre>WindowState</pre><pre>UhG%D</pre><pre>System\CurrentControlSet\Control\Keyboard Layouts\%.8x</pre><pre>vcltest3.dll</pre><pre>Password</pre><pre>OnExecute</pre><pre>Port<</pre><pre>ReportLevel</pre><pre>Max Udp pack size=</pre><pre>Initializaton of windows sockets failed</pre><pre>Invalid seek origin = %d</pre><pre>NMsmtp</pre><pre>TNMSMTP</pre><pre>NMSMTP1</pre><pre>NMSMTP1Connect</pre><pre>NMSMTP1SendStart</pre><pre>AUTH LOGIN</pre><pre>PassWord_ThreadU</pre><pre>Kernel32.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Setup</pre><pre>qqpass7</pre><pre>Msread.dt</pre><pre>smtp_fuwuqi</pre><pre>kav9x.exe</pre><pre>kavsvc9x.exe</pre><pre>kavsvcui.exe</pre><pre>kav32.exe</pre><pre>smenu.exe</pre><pre>ravmon.exe</pre><pre>passwordguard.exe</pre><pre>vpc32.exe</pre><pre>watcher.exe</pre><pre>autorun.inf</pre><pre>QQQ.file\shell\open\command</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>Notepad.exe</pre><pre>HH.exe</pre><pre>regedit.exe "</pre><pre>c:\filedebug</pre><pre>netapi32.dll</pre><pre>svrapi.dll</pre><pre>FTPF0</pre><pre>Operation would block</pre><pre>Operation now in progress</pre><pre>Operation already in progress</pre><pre>Socket operation on non-socket</pre><pre>Protocol not supported</pre><pre>Socket type not supported</pre><pre>!Operation not supported on socket</pre><pre>Protocol family not supported</pre><pre>/Address family not supported by protocol family</pre><pre>#Incompatible version of WINSOCK.DLL</pre><pre>KWindows</pre><pre>.ScktComp</pre><pre>UrlMon</pre><pre>.StopFireW_Thread</pre><pre>getpass_Thread</pre><pre>Font.Charset</pre><pre>Font.Color</pre><pre>Font.Height</pre><pre>Font.Name</pre><pre>Font.Style</pre><pre>Port</pre><pre>%Copyright ?1996-1998 NetMasters L.L.C</pre><pre>1-888-2-GET-WEB (In USA)</pre><pre>E-mail info@netmastersllc.com</pre><pre>http://www.netmastersllc.com</pre><pre>! Obtain Support and Source Code</pre><pre>,Version: 5.3.0 Build:1055 Date:5/26/99</pre><pre>Submit Bug Report</pre><pre>WinExec</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegCloseKey</pre><pre>ReportEventA</pre><pre>RegFlushKey</pre><pre>RegCreateKeyExA</pre><pre>SetViewportOrgEx</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExA</pre><pre>MsgWaitForMultipleObjects</pre><pre>MapVirtualKeyA</pre><pre>LoadKeyboardLayoutA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutList</pre><pre>GetKeyboardLayout</pre><pre>GetKeyState</pre><pre>GetKeyNameTextA</pre><pre>EnumWindows</pre><pre>EnumThreadWindows</pre><pre>ActivateKeyboardLayout</pre><pre>GetKeyboardType</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>- Dock zone has no control%List does not allow duplicates ($0%x)</pre><pre>Failed to get data for '%s'/Menu '%s' is already being used by another form</pre><pre>Service failed on %s: %s</pre><pre>shutdown(Service failed in custom message(%d): %s</pre><pre>Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"</pre><pre>Unable to insert a line Clipboard does not support Icons</pre><pre>Invalid data type for '%s'</pre><pre>Failed to set data for '%s'</pre><pre>Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window</pre><pre>%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name</pre><pre>A class named %s already exists</pre><pre>Error reading %s%s%s: %s</pre><pre>Ancestor for '%s' not found</pre><pre>Unsupported clipboard format</pre><pre>Cannot assign a %s to a %s</pre><pre>Cannot create file %s</pre><pre>Cannot open file %s</pre><pre>Class %s not found</pre><pre>Resource %s not found</pre><pre>List index out of bounds (%d) List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d) Operation not allowed on sorted string list</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>Win32 Error. Code: %d.</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction%Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'</pre><pre>Invalid variant operation"Variant method calls not supported</pre><pre>!'%s' is not a valid integer value</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre></pre>