Worm.Win32.Dorkbot_bbf494f6b5 – Adaware

Trojan.Win32.Yakes.fdqj (Kaspersky), Trojan.GenericKD.1723384 (B) (Emsisoft), Trojan.GenericKD.1723384 (AdAware), Backdoor.Win32.Farfli.FD, Worm.Win32.Dorkbot.FD, mzpefinder_pcap_file.YR, Sinowal.YR, WormDorkbot.YR, GenericUDPFlooder.YR, GenericIRCBot.YR, GenericMSNWorm.YR, GenericUSBInfector.YR, GenericDNSBlocker.YR, GenericDownloader.YR, GenericAutorunWorm.YR, GenericSYNFlooder.YR, GenericInjector.YR, BankerGeneric.YR, GenericProxy.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: bbf494f6b5d3450bd618c1485d93b72f

SHA1: 8960d837164d5408953ab4e7a1ae18b92eff8164

SHA256: a3cc34987ae4257071c30e2f6b126e698324de3fca8c84b8759e70ccdf1a4749

SSDeep: 1536:5wSaooYnwZGoi3b5l22LOmVfTpYVkvWaPQy4kPPuxBL/1RFXi7W1u7UmjFMf0:eSfLoi31lPVNY0/PQy4SAL/h165SM

Size: 114176 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-06-18 23:51:39

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
MSNWorm	A worm can spread its copies through the MSN Messanger.
DNSBlocker	A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
SYNFlooder	This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.
Trojan-Proxy	This program can launch a proxy server (SOCKS4) on a designated TCP port.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Worm creates the following process(es):

ngggg.exe:684
ngggg.exe:336
bett.exe:160
%original file name%.exe:944

The Worm injects its code into the following process(es):

calc.exe:1752
notepad.exe:304
%original file name%.exe:492
svchost.exe:1904
sppp.exe:3600
winlogon.exe:712
services.exe:756
Explorer.EXE:888
svchost.exe:936
svchost.exe:1020
svchost.exe:1104
svchost.exe:1164
svchost.exe:1244
spoolsv.exe:1436
wmiprvse.exe:1524
jqs.exe:1592

Mutexes

The following mutexes were created/opened:

ZonesCounterMutexZonesCacheCounterMutexZonesLockedCacheCounterMutex_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!history!history.ie5!WininetStartupMutexWininetConnectionMutexWininetProxyRegistryMutexRasPbFileShimCacheMutex-c1419a97Mutex

File activity

The process ngggg.exe:336 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\c731200 (1281 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ngggg.exe.gonewiththewings (0 bytes)

The process bett.exe:160 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\My Documents\My Videos\Desktop.ini (312 bytes)

The Worm deletes the following file(s):

%Program Files%\Common Files\CreativeAudio\desktop.ini (0 bytes)

The process %original file name%.exe:492 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ngggg.exe (54528 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bett.exe (84033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\456T8DEX\ng[1].exe (57625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFK30NOL\bet[1].exe (89465 bytes)

Registry activity

The process calc.exe:1752 makes changes in the system registry.