Worm.Win32.Ainslot_VariantOfZeus_26afa34f63

September 13, 2021 15:56

Trojan-Dropper.Win32.Injector.dkpl (Kaspersky), Trojan.Generic.KDV.568612 (B) (Emsisoft), Trojan.Generic.KDV.568612 (AdAware), Worm.Win32.Ainslot.VB.FD, GenericAutorunWorm.YR, WormAinslot_VariantOfZeus.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 26afa34f63c2f7d05cd1dfa79546a29d

SHA1: 8fbd5ea25a6605b3ff9a3499a946fb067a06229e

SHA256: f0b8ba068e8ef38547a6f59fa47c0fea1e6336f5154a3d5684c9a9bc830be275

SSDeep: 12288:ic2grpmbJvul6facvVtzo4/Ycidzc6HLO GNtazmph/cmwUUnI:frAuALL3CuNbkI

Size: 738844 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: Puresafe

Created at: 2012-03-12 07:21:30

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

26afa34f63c2f7d:1952
wuauclt.exe:540
reg.exe:1560
reg.exe:212
reg.exe:284
reg.exe:1584

The Worm injects its code into the following process(es):

windows_u98.exe:1472

File activity

The process 26afa34f63c2f7d:1952 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\windows_u98.exe (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vbc.exe (7547 bytes)
%Documents and Settings%\%current user%\Application Data\JavaUpdtr\%original file name%.exe (5441 bytes)
%System%\drivers\etc\hosts (65 bytes)

The process wuauclt.exe:540 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Worm deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

Registry activity

The process 26afa34f63c2f7d:1952 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 25 6F C2 D4 FA 64 0F E1 43 D8 D7 D4 29 B7 09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"JavaUpdtr" = "%Documents and Settings%\%current user%\Application Data\JavaUpdtr\%original file name%.exe"

The process windows_u98.exe:1472 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 92 5E 0F C4 CB 30 E4 54 D7 81 D9 83 86 1E 1B"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"F6HUVXYBXJ" = "May 2, 2014"

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"F6HUVXYBXJ" = "Test"

The process reg.exe:1560 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 0F 1B C0 E7 30 E3 1D 94 BA 47 0B 5F 57 B8 77"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Windows]
"test2.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\windows\Test2.exe:*:Enabled:Windows Messanger"

The process reg.exe:212 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 18 27 D8 49 87 E1 20 C4 E3 D3 F7 79 28 BB 2A"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"windows_u98.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\windows_u98.exe:*:Enabled:Windows Messanger"

The process reg.exe:284 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 51 74 00 3B FC 4B 79 8A 80 BC 04 32 59 88 42"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

The process reg.exe:1584 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 95 E6 63 20 22 CD A3 F6 96 0A 2B AB F4 0A 0B"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

Dropped PE files

MD5	File path
67f5238229333c061092f5a32e8c2ee1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\vbc.exe
e0d21bee6dae44a7c6e1896d7a8c7463	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\windows_u98.exe

HOSTS file anomalies

The Worm modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 65 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.virustotal.com
127.0.0.1	www.virusscan.jotti.org

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
26afa34f63c2f7d:1952
wuauclt.exe:540
reg.exe:1560
reg.exe:212
reg.exe:284
reg.exe:1584
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\windows_u98.exe (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vbc.exe (7547 bytes)
%Documents and Settings%\%current user%\Application Data\JavaUpdtr\%original file name%.exe (5441 bytes)
%System%\drivers\etc\hosts (65 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"JavaUpdtr" = "%Documents and Settings%\%current user%\Application Data\JavaUpdtr\%original file name%.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft
Product Name: Microsoft
Product Version: 6.4.5.4
Legal Copyright: Microsoft
Legal Trademarks:
Original Filename: ConsoleApplication1.exe
Internal Name: ConsoleApplication1.exe
File Version: 6.4.5.4
File Description: Microsoft
Comments:
Language: English (United States)

Company Name: MicrosoftProduct Name: MicrosoftProduct Version: 6.4.5.4Legal Copyright: MicrosoftLegal Trademarks: Original Filename: ConsoleApplication1.exeInternal Name: ConsoleApplication1.exeFile Version: 6.4.5.4File Description: MicrosoftComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	25460	25600	5.10075	9e97d64d1fae433ba21011090275639a
.sdata	40960	184	512	1.77935	8dc4789af5462ca92db2f2f65a2cbaef
.rsrc	49152	2696	3072	2.57262	908be1e421d81d76f0372803de8ec8f9
.reloc	57344	12	512	0.056519	12fa4d5d5b413c1a067995d007c9659d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
f715a545d536ec33e79a890bac216b25
9657a897b90f9e320b47fb6e85861c83
39e7995a99dfc4250d6dc2bf4d59cf14

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps

windows_u98.exe_1472:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

bss_server.usrReverseRelay

bss_server.usrReverseRelay

tmrWebHide

tmrWebHide

bss_server.Socket

bss_server.Socket

bss_server.usrRelay

bss_server.usrRelay

mswinsck.ocx

mswinsck.ocx

MSWinsockLib.Winsock

MSWinsockLib.Winsock

ieframe.dll

ieframe.dll

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

WebBrowser

WebBrowser

modLaunchWeb

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

winmm.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

avicap32.dll

avicap32.dll

advpack.dll

advpack.dll

GetAsyncKeyState

GetAsyncKeyState

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

PSAPI.DLL

PSAPI.DLL

SHFileOperationA

SHFileOperationA

CreatePipe

CreatePipe

CHAT_ADDMSG

CHAT_ADDMSG

GetTcpTable

GetTcpTable

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

WinInet.dll

WinInet.dll

DeleteUrlCacheEntryA

DeleteUrlCacheEntryA

urlmon

urlmon

URLDownloadToFileA

URLDownloadToFileA

ShellExecuteA

ShellExecuteA

keybd_event

keybd_event

VBA6.DLL

VBA6.DLL

C:\Windows\SysWow64\msvbvm60.dll\3

C:\Windows\SysWow64\msvbvm60.dll\3

ws2_32.dll

ws2_32.dll

AddMsg

AddMsg

GdiplusShutdown

GdiplusShutdown

RemotePort

RemotePort

LocalPort

LocalPort

WSOCK32.DLL

WSOCK32.DLL

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ntdll.dll

ntdll.dll

*wC:\Windows\SysWOW64\ieframe.oca

*wC:\Windows\SysWOW64\ieframe.oca

UDPSocket

UDPSocket

J%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc14663.oca

J%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc14663.oca

tmrTCP

tmrTCP

tmrUDP

tmrUDP

UDPFlood

UDPFlood

ole32.dll

ole32.dll

crypt32.dll

crypt32.dll

oleaut32.dll

oleaut32.dll

RegOpenKeyA

RegOpenKeyA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

imgLoginPressed

imgLoginPressed

imgLogin

imgLogin

txtPassword

txtPassword

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

gdi32.dll

gdi32.dll

olepro32.dll

olepro32.dll

InternetOpenUrlA

InternetOpenUrlA

FtpGetFileA

FtpGetFileA

FtpPutFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpOpenFileA

FtpGetDirectory

FtpGetDirectory

Http_DownloadFile

Http_DownloadFile

FtpGetFileSize

FtpGetFileSize

FtpDeleteFileA

FtpDeleteFileA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpRenameFileA

FtpDownload

FtpDownload

FtpUpload

FtpUpload

cmdShowfiles

cmdShowfiles

msvbvm60.dll

msvbvm60.dll

?8??8??8??8??8?

?8??8??8??8??8?

.QX0WPp

.QX0WPp

uMsg

uMsg

strMsg

strMsg

MsgNum

MsgNum

AllMsgs

AllMsgs

lngPort

lngPort

URL_TARGET

URL_TARGET

Port

Port

Password

Password

WebURL

WebURL

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

{00020404-0000-0000-C000-000000000046}

\nir_cmd.bss speak text

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

\nir_cmd.bss monitor on

PORT

PORT

TRANSFERPORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Keylog

Wscript.Shell

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

\winlogon.exe

iexplore.exe

iexplore.exe

http://www.facebook.com/?ref=home

http://www.facebook.com/?ref=home

http://www.facebook.com

http://www.facebook.com

ADVAPI32.dll

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

WebCamCapture

\Vuze\Azureus.exe

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe /HIDE

\uTorrent\uTorrent.exe /HIDE

\BitTorrent\bittorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\MSWINSCK.OCX

\cmd.exe

\cmd.exe

\data.dat

\data.dat

\steam\steam.exe

\steam\steam.exe

nkey

nkey

dkey

dkey

regsvr32.exe

regsvr32.exe

\pws_mail.bss

\pws_mail.bss

\pws_mess.bss

\pws_mess.bss

\pws_cdk.bss

\pws_cdk.bss

\pws_ff.bss

\pws_ff.bss

\pws_chro.bss

\pws_chro.bss

\nir_cmd.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

00000000

winmgmts:\\.\root\cimv2

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

Select * from Win32_Keyboard

api.ipinfodb.com

api.ipinfodb.com

GET /v2/ip_query.php?key=

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

GET /v2/ip_query_country.php?key=

Portable

Portable

winmgmts:\\.\root\SecurityCenter

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.bmp

\wallpaper.jpg

\wallpaper.jpg

WScript.Shell

WScript.Shell

WinServer 2003, Web Edition

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

__oxFrame.class__

Scripting.FileSystemObject

Scripting.FileSystemObject

Autorun.ini

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Address family not supported by protocol family.

Operation already in progress.

Operation already in progress.

Operation now in progress.

Operation now in progress.

Socket operation on nonsocket.

Socket operation on nonsocket.

Operation not supported.

Operation not supported.

Protocol family not supported.

Protocol family not supported.

Protocol not supported.

Protocol not supported.

Socket type not supported.

Socket type not supported.

Winsock.dll version out of range.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

CSocketMaster.SendBufferedData

/stext mess.dat

/stext mess.dat

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

\mess.dat

\mess.dat

/stext mail.dat

/stext mail.dat

\mail.dat

\mail.dat

/stext ffpw.dat

/stext ffpw.dat

\ffpw.dat

\ffpw.dat

Web Site

Web Site

Password

Password

/stext chro.dat

/stext chro.dat

\chro.dat

\chro.dat

Action URL

Action URL

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

Windows

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

http\shell\open\command

http\shell\open\command

127.0.0.1

127.0.0.1

\dump.txt

\dump.txt

\uTorrent\uTorrent.exe /DIRECTORY

\uTorrent\uTorrent.exe /DIRECTORY

255.255.255.255

255.255.255.255

finalizarprocessoportas

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bps1.exe

bhookpl.dll

bhookpl.dll

bnfa.exe

bnfa.exe

drvloadn.dll

drvloadn.dll

drvloadx.dll

drvloadx.dll

VNCHooks.dll

VNCHooks.dll

xr4tdwa.exe

xr4tdwa.exe

shutdown.exe

shutdown.exe

TCnRawKeyBoard

TCnRawKeyBoard

HuntHTTPDownload

HuntHTTPDownload

autorun.inf

autorun.inf

https://onlineeast#.bankofamerica.com

https://onlineeast#.bankofamerica.com

winlogon.exe

winlogon.exe

moz_logins

moz_logins

WEBCAMLIVE

WEBCAMLIVE

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

\system32\userinit.exe,

notepad.exe

notepad.exe

\system32\userinit.exe

\system32\userinit.exe

steam.exe

steam.exe

hl.exe

hl.exe

http:///

http:///

@*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

@*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

windows_u98.exe_1472_rwx_00400000_00070000:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

bss_server.usrReverseRelay

bss_server.usrReverseRelay

tmrWebHide

tmrWebHide

bss_server.Socket

bss_server.Socket

bss_server.usrRelay

bss_server.usrRelay

mswinsck.ocx

mswinsck.ocx

MSWinsockLib.Winsock

MSWinsockLib.Winsock

ieframe.dll

ieframe.dll

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

WebBrowser

WebBrowser

modLaunchWeb

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

winmm.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

avicap32.dll

avicap32.dll

advpack.dll

advpack.dll

GetAsyncKeyState

GetAsyncKeyState

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

PSAPI.DLL

PSAPI.DLL

SHFileOperationA

SHFileOperationA

CreatePipe

CreatePipe

CHAT_ADDMSG

CHAT_ADDMSG

GetTcpTable

GetTcpTable

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

WinInet.dll

WinInet.dll

DeleteUrlCacheEntryA

DeleteUrlCacheEntryA

urlmon

urlmon

URLDownloadToFileA

URLDownloadToFileA

ShellExecuteA

ShellExecuteA

keybd_event

keybd_event

VBA6.DLL

VBA6.DLL

C:\Windows\SysWow64\msvbvm60.dll\3

C:\Windows\SysWow64\msvbvm60.dll\3

ws2_32.dll

ws2_32.dll

AddMsg

AddMsg

GdiplusShutdown

GdiplusShutdown

RemotePort

RemotePort

LocalPort

LocalPort

WSOCK32.DLL

WSOCK32.DLL

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ntdll.dll

ntdll.dll

*wC:\Windows\SysWOW64\ieframe.oca

*wC:\Windows\SysWOW64\ieframe.oca

UDPSocket

UDPSocket

J%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc14663.oca

J%Program Files% (x86)\Microsoft Visual Studio\VB98\vbc14663.oca

tmrTCP

tmrTCP

tmrUDP

tmrUDP

UDPFlood

UDPFlood

ole32.dll

ole32.dll

crypt32.dll

crypt32.dll

oleaut32.dll

oleaut32.dll

RegOpenKeyA

RegOpenKeyA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

imgLoginPressed

imgLoginPressed

imgLogin

imgLogin

txtPassword

txtPassword

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

gdi32.dll

gdi32.dll

olepro32.dll

olepro32.dll

InternetOpenUrlA

InternetOpenUrlA

FtpGetFileA

FtpGetFileA

FtpPutFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpOpenFileA

FtpGetDirectory

FtpGetDirectory

Http_DownloadFile

Http_DownloadFile

FtpGetFileSize

FtpGetFileSize

FtpDeleteFileA

FtpDeleteFileA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpRenameFileA

FtpDownload

FtpDownload

FtpUpload

FtpUpload

cmdShowfiles

cmdShowfiles

msvbvm60.dll

msvbvm60.dll

?8??8??8??8??8?

?8??8??8??8??8?

.QX0WPp

.QX0WPp

uMsg

uMsg

strMsg

strMsg

MsgNum

MsgNum

AllMsgs

AllMsgs

lngPort

lngPort

URL_TARGET

URL_TARGET

Port

Port

Password

Password

WebURL

WebURL

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

{00020404-0000-0000-C000-000000000046}

\nir_cmd.bss speak text

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

\nir_cmd.bss monitor on

PORT

PORT

TRANSFERPORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Keylog

Wscript.Shell

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

\winlogon.exe

iexplore.exe

iexplore.exe

http://www.facebook.com/?ref=home

http://www.facebook.com/?ref=home

http://www.facebook.com

http://www.facebook.com

ADVAPI32.dll

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

WebCamCapture

\Vuze\Azureus.exe

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe /HIDE

\uTorrent\uTorrent.exe /HIDE

\BitTorrent\bittorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\MSWINSCK.OCX

\cmd.exe

\cmd.exe

\data.dat

\data.dat

\steam\steam.exe

\steam\steam.exe

nkey

nkey

dkey

dkey

regsvr32.exe

regsvr32.exe

\pws_mail.bss

\pws_mail.bss

\pws_mess.bss

\pws_mess.bss

\pws_cdk.bss

\pws_cdk.bss

\pws_ff.bss

\pws_ff.bss

\pws_chro.bss

\pws_chro.bss

\nir_cmd.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

00000000

winmgmts:\\.\root\cimv2

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

Select * from Win32_Keyboard

api.ipinfodb.com

api.ipinfodb.com

GET /v2/ip_query.php?key=

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

GET /v2/ip_query_country.php?key=

Portable

Portable

winmgmts:\\.\root\SecurityCenter

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.bmp

\wallpaper.jpg

\wallpaper.jpg

WScript.Shell

WScript.Shell

WinServer 2003, Web Edition

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

__oxFrame.class__

Scripting.FileSystemObject

Scripting.FileSystemObject

Autorun.ini

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Address family not supported by protocol family.

Operation already in progress.

Operation already in progress.

Operation now in progress.

Operation now in progress.

Socket operation on nonsocket.

Socket operation on nonsocket.

Operation not supported.

Operation not supported.

Protocol family not supported.

Protocol family not supported.

Protocol not supported.

Protocol not supported.

Socket type not supported.

Socket type not supported.

Winsock.dll version out of range.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

CSocketMaster.SendBufferedData

/stext mess.dat

/stext mess.dat

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

\mess.dat

\mess.dat

/stext mail.dat

/stext mail.dat

\mail.dat

\mail.dat

/stext ffpw.dat

/stext ffpw.dat

\ffpw.dat

\ffpw.dat

Web Site

Web Site

Password

Password

/stext chro.dat

/stext chro.dat

\chro.dat

\chro.dat

Action URL

Action URL

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

Windows

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

http\shell\open\command

http\shell\open\command

127.0.0.1

127.0.0.1

\dump.txt

\dump.txt

\uTorrent\uTorrent.exe /DIRECTORY

\uTorrent\uTorrent.exe /DIRECTORY

255.255.255.255

255.255.255.255

finalizarprocessoportas

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bps1.exe

bhookpl.dll

bhookpl.dll

bnfa.exe

bnfa.exe

drvloadn.dll

drvloadn.dll

drvloadx.dll

drvloadx.dll

VNCHooks.dll

VNCHooks.dll

xr4tdwa.exe

xr4tdwa.exe

shutdown.exe

shutdown.exe

TCnRawKeyBoard

TCnRawKeyBoard

HuntHTTPDownload

HuntHTTPDownload

autorun.inf

autorun.inf

https://onlineeast#.bankofamerica.com

https://onlineeast#.bankofamerica.com

winlogon.exe

winlogon.exe

moz_logins

moz_logins

WEBCAMLIVE

WEBCAMLIVE

explorer.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

\system32\userinit.exe,

notepad.exe

notepad.exe

\system32\userinit.exe

\system32\userinit.exe

steam.exe

steam.exe

hl.exe

hl.exe

http:///

http:///

@*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp

@*\AC:\Users\Admin\Desktop_old\Blackshades project\Blackshades NET\server\server.vbp