Skip to main content

FakeAV.Win32.FakeRean_8aa08f5584


Gen:Variant.Zbot.40 (BitDefender), Rogue:Win32/FakeRean (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), FraudTool.Win32.FakeRean.e (v) (VIPRE), Trojan.Fakealert.20509 (DrWeb), Gen:Variant.Zbot.40 (B) (Emsisoft), FakeAlert-Rena.c (McAfee), Trojan.FakeAV!gen69 (Symantec), Trojan.Fakeav (Ikarus), Gen:Variant.Zbot.40 (FSecure), FakeAlert (AVG), Win32:Renosa-G [Wrm] (Avast), TROJ_FAKEAL.SMQP (TrendMicro), Backdoor.Win32.PcClient.FD, Fake-AV.Win32.FakeRean.2.FD, Trojan.Win32.IEDummy.FD, FakeAVWin32FakeRean.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Fake-AV

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 8aa08f558416d865010282e43999daf3

SHA1: 4ab782ff83764eaf163267f1926a379bbb59cb8b

SHA256: 677ffa33712aed820a3d8386911b7b8f162b4d8d67c4305e715431bfd90b5c1f

SSDeep: 12288:zugvybZAxdnK3UuCXuLtqO7qkchOz41Rnxr UHYwqqRXDGU :zugabKdK3UKckc 4Xh/PqqR

Size: 507904 bytes

File type: DLL

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: F

Created at: 2001-10-19 23:03:58

Analyzed on: WindowsXP SP3 32-bit

Summary: Fake-AV. FakeAV programs generate exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Fake-AV creates the following process(es):

imapi.exe:816
ilSyo.exe:404
regsvr32.exe:1288

The Fake-AV injects its code into the following process(es):

uyk.exe:564
rundll32.exe:1100
iexplore.exe:216

File activity

The process imapi.exe:816 makes changes in the file system.


The Fake-AV creates and/or writes to the following file(s):

%WinDir%\Temp\ihm6nvg8.TMP (146970 bytes)

The process uyk.exe:564 makes changes in the file system.


The Fake-AV creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\jd0304a8d3q3q1q3u (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jd0304a8d3q3q1q3u (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\jd0304a8d3q3q1q3u (251 bytes)
%Documents and Settings%\%current user%\Templates\jd0304a8d3q3q1q3u (251 bytes)

The Fake-AV deletes the following file(s):

C:\8aa08f558416d865010282e43999daf3.dll (0 bytes)

The process ilSyo.exe:404 makes changes in the file system.


The Fake-AV creates and/or writes to the following file(s):

%System%\2p15x.dll (192 bytes)

The process regsvr32.exe:1288 makes changes in the file system.


The Fake-AV creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ilSyo.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\uyk.exe (1788 bytes)

The process iexplore.exe:216 makes changes in the file system.


The Fake-AV deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ilSyo.exe (0 bytes)

Registry activity

The process imapi.exe:816 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 FE 25 27 64 D8 82 19 FD A1 4D 3D DA CF BE 39"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"

The process uyk.exe:564 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKCU\Software\Classes\exefile\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\uyk.exe -a %1 %*"

[HKCU\Software\Classes\exefile\shell\runas\command]
"IsolatedCommand" = "%1 %*"

[HKCU\Software\Classes\exefile]
"(Default)" = "Application"

[HKCU\Software\Classes\.exe\shell\runas\command]
"IsolatedCommand" = "%1 %*"

[HKLM\SOFTWARE\Clients\StartMenuInternet]
"(Default)" = "IEXPLORE.EXE"

[HKCU\Software\Classes\exefile\shell\open\command]
"IsolatedCommand" = "%1 %*"

[HKCU\Software\Classes\.exe\shell\runas\command]
"(Default)" = "%1 %*"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Classes\exefile\shell\runas\command]
"(Default)" = "%1 %*"

[HKCU\Software\Classes\exefile]
"Content Type" = "application/x-msdownload"

[HKCU\Software\Classes\.exe\shell\open\command]
"IsolatedCommand" = "%1 %*"

[HKCU\Software\Classes\.exe]
"(Default)" = "exefile"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\uyk.exe -a %Program Files%\Internet Explorer\iexplore.exe"

[HKCU\Software\Classes\exefile\DefaultIcon]
"(Default)" = "%1"

[HKCU\Software\Microsoft\Windows]
"Identity" = "2949954561"

[HKCU\Software\Classes\.exe\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\uyk.exe -a %1 %*"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 DF 55 AB EB BA FE 66 0A CA 95 8E B0 48 04 37"

[HKCU\Software\Classes\.exe\DefaultIcon]
"(Default)" = "%1"

[HKCU\Software\Classes\.exe]
"Content Type" = "application/x-msdownload"

To automatically run itself each time Windows is booted, the Fake-AV adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe" = "%System%\ctfmon.exe"

The process rundll32.exe:1100 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 39 4F C8 68 13 2B CE 2C A8 4F 86 E4 FE 50 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process ilSyo.exe:404 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 94 B7 23 BA 7E A4 25 88 27 2C 47 6C 3B E5 DD"

[HKCR\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}\InProcServer32]
"(Default)" = "%System%\2p15x.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer]
"6553e2ef" = "82 6F 8E DF 81 00 00 00 0C 02 3D 68 B9 7C 08 51"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"6553e2ef" = "82 6F 8E DF 81 00 00 00 0C 02 3D 68 B9 7C 08 51"

The process regsvr32.exe:1288 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 99 AE 72 8C F5 F9 B7 58 47 20 17 3F EB F4 7D"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
"UpdatesDisableNotify" = "1"
"FirewallOverride" = "1"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = "0"

"DoNotAllowExceptions" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
"Start" = "4"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The process iexplore.exe:216 makes changes in the system registry.


The Fake-AV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 22 1B 59 E4 8E C1 EE 82 87 BE 1B 9D B3 0C 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer]
"6553e2ef" = "99 69 E3 F9 34 01 00 00 0C 2E 18 68 03 E0 A7 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"6553e2ef" = "99 69 E3 F9 34 01 00 00 0C 2E 18 68 03 E0 A7 01"

Network activity (URLs)

URL IP
hxxp://vehyraceke.com/6bH3p Kx96fhtPen4w208.73.211.247
ypyrezaba.com69.43.161.170
utuhubolype.com69.43.161.170
igotiroda.com208.73.211.247
ydijajyb.com69.43.161.170
ykilyxagesop.com208.73.211.230
xibipijuxoj.comUnresolvable
pubyhixasuhu.comUnresolvable
curibygerulusi.comUnresolvable
ygywiguxake.comUnresolvable
gygokelara.comUnresolvable
kepehukoc.comUnresolvable
zizybilyxu.comUnresolvable
zotaziweboxe.comUnresolvable
jewarowydyni.comUnresolvable


HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    imapi.exe:816
    ilSyo.exe:404
    regsvr32.exe:1288

  2. Delete the original Fake-AV file.
  3. Delete or disinfect the following files created/modified by the Fake-AV:

    %WinDir%\Temp\ihm6nvg8.TMP (146970 bytes)
    %Documents and Settings%\All Users\Application Data\jd0304a8d3q3q1q3u (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jd0304a8d3q3q1q3u (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\jd0304a8d3q3q1q3u (251 bytes)
    %Documents and Settings%\%current user%\Templates\jd0304a8d3q3q1q3u (251 bytes)
    %System%\2p15x.dll (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ilSyo.exe (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\uyk.exe (1788 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe" = "%System%\ctfmon.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps