HEUR:Trojan.Win32.Generic (Kaspersky), Backdoor.Win32.Fynloski!IK (Emsisoft), Worm.Win32.Ainslot.VB.FD, GenericAutorunWorm.YR, WormAinslot_VariantOfZeus.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: f02495821a91961ca4fceb123e2e2956
SHA1: 9050769467e8eb79d11e2167f8830fcab63a2b3e
SHA256: 6386946b20b4d728308c741ad60c883491b8d216c0fec6bbff293cbca3fdb4ad
SSDeep: 12288:GxvgzFaTE/NhowkBPT6 OQxdE14CbFAeVaLZBXBqhm10iuv:GxvaATuNmwwb6 ddE14CJAQG3XBQ00iu
Size: 519672 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2012-11-01 05:58:37
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
reg.exe:824
reg.exe:504
reg.exe:1628
reg.exe:392
%original file name%.exe:596
The Worm injects its code into the following process(es):
vbc.exe:1164
File activity
The process vbc.exe:1164 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\4TSQ4H3FLC.exe (3860 bytes)
%Documents and Settings%\%current user%\Application Data\logs (35 bytes)
The process %original file name%.exe:596 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WinDefender.Exe (3073 bytes)
Registry activity
The process vbc.exe:1164 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 4F 7E A4 57 7B 10 3B 6B 5F 2E 93 B8 63 38 E5"
[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"P1YZ2EXU7Y" = "December 17, 2013"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"P1YZ2EXU7Y" = "Runescape"
The process reg.exe:824 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 B0 7F 27 59 9E 96 B5 25 53 02 4C C5 ED 1D 2D"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process reg.exe:504 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 05 8A EA 2A 55 6F CC 3C C9 38 FF 3D D1 D6 AC"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process reg.exe:1628 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 CC FA 84 78 BD 0E AE 20 7B 8C 6F E0 5C E2 29"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"4TSQ4H3FLC.exe" = "%Documents and Settings%\%current user%\Application Data\4TSQ4H3FLC.exe:*:Enabled:Windows Messanger"
The process reg.exe:392 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A A6 B8 C0 4F 6E 09 A9 8D 05 8D 2C 0F B7 A8 67"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%WinDir%\Microsoft.NET\Framework\v2.0.50727]
"vbc.exe" = "%WinDir%\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger"
The process %original file name%.exe:596 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 78 E7 9F 07 C6 96 4B 6A 5C 99 AC 81 A1 8B 06"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinDefender" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\WinDefender.Exe"
Network activity (URLs)
No activity has been detected.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
reg.exe:824
reg.exe:504
reg.exe:1628
reg.exe:392
%original file name%.exe:596 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\4TSQ4H3FLC.exe (3860 bytes)
%Documents and Settings%\%current user%\Application Data\logs (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WinDefender.Exe (3073 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinDefender" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\WinDefender.Exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.