Trojan.Win32.Scarsi.ufm (Kaspersky), Trojan.DownLoader10.49250 (DrWeb), CoinMiner.YC (AVG), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 2eb25d09c14eaaa0a430963869be8a27
SHA1: 7484b7e094599a6d9bfa452a1c9dfe6b012079b4
SHA256: 3ab5ac9461666bf60071fa1e94a95b33f12d73b46f37f3b9d2350de30d8fc020
SSDeep: 3072:KBeSpjYoV7VLNSlMxmpNL9PHw Q9rKJSkp5hGOe:K9pjYoVdNSqIrLODF8yZ
Size: 182784 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: Firseria
Created at: 2013-10-30 14:06:12
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1808
iAX6in4PzGEGaj.exe:176
iAX6in4PzGEGaj.exe:596
File activity
The process %original file name%.exe:1808 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe (673 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\iAX6in4PzGEGaj.exe (673 bytes)
The process iAX6in4PzGEGaj.exe:596 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\diablo121016.cl (18453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pthreadGC2.dll (35673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libpdcurses.dll (55565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\liburl.tmp (135661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libblkmaker_jansson-0.1-0.dll (12433 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\iAX6in4PzGEGaj.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libeay32.dll (498825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libcurl.dll (192597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scrypt121016.cl (8129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libjansson-4.dll (69481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libblkmaker-0.1-0.dll (10324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phatk121016.cl (5797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\poclbm121016.cl (16665 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\diakgcn121016.cl (8577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libidn-11.dll (90545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zlib1.dll (30777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ssleay32.dll (133761 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe (0 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\iAX6in4PzGEGaj.exe (0 bytes)
Registry activity
The process %original file name%.exe:1808 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe"
The process iAX6in4PzGEGaj.exe:176 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 45 6C 79 38 42 89 76 16 ED 6C B6 6F F7 D7 AD"
The process iAX6in4PzGEGaj.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://91.121.66.158/panel/files/zlib1.dll (Malicious) | |
| hxxp://91.121.66.158/panel/files/diablo121016.cl | |
| hxxp://91.121.66.158/panel/files/miner.exe (Malicious) | |
| hxxp://91.121.66.158/panel/res.php | |
| stratum.mining.eligius.st | 23.21.225.111 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in ntdll.dll:
ZwSetValueKey
NtResumeThread
RtlGetNativeSystemInformation
NtQueryDirectoryFile
ZwOpenProcess
ZwOpenFile
NtEnumerateValueKey
ZwDeleteValueKey
NtCreateFile
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1808
iAX6in4PzGEGaj.exe:176
iAX6in4PzGEGaj.exe:596 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe (673 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\iAX6in4PzGEGaj.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\diablo121016.cl (18453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pthreadGC2.dll (35673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libpdcurses.dll (55565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\liburl.tmp (135661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libblkmaker_jansson-0.1-0.dll (12433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libeay32.dll (498825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libcurl.dll (192597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scrypt121016.cl (8129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libjansson-4.dll (69481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libblkmaker-0.1-0.dll (10324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phatk121016.cl (5797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\poclbm121016.cl (16665 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\diakgcn121016.cl (8577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\libidn-11.dll (90545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zlib1.dll (30777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ssleay32.dll (133761 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"iAX6in4PzGEGaj" = "%Documents and Settings%\%current user%\Application Data\Windows\iAX6in4PzGEGaj.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.