Skip to main content

Trojan.Win32.EyeStye_e4aed329e7


Trojan.Win32.Patched.md (Kaspersky), Virus.Win32.Ramnit.a!dam (v) (VIPRE), Virus.Win32.Zbot!IK (Emsisoft), Backdoor.Win32.Farfli.FD, Trojan.Win32.EyeStye.FD, TrojanEyeStye.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Virus

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e4aed329e777253b486d829a394f270c

SHA1: 2afd3218d0c2a3b285ab121594dd61e98ca46d1e

SHA256: 710921b6a10a732cc0ec0d7d39e46179ff2d10ba7aed51031ea68a7fd959690b

SSDeep: 6144:yndj8E6S4u09FLx6WvbWdiWX7ht69qsiPNjYjdRFatrGaRdITAWr:yCE6S4Z9JkubIi2s9MVTiaRU9r

Size: 361374 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Express Install

Created at: 2011-07-01 12:25:08

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

e4aed329e777253:2704
02126517951.exe:668
%original file name%.exe:2412
ajvmmkjkbtsibwto.exe:3300

The Trojan injects its code into the following process(es):

ctfmon.exe:252

File activity

The process e4aed329e777253:2704 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ajvmmkjkbtsibwto.exe (601 bytes)

The process 02126517951.exe:668 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\hdwe2y7.bin\30849139C22EAD4 (5 bytes)

The process %original file name%.exe:2412 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\e4aed329e777253b486d829a394f270cmgr.exe (120 bytes)

The process ajvmmkjkbtsibwto.exe:3300 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\psyykfdm.sys (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\psyykfdm.sys (0 bytes)

Registry activity

The process e4aed329e777253:2704 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 9A 9E A8 EB 36 72 03 51 C0 FF 00 F1 5A 60 8C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"ajvmmkjkbtsibwto.exe" = "ajvmmkjkbtsibwto"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process 02126517951.exe:668 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 8F 2B 0D 96 4F AD EF 28 5E 7C 72 81 F3 D1 2E"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1309512308"
"Name" = "02126517951.exe"

The process ctfmon.exe:252 makes changes in the system registry.


The Trojan deletes the following value(s) in system registry:


The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"

The process %original file name%.exe:2412 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 6A CD 0E B0 F6 C6 ED A6 2C D6 23 0D FB 49 97"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1309512308"
"Name" = "%original file name%.exe"

The process ajvmmkjkbtsibwto.exe:3300 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 16 A5 67 91 B8 85 C6 5F AD B6 66 95 AA E2 C9"

Network activity (URLs)

URL IP
hxxp://199.2.137.140/nodf4b.php
hxxp://lb1.www.ms.akadns.net/
haqkwkokaigcdslnrlr.com195.22.26.231
aguhlabfubbvek.com195.22.26.253
awckeliqcherasntmin.com72.14.182.233
sliokrvnkjenhwgpjl.com178.79.190.156
uxlyihgvfnqcrfcf.com178.79.190.156
jexgpprgph.com50.116.32.177
mavjlatqkpuban.com50.116.32.177
hxpgffdwbevww.com50.116.32.177
prcgijpwvrl.com209.99.40.227
adhcssvuayv.com195.22.26.231
www.microsoft.com1.103.192.54
dgrdrqkpmggukqo.comUnresolvable
rkxukunrgvpkgmc.comUnresolvable
eijahjdmm.comUnresolvable
nirxlosffmarpbp.comUnresolvable
ebddteinurkortapgs.comUnresolvable
sgjwptrfosjeico.comUnresolvable
jfvxpfbgo.comUnresolvable
hfegocufjkndwc.comUnresolvable
oqayununxmqdxo.comUnresolvable
dxovrcmyletmggxf.comUnresolvable
kvoxyhnaggyqrcc.comUnresolvable
sptihuxubpj.comUnresolvable
vmdgwbenh.comUnresolvable
ntnwcxtwgxwecrdxr.comUnresolvable
ojmitlcyjsuyb.comUnresolvable
obcjfjseku.comUnresolvable
rxckgnatt.comUnresolvable
wpaxdlstrs.comUnresolvable
hijkitpq.comUnresolvable
bllkuhftropiwymr.comUnresolvable
dlsvfpmniphnmxnvoeo.comUnresolvable
nwetlnpjovgxmj.comUnresolvable
fdkasoupvgxigejgdfb.comUnresolvable
pbwjbkgdo.comUnresolvable
pdcdcwjwrqsq.comUnresolvable
arhpgoeeasi.comUnresolvable
rsmhdfgpgw.comUnresolvable
fokvmmygnngm.comUnresolvable
wvogkbbapujp.comUnresolvable
fxkapveygtffbkv.comUnresolvable
qxdfhujechixcrgdb.comUnresolvable
drpfrkvdttdkhgpqi.comUnresolvable
iljmekbkcukps.comUnresolvable
xxkoixiiiqpyecxoaka.comUnresolvable
ucwkkgbdxvjexa.comUnresolvable
fkcxdfiv.comUnresolvable
fksudkswknxd.comUnresolvable
xeucibnop.comUnresolvable
byraiyodqfdx.comUnresolvable
hbwpvcnwwcdgfojuixm.comUnresolvable
kgrrxfmyixossjmk.comUnresolvable
kqrkegigdtjxxcrvl.comUnresolvable
kmyxdodog.comUnresolvable
oxjlrgepfnkvdprbr.comUnresolvable
btfkjkqv.comUnresolvable
hhowujyrcvdrwpdvsck.comUnresolvable
ppwnhnvwnvtggifhbv.comUnresolvable
lyghwyciguta.comUnresolvable
edqmjbyjcxyjqnjjodh.comUnresolvable
umiuqmrmvsuiscitx.comUnresolvable
rtcocsaitmadupgl.comUnresolvable
lvmrpvkyo.comUnresolvable
kjjeuhhqiwvfnuvvtkd.comUnresolvable
fsksblipt.comUnresolvable
dpjbclufd.comUnresolvable
nyyhahsslkflyhulcgl.comUnresolvable
laiotlboxklvpcdfhu.comUnresolvable
tuisyirhweflhvqyxh.comUnresolvable
mjuqovvuruldy.comUnresolvable
nwrqebry.comUnresolvable
ixnaxrqn.comUnresolvable
wiyqctbhe.comUnresolvable
ojvpkaohbddmbfac.comUnresolvable
qsrywodlwhorwibvy.comUnresolvable
xsredbpaef.comUnresolvable
yicgycrtyoxaiu.comUnresolvable
amobragjgge.comUnresolvable
pvbmlrybufe.comUnresolvable
ykkcsanct.comUnresolvable
relmyplngdrdxpyv.comUnresolvable
bxnrxuyjcytf.comUnresolvable
ntohnxgjijsgi.comUnresolvable
wxurahlisqbmppqss.comUnresolvable
mmmngmrhvvohfnv.comUnresolvable
uigwsscasowqdiyp.comUnresolvable
xqdrbrjiqwwpahhk.comUnresolvable
rapbmprhwwm.comUnresolvable
hugnnpnymbwnhtuh.comUnresolvable
gwbdgrlikclhthyivym.comUnresolvable
vnskyqlkrdfnnp.comUnresolvable
ocnsfoyrdplmewnyx.comUnresolvable
mcchphgndpadclga.comUnresolvable
gkholyjchymn.comUnresolvable
bklerdwiadlxxbjunwu.comUnresolvable
cqlmxlukplhlfdo.comUnresolvable
dykxkasesippbsjb.comUnresolvable
ykesfabqxbvmns.comUnresolvable
qqsvttcnvsigkh.comUnresolvable
rgcdictp.comUnresolvable
lgeohbboqpngfap.comUnresolvable
qwfxemkbuee.comUnresolvable
xnttkdfunybxgn.comUnresolvable
dypislng.comUnresolvable
uilmabdaxqlaxuj.comUnresolvable
ushfktptgmspn.comUnresolvable
wqfmumga.comUnresolvable
njqvexdhwhutar.comUnresolvable
vgfsnrewuxeaoxoh.comUnresolvable
wwgxwnil.comUnresolvable
lnjrtxcjbiaov.comUnresolvable
qbpcpmcijn.comUnresolvable
kpkyaxyytagbk.comUnresolvable
jxnbdfwh.comUnresolvable
qadjgxayck.comUnresolvable
irfldtfkhgyrpsarcje.comUnresolvable
snpltixygwcpifp.comUnresolvable
vvhvidpeog.comUnresolvable
catvfmsxowehqvfahu.comUnresolvable
tnueoqahys.comUnresolvable
mefqtfwlxrfhguru.comUnresolvable
ticfmjsce.comUnresolvable
dfyxptqjxwtdkjjbiu.comUnresolvable
ilasqwag.comUnresolvable
omsilsdcpdsgpxm.comUnresolvable
kiiwacbehxexixl.comUnresolvable
uxqbewwdunihwscfl.comUnresolvable
hgubujdad.comUnresolvable
expecvmanfaydv.comUnresolvable
fujosogkpsxthf.comUnresolvable
ohpmyviumie.comUnresolvable
ggpmcodfppkjirg.comUnresolvable
pphxfntktjvhgti.comUnresolvable
udvnniovrov.comUnresolvable
yyeyutjgnsfrmswdygl.comUnresolvable
vmhgbribbhm.comUnresolvable
ejjogggfqcmc.comUnresolvable
erfhytwpgitkpgudo.comUnresolvable
bbmfswfgmljwj.comUnresolvable
yqvndqgijbpmx.comUnresolvable
tvxwdutxo.comUnresolvable
oukicfldnvxhrtxvuqr.comUnresolvable
suhfvuljuihmevldp.comUnresolvable
nbvhroptghtmsydrfq.comUnresolvable
mggtqypybfts.comUnresolvable
qanmwnpvpcyqsa.comUnresolvable
iedaagmofvk.comUnresolvable
gjvhfiouvwiqvtewbu.comUnresolvable
jabdfnuridle.comUnresolvable
tfgixgmqhdowexm.comUnresolvable
tfpohsjc.comUnresolvable
egcftpguclkoi.comUnresolvable
dpyeoipbso.comUnresolvable
ynergdikorjg.comUnresolvable


HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following kernel-mode hooks:

ZwCreateKey
ZwOpenKey

The Trojan installs the following user-mode hooks in WININET.dll:

InternetWriteFile
InternetReadFileExA
HttpSendRequestA
HttpSendRequestW
HttpOpenRequestA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetQueryOptionA

The Trojan installs the following user-mode hooks in USER32.dll:

TranslateMessage

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CryptEncrypt

The Trojan installs the following user-mode hooks in WS2_32.dll:

send

The Trojan installs the following user-mode hooks in ntdll.dll:

ZwVdmControl
ZwSetInformationFile
NtResumeThread
ZwQueryDirectoryFile
ZwEnumerateValueKey

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    e4aed329e777253:2704
    02126517951.exe:668
    %original file name%.exe:2412
    ajvmmkjkbtsibwto.exe:3300

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\ajvmmkjkbtsibwto.exe (601 bytes)
    C:\hdwe2y7.bin\30849139C22EAD4 (5 bytes)
    C:\e4aed329e777253b486d829a394f270cmgr.exe (120 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\psyykfdm.sys (15 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps