Skip to main content

TrojanPSW.Win32.Zbot_33a39baddd


Trojan.Win32.Jorik.ZAccess.qwp (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan-Proxy.Win32.Bedri!IK (Emsisoft), Backdoor.Win32.Farfli.FD, Backdoor.Win32.ZeroAccess.FD, Trojan-PSW.Win32.Zbot.6.FD, GenericInjector.YR, TrojanPSWZbot.YR, BackdoorCaphaw_QKKBAL.YR, Sinowal.YR (Lavasoft MAS)Behaviour: Trojan-Proxy, Trojan-PSW, Trojan, Backdoor, Trojan-Proxy

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 33a39baddd41ff76677f9e1017a36c8b

SHA1: aea7645bcbe8446968b05b6aa0e3b3603af678e0

SHA256: aec989b0ae8d51c9ac8f431afc2b78b2d39a3027ec2ddf9f02f180cb08d47214

SSDeep: 384:Ufw52gYhv86admDlByQutPZRQxVl3qpRYxCN3OoV6YTk1dCS34xGRyXJK07:z5TY86adhdZR0l6uxjaxGRGT7

Size: 73728 bytes

File type: PE32

Platform:

Entropy: Not Packed

PEID: MicrosoftVisualC; Armadillov171; MicrosoftVisualCv50v60MFC; MicrosoftVisualC50; UPolyXv05_v6

Company: no certificate found

Created at: 2013-06-12 20:14:04

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Process activity

The Trojan-PSW creates the following process(es):

w.exe:del:984
quma.exe:1404
tasklist.exe:1896
1_7.exe:1644
33a39baddd41ff76677f9e1017a36c8b.exe:1660
net.exe:676
l.exe:1208
w.exe:812
m.exe:596
m.exe:1484

The Trojan-PSW injects its code into the following process(es):

File activity

The process w.exe:del:984 makes changes in a file system.


The Trojan-PSW deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w.exe (0 bytes)

The process 1_7.exe:1644 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp14043dd3.bat (197 bytes)

The process 33a39baddd41ff76677f9e1017a36c8b.exe:1660 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\explorer.exe (26378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\m.exe (34726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\explorer[1].exe (28137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w.exe (31045 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\w[1].exe (31819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\clark[1].txt (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\clark.txt (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\l.exe (54426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[1].exe (36586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\l[1].exe (57651 bytes)

The process l.exe:1208 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp9027938f.bat (169 bytes)
%Documents and Settings%\%current user%\Application Data\Etizri\quma.exe (217 bytes)

The process w.exe:812 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w.exe:del (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sqpquoi\sasigcr\wow.dll (601 bytes)

The process m.exe:596 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$I3783F449 (544 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$b7e6104547231b6c1424e765e58dff38\n (28 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$b7e6104547231b6c1424e765e58dff38\@ (2 bytes)
C:\RECYCLER\S-1-5-18\$b7e6104547231b6c1424e765e58dff38\@ (2 bytes)
%System%\CatRoot2\dberr.txt (351 bytes)
C:\RECYCLER\S-1-5-18\$b7e6104547231b6c1424e765e58dff38\n (28 bytes)

The process m.exe:1484 makes changes in a file system.


The Trojan-PSW creates and/or writes to the following file(s):

%System%\CatRoot2\dberr.txt (267 bytes)

Registry activity

The process w.exe:del:984 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 C2 C7 DD 46 9D 18 19 0A 71 A6 7C 7A E0 21 9B"

The process quma.exe:1404 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 99 4A 13 8E 75 C9 91 0E 67 F1 E6 E2 FE 3E BC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process tasklist.exe:1896 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 7D B3 52 85 5A 68 22 49 25 75 E3 FA 99 72 A5"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process 1_7.exe:1644 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 79 60 AD 60 01 10 FD 77 3A CE DB 72 42 54 21"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process 33a39baddd41ff76677f9e1017a36c8b.exe:1660 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 0D 86 EE 00 C3 78 96 E3 0C FE 66 42 87 BC 73"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-PSW deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

The process net.exe:676 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 7D 6C 78 03 7F E0 0D DD F5 43 51 DC 46 40 E9"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process l.exe:1208 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF DA AF 58 0B 2A 0F F2 B2 EA 0C E3 FA F1 6D 48"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

The process w.exe:812 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 6B B9 3E 47 40 23 80 F4 23 FA DD C6 DF 37 B1"

[HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\inprocserver32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sqpquoi\sasigcr\wow.dll"

The process m.exe:596 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 4F E0 A1 93 46 40 F9 B0 A5 F1 24 A6 85 90 3D"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1372175703"

[HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
"(Default)" = "C:\RECYCLER\S-1-5-18\$b7e6104547231b6c1424e765e58dff38\n."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "m.exe"

The Trojan-PSW deletes the following value(s) in system registry:


The Trojan-PSW disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"

The process m.exe:1484 makes changes in a system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 E8 5F 5C BD 37 29 86 29 AD C7 C7 B2 E2 28 3E"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1372175703"

[HKCU\Software\Microsoft\Mipy]
"Letimuemy" = "E8 02 61 D6 7C 9D B9 C7 6D 3B 3B 10 B1 1C 7A C6"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "m.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

Network activity (URLs)

This program can launch a proxy server (SOCKS4) on a designated TCP port.

URL: hxxp://83.133.120.16/MQf3W5VVBNhEdj0xLjImaWQ9Mzg3NTE5Nzc4NSZhaWQ9NTExMDgmc2lkPTUmb3M9NS4xLTMyluzuNN4Y Country: Germany
URL: ffe4c4.com IP: 37.1.200.165
URL: j.maxmind.com IP: 50.22.196.70
URL: xlotxdxtorwfmvuzfuvtspel.com IP: 166.78.144.80
URL: dfdkhdsrv3.tpmk.info IP: 158.255.1.225
URL: kxec5drbn2.tpmk.info IP: 158.255.1.225
URL: www.google.com IP: 173.194.43.16
URL: www.google.ca IP: 173.194.43.23
URL: 8fygcgvcv5.tpmk.info IP: 8.8.8.8

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WINMM.dll:

PlaySoundW

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpEndRequestW
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetSetFilePointer
InternetQueryDataAvailable
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC

The Trojan-PSW installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSASend
gethostbyname
send
closesocket
getaddrinfo

The Trojan-PSW installs the following user-mode hooks in kernel32.dll:

ExitProcess
GetFileAttributesExW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

NtCreateThread

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    w.exe:del:984
    quma.exe:1404
    tasklist.exe:1896
    1_7.exe:1644
    33a39baddd41ff76677f9e1017a36c8b.exe:1660
    net.exe:676
    l.exe:1208
    w.exe:812
    m.exe:596
    m.exe:1484

  3. Delete the original Trojan-PSW file.
  4. Delete or disinfect the following files created/modified by the Trojan-PSW:

    %Documents and Settings%\%current user%\Local Settings\Temp\tmp14043dd3.bat (197 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\explorer.exe (26378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\m.exe (34726 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\explorer[1].exe (28137 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w.exe (31045 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\w[1].exe (31819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\clark[1].txt (184 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\clark.txt (184 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\l.exe (54426 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\m[1].exe (36586 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\l[1].exe (57651 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\tmp9027938f.bat (169 bytes)
    %Documents and Settings%\%current user%\Application Data\Etizri\quma.exe (217 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w.exe:del (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\sqpquoi\sasigcr\wow.dll (601 bytes)
    C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$I3783F449 (544 bytes)
    C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$b7e6104547231b6c1424e765e58dff38\n (28 bytes)
    C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\$b7e6104547231b6c1424e765e58dff38\@ (2 bytes)
    C:\RECYCLER\S-1-5-18\$b7e6104547231b6c1424e765e58dff38\@ (2 bytes)
    %System%\CatRoot2\dberr.txt (351 bytes)
    C:\RECYCLER\S-1-5-18\$b7e6104547231b6c1424e765e58dff38\n (28 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps


Related articles