Gen.Variant.Barys.4639_bf64d33e4e – Adaware

Gen:Variant.Barys.4639 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Barys.4639 (B) (Emsisoft), Trojan-Dropper.Small (Ikarus), Gen:Variant.Barys.4639 (FSecure), Dropper.Small.PTM (AVG), Gen:Variant.Barys.4639 (AdAware), Trojan-PSW.Win32.Zbot.6.FD, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan-PSW, Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: bf64d33e4ed99fbf04fbb6c4e1ce8056

SHA1: 262c2f68cf0a05568d77138ad9de0a240c1ca9ea

SHA256: df7d4a4c6f4f27be828b1c2a5eb1f3e2467f007a286f60b28dc8ea8fc7399023

SSDeep: 6144:82GfHdFNGYcevIV1fOxSwet5ovkLGfHdFNGYcevIV1fOxSwet5ovkvs9:8jHdOeoMxSwet6vk6HdOeoMxSwet6vk

Size: 512000 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2014-08-03 16:46:56

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

orzub.exe:580
csc.exe:1780
cvtres.exe:1864
lshss.exe:408

The Trojan injects its code into the following process(es):

%original file name%.exe:532
DW20.EXE:196
Explorer.EXE:1912

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex{E07CE937-C23F-446A-6653-6754D7DAB946}ShimCacheMutex

File activity

The process csc.exe:1780 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.out (396 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CSCD.tmp (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.dll (4164 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RESE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CSCD.tmp (0 bytes)

The process cvtres.exe:1864 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RESE.tmp (2912 bytes)

The process lshss.exe:408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp9f37664a.bat (211 bytes)
%Documents and Settings%\%current user%\Application Data\Paymhe\orzub.exe (164 bytes)

The process %original file name%.exe:532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\lshss.exe (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.cmdline (238 bytes)
%Documents and Settings%\%current user%\Application Data\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.out (305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.0.cs (196 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.cmdline (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.err (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.out (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.0.cs (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ffpk6bwt.tmp (0 bytes)

Registry activity

The process orzub.exe:580 makes changes in the system registry.