Trojan.Win32.Generic!BT (VIPRE), Trojan.SuspectCRC!IK (Emsisoft), Backdoor.Win32.PcClient.FD, Worm.Win32.Ainslot.VB.FD, GenericAutorunWorm.YR, WormAinslot_VariantOfZeus.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7643147c669472bcf3019378f0cc9b80
SHA1: 07f7d5c30f4e6ac67776e486c0e47fdf0a7ffcf1
SHA256: 991b990b8007aafda70a27882bb84e6139d48d9c268714a8e889a18a3be06bc4
SSDeep: 12288:3 XlacwGBB2/f1aCq/JsxgmTxmAN1R7O0YcNPv:O1aj1an8g8V7Oav
Size: 469504 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2013-09-10 03:21:41
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
reg.exe:1324
reg.exe:904
reg.exe:492
reg.exe:1592
%original file name%.exe:1552
%original file name%.exe:1156
The Worm injects its code into the following process(es):
L5EDMC4O56.EXE:1056
rundll32.exe:212
File activity
The process L5EDMC4O56.EXE:1056 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\logs (33 bytes)
%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe (161 bytes)
The process %original file name%.exe:1552 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JOSIE1.JPG (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\L5EDMC4O56.EXE (179 bytes)
Registry activity
The process L5EDMC4O56.EXE:1056 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 87 25 34 2B A0 EF CD 1E 5A 17 0B EC AA 48 22"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{CFBD7D75-AEAB-F53E-4DF6-C7A728DDEB0F}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
[HKCU\Software\Microsoft\Active Setup\Installed Components\{CFBD7D75-AEAB-F53E-4DF6-C7A728DDEB0F}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
"Windows Defender" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"RK37QA92BA" = "February 10, 2014"
[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"RK37QA92BA" = "fulnp's Bot"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
The process reg.exe:1324 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 2B 68 A0 D3 1F 1E 3B E7 48 6B AF 81 65 04 DC"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process reg.exe:904 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 85 7E B1 77 D7 CC 2C 08 1B 96 30 BC F0 9A BA"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process reg.exe:492 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D DA 5C BD 6B 3F D5 6E 1E 6C 79 C2 74 1F 61 BC"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"L5EDMC4O56.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\L5EDMC4O56.exe:*:Enabled:Windows Messanger"
The process reg.exe:1592 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 9F 5F 5C 72 52 E7 74 20 36 DF 22 96 4E 78 CE"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"L5EDMC4O56.exe" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe:*:Enabled:Windows Messanger"
The process rundll32.exe:212 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 05 51 E6 B2 5E C2 72 EB CA 26 33 2D 53 CE EE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process %original file name%.exe:1552 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 0B DD E4 AD 1A 77 4F 8F 2F AE 3B 2B DC 07 B9"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"shimgvw.dll" = "Windows Picture and Fax Viewer"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"L5EDMC4O56.EXE" = "L5EDMC4O56"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process %original file name%.exe:1156 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 90 54 E4 40 D9 00 B4 C4 F1 65 76 F5 D1 CD 7B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
Network activity (URLs)
URL | IP |
---|---|
hxxp://api.ipinfodb.com/v2/ip_query_country.php?key=33134207068e7a95c2b45275a388806be6b9ca837fe782832723b99fb21a7a8c&timezone=off | 192.151.154.180 |
dbag40.no-ip.biz | 174.68.91.236 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
reg.exe:1324
reg.exe:904
reg.exe:492
reg.exe:1592
%original file name%.exe:1552
%original file name%.exe:1156 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\logs (33 bytes)
%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JOSIE1.JPG (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\L5EDMC4O56.EXE (179 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender" = "%Documents and Settings%\%current user%\Application Data\L5EDMC4O56.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.