DeepScan.Generic.ServStart.A.237BB2AD_c02621a67d
DeepScan:Generic.ServStart.A.237BB2AD (BitDefender), DDoS:Win32/Nitol.A (Microsoft), Rootkit.Win32.Lapka.an (Kaspersky), Trojan.Win32.Zegost.lt (v) (VIPRE), Trojan.DnsAmp.28 (DrWeb), DeepScan:Generic.ServStart.A.237BB2AD (B) (Emsisoft), Nitol!51A8792BD504 (McAfee), Backdoor.Nitol (Symantec), Trojan.Win32.ServStart (Ikarus), DeepScan:Generic.ServStart.A.237BB2AD (FSecure), Win32/DH{gmKBEAM?} (AVG), Win32:Agent-AXZC [Trj] (Avast), TROJ_NITOL.SMN1 (TrendMicro), DeepScan:Generic.ServStart.A.237BB2AD (AdAware), DDoSNitol.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: c02621a67daaedb36ffa02ba0bd9382d
SHA1: 0fcad3e82c710b54ad1e2b6b2c4a8b635c3c79b6
SHA256: 38ee24aa415c6513a130a9146653144b478c68a1fc25ae082128d4e5a6f85fd1
SSDeep: 384:dkgM47uZF8CDQBZbXw9zZ kdB5uA07ICkU3plg m3gKoN:XM4qZF8waZbg9zZhZuz7hkKlgbZo
Size: 20480 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2016-12-02 07:05:12
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The DeepScan creates the following process(es):
%original file name%.exe:2528
The DeepScan injects its code into the following process(es):
riznia.exe:2972
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:2528 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):
C:\Windows\riznia.exe (20 bytes)
Registry activity
The process %original file name%.exe:2528 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\System\CurrentControlSet\Services\.Net CLR]
"Description" = "Microsoft .NET COM Integration with SOAP"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The DeepScan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 40960 | 20480 | 18432 | 5.43853 | 4296bce24a97d3fb3933decd6d208811 |
| .rsrc | 61440 | 4096 | 1024 | 1.70537 | 740b13471e7d16203c44370e59980d06 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
| URL | IP |
|---|---|
| dns.msftncsi.com |  |
| base8.gyddos.com |  |
| teredo.ipv6.microsoft.com | |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
The DeepScan connects to the servers at the folowing location(s):
`.rsrc
WS2_32.dll
GetWindowsDirec=ry
.Net CLRM
\\%s %d:
F:\g1fd.exhH
%uL > n
HTTP/1.1
KERNEL32.dll
GetWindowsDirectoryA
ADVAPI32.dll
RegOpenKeyA
RegCloseKey
118.193.193.137
.Net CLR
Microsoft .Net Framework COM Support
Microsoft .NET COM Integration with SOAP
at \\%s %d:%d %s
F:\g1fd.exe
\\%s\F$\g1fd.exe
E:\g1fd.exe
\\%s\E$\g1fd.exe
D:\g1fd.exe
\\%s\D$\g1fd.exe
C:\g1fd.exe
\\%s\C$\NewArean.exe
\\%s\admin$\g1fd.exe
\\%s\ipc$
mpr.dll
%d.%d.%d.%d
1314520
5201314
12345678
password
hra%u.dll
kernel32.dll
ddd
%c%c%c%c%c%c.exe
%u Mbps
%u Gbps
0.0.0.0
%u MB
%d*%u%s
%s %s %s%d
GET %s HTTP/1.1
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
Host: %s:%d
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
SSSh^,@
SSShJE@
.text
`.rdata
@.data
.rsrc
@.reloc
SHELL32.dll
SHLWAPI.dll
lpk.attack
lpk.dll
WinExec
RegOpenKeyExA
_acmdln
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
.data
.TMi
'RAREXE.
KERNEL32.DLL
iphlpapi.dll
MSVCRT.dll
USER32.dll
riznia.exe_2972_rwx_00401000_0000D000:
WS2_32.dll
KERNEL32.dll
GetWindowsDirectoryA
ADVAPI32.dll
RegOpenKeyA
RegCloseKey
118.193.193.137
.Net CLR
Microsoft .Net Framework COM Support
Microsoft .NET COM Integration with SOAP
at \\%s %d:%d %s
F:\g1fd.exe
\\%s\F$\g1fd.exe
E:\g1fd.exe
\\%s\E$\g1fd.exe
D:\g1fd.exe
\\%s\D$\g1fd.exe
C:\g1fd.exe
\\%s\C$\NewArean.exe
\\%s\admin$\g1fd.exe
\\%s\ipc$
mpr.dll
%d.%d.%d.%d
1314520
5201314
12345678
password
hra%u.dll
kernel32.dll
ddd
%c%c%c%c%c%c.exe
%u Mbps
%u Gbps
0.0.0.0
%u MB
%d*%u%s
%s %s %s%d
GET %s HTTP/1.1
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
Host: %s:%d
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
SSSh^,@
SSShJE@
.text
`.rdata
@.data
.rsrc
@.reloc
SHELL32.dll
SHLWAPI.dll
lpk.attack
lpk.dll
WinExec
RegOpenKeyExA
_acmdln
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
.data
mqiaqq.exe_2972:
`.rsrc
WS2_32.dll
GetWindowsDirec=ry
.Net CLRM
\\%s %d:
F:\g1fd.exhH
%uL > n
HTTP/1.1
KERNEL32.dll
GetWindowsDirectoryA
ADVAPI32.dll
RegOpenKeyA
RegCloseKey
118.193.193.137
.Net CLR
Microsoft .Net Framework COM Support
Microsoft .NET COM Integration with SOAP
at \\%s %d:%d %s
F:\g1fd.exe
\\%s\F$\g1fd.exe
E:\g1fd.exe
\\%s\E$\g1fd.exe
D:\g1fd.exe
\\%s\D$\g1fd.exe
C:\g1fd.exe
\\%s\C$\NewArean.exe
\\%s\admin$\g1fd.exe
\\%s\ipc$
mpr.dll
%d.%d.%d.%d
1314520
5201314
12345678
password
hra%u.dll
kernel32.dll
ddd
%c%c%c%c%c%c.exe
%u Mbps
%u Gbps
0.0.0.0
%u MB
%d*%u%s
%s %s %s%d
GET %s HTTP/1.1
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
Host: %s:%d
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
SSSh^,@
SSShJE@
.text
`.rdata
@.data
.rsrc
@.reloc
SHELL32.dll
SHLWAPI.dll
lpk.attack
lpk.dll
WinExec
RegOpenKeyExA
_acmdln
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
.data
.TMi
'RAREXE.
KERNEL32.DLL
iphlpapi.dll
MSVCRT.dll
USER32.dll
mqiaqq.exe_2972_rwx_00401000_0000D000:
WS2_32.dll
KERNEL32.dll
GetWindowsDirectoryA
ADVAPI32.dll
RegOpenKeyA
RegCloseKey
118.193.193.137
.Net CLR
Microsoft .Net Framework COM Support
Microsoft .NET COM Integration with SOAP
at \\%s %d:%d %s
F:\g1fd.exe
\\%s\F$\g1fd.exe
E:\g1fd.exe
\\%s\E$\g1fd.exe
D:\g1fd.exe
\\%s\D$\g1fd.exe
C:\g1fd.exe
\\%s\C$\NewArean.exe
\\%s\admin$\g1fd.exe
\\%s\ipc$
mpr.dll
%d.%d.%d.%d
1314520
5201314
12345678
password
hra%u.dll
kernel32.dll
ddd
%c%c%c%c%c%c.exe
%u Mbps
%u Gbps
0.0.0.0
%u MB
%d*%u%s
%s %s %s%d
GET %s HTTP/1.1
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
Host: %s:%d
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
SSSh^,@
SSShJE@
.text
`.rdata
@.data
.rsrc
@.reloc
SHELL32.dll
SHLWAPI.dll
lpk.attack
lpk.dll
WinExec
RegOpenKeyExA
_acmdln
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
.data
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2528
- Delete the original DeepScan file.
- Delete or disinfect the following files created/modified by the DeepScan:
C:\Windows\riznia.exe (20 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
