GenPack.Generic.Malware.Sdld.0B0DA6E6_065cc7fd4e
HEUR:Packed.Win32.Upantix.gen (Kaspersky), GenPack:Generic.Malware.Sdld.0B0DA6E6 (B) (Emsisoft), GenPack:Generic.Malware.Sdld.0B0DA6E6 (AdAware), IRC-Worm.Win32.MyDoom.FD, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Worm, IRC-Worm, Packed, IRCBot, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 065cc7fd4e36e1842eb5769fa99c64b0
SHA1: 4385ed6958bd3cc8e4dd6118265df9ba34660063
SHA256: 033bf74df2b87a067f8e222a812f65ada48be633bc911afaaef133b90be1e006
SSDeep: 3072:C/bzzzzz ZkYe 6RDbg8AAlrw1ac/2doA8wbzj:CDzzzzzM4 6508nJIU/8g
Size: 135052 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit
Summary:
Worm. A program that is primarily replicating on networks or removable drives.
Payload
| Behaviour | Description |
|---|---|
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The GenPack creates the following process(es):
No processes have been created.
The GenPack injects its code into the following process(es):
%original file name%.exe:2956
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:2956 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):
C:\Windows\win32dc\Quake3 serial.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (673 bytes)
C:\Windows\win32dc\UT2004 fix.exe (17935 bytes)
C:\Windows\win32dc\Doom 3(cdfix).exe (673 bytes)
C:\Windows\win32dc\Counter-Strike trainer.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut hack.exe (6639 bytes)
C:\Windows\win32dc\FlatOut_codes.exe (6639 bytes)
C:\Windows\win32dc\Counter-Strike patch.exe (10879 bytes)
C:\Windows\win32dc\Doom 3(patch).exe (14311 bytes)
Registry activity
Dropped PE files
| MD5 | File path |
|---|---|
| ec9b2e4277840d4b786ee1931c239088 | c:\Windows\win32dc\Counter-Strike patch.exe |
| 87237d11fcf45a3871173ef136b0342a | c:\Windows\win32dc\Doom 3(patch).exe |
| 56a608294f9204ab5f92fb5439228c2a | c:\Windows\win32dc\FlatOut hack.exe |
| b55145e51f797d9f997f6dee19594a33 | c:\Windows\win32dc\FlatOut_codes.exe |
| 1c08a0f21dd5a0d1a36272399140e281 | c:\Windows\win32dc\Half-Life 2 cheat.exe |
| 6e0d02b3998e6d336032b9833e192ee9 | c:\Windows\win32dc\UT2004 fix.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 57344 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 61440 | 77824 | 76288 | 5.52197 | d6258383e557ea7abf33e63e245c5c97 |
| .rsrc | 139264 | 4096 | 2048 | 2.63797 | b5916a1f63e299e8c8a487a2ccfe581b |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 78
0e8cc3029d3acf2b7758eb0168804d9e
14477edda0cae19be69cf5006eb941b3
f9990007d6590bd13269080bb6c21ca1
efce4f8851962bafee5777844e5b1e92
ef8efd31a93b37726b6548cc32d15c8b
ea2f5c3f421b7f54e6e90c6e0be9c4bb
d1fceadc2ec13c77c64691677b455fcc
6bc2c3f22d75f318cce1fbf50a362a9f
5bb7eb12e7f44dbe3727e6b9b5858ebb
027836c1dff19350fd4534c661cb6372
ef4f4829f04358e403d3c7d7c555f03b
e953f4d6eff1ff48f58b73fb1a8cd75a
e17c6e18bad60f0c0d0f9371a130bec8
c74b71dfa83b878c345d2dd13cb9f84e
8ebf91afaa3f36629e3bc1bc31db9c3d
8a95b5bd4327b0338b95a544dafaa533
794ec7feff497f63da9ea049bc4141e0
36b761531cc64940dd5859c9eb10125d
30525465afeecf6da2833625e2554e8c
29d725c5009d591759099020aeab702e
1c5dc4296f3c4f7fbcc09f098bf3efc6
fe81d1e58fe7052a28fce71e0b5c2ce5
ee57e38250b8429c9841000c00fc122c
94ab19937152a6126a257c02a248fce2
8a7cb6d0600d54911896cb1b5c031292
70ee15b2f5b973043d8a5d63dc51275a
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
ET CHAT IRC PONG response
ET CHAT IRC NICK command
ET CHAT IRC PING command
Traffic
Web Traffic was not found.
The GenPack connects to the servers at the folowing location(s):
`.rsrc
PRIVMSG
JOIN
login
PRIVMSG
:Fisier Executat
(Director Windows:
(netbios_invalidpass:
File(%cur%\
File(%sys%\
rndnick
NICK
join
%sys%\
%cur%\
%rnddir%\%rand%.exe
system.ini
explorer.exe
.com "win2k" :
DCPlusPlus.xml
dcplusplus.xml
%sys%
%cur%
\WINDOWS\Start Menu\Programs\Startup\
netapi32.dll
%rnddir%\%rand%.com
us.undernet.org
KWindows
&pWebServer
GetWindowsDirectoryA
RegOpenKeyExA
RegCloseKey
ShellExecuteA
URLDownloadToFileA
GetKeyboardType
.idata
.rdata
P.reloc
P.rsrc
)( *-,/.!
&pWebServ
O^nKey
URLg
KERNEL32.DLL
advapi32.dll
mpr.dll
oleaut32.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
wsock32.dll
%original file name%.exe_2956_rwx_00401000_00014000:
PRIVMSG
JOIN
login
PRIVMSG
:Fisier Executat
(Director Windows:
(netbios_invalidpass:
File(%cur%\
File(%sys%\
rndnick
NICK
join
%sys%\
%cur%\
%rnddir%\%rand%.exe
system.ini
explorer.exe
.com "win2k" :
DCPlusPlus.xml
dcplusplus.xml
%sys%
%cur%
\WINDOWS\Start Menu\Programs\Startup\
netapi32.dll
%rnddir%\%rand%.com
us.undernet.org
KWindows
&pWebServer
GetWindowsDirectoryA
RegOpenKeyExA
RegCloseKey
ShellExecuteA
URLDownloadToFileA
GetKeyboardType
.idata
.rdata
P.reloc
P.rsrc
)( *-,/.!
&pWebServ
O^nKey
URLg
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original GenPack file.
- Delete or disinfect the following files created/modified by the GenPack:
C:\Windows\win32dc\Quake3 serial.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 codes.exe (673 bytes)
C:\Windows\win32dc\UT2004 fix.exe (17935 bytes)
C:\Windows\win32dc\Doom 3(cdfix).exe (673 bytes)
C:\Windows\win32dc\Counter-Strike trainer.exe (673 bytes)
C:\Windows\win32dc\Half-Life 2 cheat.exe (6639 bytes)
C:\Windows\win32dc\FlatOut hack.exe (6639 bytes)
C:\Windows\win32dc\FlatOut_codes.exe (6639 bytes)
C:\Windows\win32dc\Counter-Strike patch.exe (10879 bytes)
C:\Windows\win32dc\Doom 3(patch).exe (14311 bytes) - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
