MD5: bb093c2dc70e911d46a7d14c3ccb4cc5
SHA1: 1863814071ee85463185291ce54d77b15caeab8b
SHA256: fdb1a09968e04f9fdd5ff81ee589e7244ea45d5100c82a664b304dde5c332420
SSDeep: 12288:WXQ8DurSXVmbDxH RgbX5ig0LIqJaGX3D3VZG9Sl:gQ86eXVmbDd 5i/FF3zGk
Size: 542720 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: snipsmart
Created at: no data
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

rundll32.exe:3504
%original file name%.exe:1796

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process rundll32.exe:3504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U7UWTV3V\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NL66L3PU\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\255OZE0M\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F13JBULU\desktop.ini (67 bytes)

The process %original file name%.exe:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\xm\common.dll (32892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\xm\cache\resolve1 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xiaomi_1478.7z (55748 bytes)
C:\Windows\System32\drivers\etc\hosts2 (893 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xiaomi_1478.7z (0 bytes)
C:\Windows\System32\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\tianqi]
"LAST_UPDATE" = "0F E7 5C 59"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 01 00 00 00 09 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "127.0.0.1"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 01 00 00 00 09 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\tianqi]
"base_dir" = "44 3A 5C"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\bb093c2dc70e911d46a7d14c3ccb4cc5_RASAPI32]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 893 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ????(??)????????
Product Name: ??
Product Version: 14.50
Legal Copyright: Copyright (C) 2017
Legal Trademarks:
Original Filename: ??.exe
Internal Name: ??.exe
File Version: 14.50
File Description: ?????????
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://download.qiangxm.com.w.kunlunea.com/resolve1	221.204.226.187
hxxp://download.qiangxm.com.w.kunlunea.com/tianqi/common9.dll	221.204.226.187
hxxp://download.qiangxm.com.w.kunlunea.com/xiaomi_1478.7z	221.204.226.187
hxxp://download.qiangxm.com/tianqi/common9.dll	221.204.226.187
hxxp://download.qiangxm.com/resolve1	221.204.226.187
hxxp://download.qiangxm.com/xiaomi_1478.7z	221.204.226.187
teredo.ipv6.microsoft.com	157.56.106.189

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /resolve1 HTTP/1.1

User-Agent: xiaomitq/14.74 (Windows 6.1.7601.17725)

Host: download.qiangxm.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 4

Connection: keep-alive

Date: Wed, 05 Jul 2017 12:58:26 GMT

x-oss-request-id: 595CE272D8238DB65A3D9F79

Accept-Ranges: bytes

ETag: "2B3F6572E7FDBA9F1FBD039131B0BAA2"

Last-Modified: Wed, 21 Jun 2017 02:09:37 GMT

x-oss-object-type: Normal

x-oss-hash-crc64ecma: 10382780716175649377

x-oss-storage-class: Standard

Content-MD5: Kz9lcuf9up8fvQORMbC6og==

x-oss-server-time: 1

Via: cache3.l2et2-1[0,200-0,H], cache19.l2et2-1[2,0], kunlun10.cn102[50,200-0,M], kunlun8.cn102[52,0]

Age: 1164

X-Cache: MISS TCP_MISS dirn:-2:-2

X-Swift-SaveTime: Wed, 05 Jul 2017 13:17:50 GMT

X-Swift-CacheTime: 3600

Timing-Allow-Origin: *

EagleId: ddcce28814992606707823582e
M.@.....


GET /tianqi/common9.dll HTTP/1.1

User-Agent: xiaomitq/14.74 (Windows 6.1.7601.17725)

Host: download.qiangxm.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-msdownload

Content-Length: 246272

Connection: keep-alive

Date: Wed, 05 Jul 2017 13:18:01 GMT

x-oss-request-id: 595CE709A5AF039565817301

Accept-Ranges: bytes

ETag: "D53016E6950ACD84397AD35314CBC03D"

Last-Modified: Wed, 05 Apr 2017 00:41:10 GMT

x-oss-object-type: Normal

x-oss-hash-crc64ecma: 13926214360344119756

x-oss-storage-class: Standard

Content-MD5: 1TAW5pUKzYQ5etNTFMvAPQ==

x-oss-server-time: 24

Via: cache27.l2nu16-1[275,200-0,H], cache18.l2nu16-1[277,0], kunlun1.cn102[10297,200-0,M], kunlun8.cn102[10299,0]

Age: 0

X-Cache: MISS TCP_MISS dirn:-2:-2

X-Swift-SaveTime: Wed, 05 Jul 2017 13:18:01 GMT

X-Swift-CacheTime: 3600

Timing-Allow-Origin: *

EagleId: ddcce28814992606712405671e
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L...(...
...........#................p..............f..........................
................ .....................,...D.......,...................
........p.............................................................
...........................text....................................dat
a...............................@....rsrc.............................
..@...3.91.UPX!.....?..y.@.:{..L.......&......).....=...@Bv..c...e..""
..y.$c...r..x......@p.B.O{NBa.W.j.y...v".G[......o..?.....DS...".<.
l..:.....Y...V...y{...Ik.L.9..3.4@3e...I.I.6.`)W[..........W..D.S[P.u.
....A...s..........J.iS.}.8..$..3......:.PN.."9/X...Z.5N...-X..].$o..E
...F4.B.N....w...P...d./...:.m~.#.j.....d.......S e...uw. .e...... .l.
/V,Q.L.@..u.p.f..........8...K1YL...DO....BB...v...1.5...;.=.@...2A.W.
.8Q..... ....m..}b"...<#....n.d....4e.J....d."~..pv.,..B....e....a.
5....H..........!..............C.......T......40o...mB...>\.\.s...5
.K......i.v.#.....r7*.a...,...Q.....k.%.,.!x......D g>...O...0 . ..
....;V.........B.Y....\......]:..CHy...^biB..`.X...)M.OK.|=......oT...
.s;D.*..}...5......m...'1..k..~...O....J.P"...0.j>.E...l.w..u(..Q=.
i"B.. |:.. ..(ra..$.u.m......X...."5.i..t.h.......=..Q.......P.~.3*...
..#d...l....d...L.h.v...-......c.zF]H...L^g..xG..N..0...*}...W.....Q5.
Vf.....G......C&i....'..q.u.G.V.?4g,..P$......)R.}..a/..d.W..?:h. -..1
..a.IS^..%.;...w...6..a.z.xT.....x....tG.q....~.W.m...V..T..E..CEx
<<< skipped >>>

GET /xiaomi_1478.7z HTTP/1.1

User-Agent: xiaomitq/14.74 (Windows 6.1.7601.17725)

Host: download.qiangxm.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 433693

Connection: keep-alive

Date: Wed, 05 Jul 2017 13:18:08 GMT

x-oss-request-id: 595CE710B2B5A7D4345B330E

Accept-Ranges: bytes

ETag: "6A704047BA1BDD32539BFC0136AC180F"

Last-Modified: Wed, 05 Jul 2017 03:27:23 GMT

x-oss-object-type: Normal

x-oss-hash-crc64ecma: 12258743455532311112

x-oss-storage-class: Standard

Content-MD5: anBAR7ob3TJTm/wBNqwYDw==

x-oss-server-time: 136

Via: cache29.l2nu16-1[60,304-0,H], cache33.l2nu16-1[72,0], kunlun7.cn102[104,200-0,H], kunlun8.cn102[107,0]

Age: 0

X-Cache: HIT TCP_REFRESH_HIT dirn:10:304402766

X-Swift-SaveTime: Wed, 05 Jul 2017 13:18:08 GMT

X-Swift-CacheTime: 3544

Timing-Allow-Origin: *

EagleId: ddcce28814992606881034277e
7z..'.....1.........Z........C....I..].&..p.........../D.N... .S....N.
..c@HC).|W1.mg&I........=,...F...2..f...,.....Q....T\.c.#.6...E...8..B
.x............s......l...[.....o.4.#..;.....h-...@.1..x./......xI.u...
#.\US.sI.vN<.......@.w.Pt..~^f..D.$e.lj.1...F.........b.K....Hw8?..
.. U....x..#..v.).....L..T........>r/M......w`H{</.........xkk.8
.[j...0i8.$.?..l..:......... C......$......pBv...Q....D.N.........w.F5
.6..-..F=...3.....7q.......g.n...<.{....;S....4.&.=.Z.l./M..wV.....
*C[..I5.>YQ!...p..0.2py_.s.H.3....[..E..0...cWf.=...I.#;..D......i.
.1)a...m..C.o...f .qK._....[...U.....G....@....X..x.........a..a.¦..
q4..........B...].r%../.-.K.~T...R.[o......c"6@`.....B~......=.....P[e
.I../.&.L.............I|....P...W..=....@..4..Q..- 8..~......:. ..k..s
.'oNX.Jl..._.I.X!....g..F...p..F...0w..:.U8...6t.L:l.....^...t.z.S...?
G...g].9.....f|V@o..Y|...YgG..........}T.l..z./ b....G..k>.Y..=.h..
Yqvl."...}.....mM...qu.h.c..GMnq..O(.BYqh;<.......g-.&g....{U|.plu.
...n.*O..._Vo/...:.}x..F-.."......m*..OT...%..i!8.,......"....~fDB..  
.....p7.].&.|....|.g.,,i....)y..&....V.U....p.J..<.}....q......a/.u
r..K....&.y.?..L...Q..z&_3......X......l.MYWGqT.....6.d.u.. ..,...:...
..q.....gZ....Vb...iURjH&.y..S...........]...'4@.U....d...?z.G........
.r..... ..kw16.O.. ..t%.... ...D.....,T.x..&..X3o..7.SY.C.............
.H......=.x...X...p8.U.....aG6c......Y.F..!.s.F...S..4....K..>..P..
.}gEF.C?....fd....?kw..cm=....d._~.p...QGb.u......@Xgl.4.(B..`.d......
e.3.<.Q....h.3.....{...4gk..I~.U.b.:i....!|d.. EL-......y.\.6..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   rundll32.exe:3504
   %original file name%.exe:1796

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U7UWTV3V\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NL66L3PU\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\255OZE0M\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F13JBULU\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\xm\common.dll (32892 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\xm\cache\resolve1 (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xiaomi_1478.7z (55748 bytes)
   C:\Windows\System32\drivers\etc\hosts2 (893 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.