MD5: bea44cc7f94488bd3684207c41435d0c
SHA1: aae1bc742c88703cca012edfcb5bd6a6471125df
SHA256: 0dfac0de09d2b4d50bf54b9767c64248602c4721dce3651247f851eb0048176c
SSDeep: 3072:dCjqja3gkVKLn73fm5yGppvnsXUmdJ/YJiA/2CnoKq3QQJ8nq3hQtpqB3y6EaIs:dCjqygaKLnLeQyvsXUmd5LA/7noK0QQl
Size: 195072 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: Mail.Ru
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2928

The Trojan injects its code into the following process(es):

taskhost.exe:1940
Dwm.exe:2008
Explorer.EXE:2024
conhost.exe:2520

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp459c433b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Fauzli\olzau.exe (391 bytes)

Registry activity

The process %original file name%.exe:2928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Dyiwd]
"Ybunage" = "AC A7 77 1F 69 61 53 39 42 03 08 23 DC CC 85 16"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExW
InternetReadFileExA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoA
InternetCloseHandle

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

SetCursorPos
ReleaseCapture
SetCapture
GetMessagePos
DefDlgProcW
CallWindowProcA
DefMDIChildProcA
DefFrameProcA
GetUpdateRgn
DefFrameProcW
DefMDIChildProcW
DefDlgProcA
GetClipboardData
GetMessageW
TranslateMessage
PeekMessageW
EndPaint
BeginPaint
GetDC
ReleaseDC
DefWindowProcW
GetWindowDC
GetDCEx
CallWindowProcW
PeekMessageA
GetMessageA
RegisterClassExW
RegisterClassW
RegisterClassA
DefWindowProcA
GetUpdateRect
GetCursorPos
GetCapture
RegisterClassExA
OpenInputDesktop
SwitchDesktop

The Trojan installs the following user-mode hooks in WS2_32.dll:

send
WSASend
closesocket

The Trojan installs the following user-mode hooks in kernel32.dll:

GetFileAttributesExW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
ZwCreateUserProcess

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

HTTP/1.0

urlmon.dll

cabinet.dll

"8 '3)39

=!*73/;-~4*6

!5$=4>4|8$:

2652&436

;&% 60798.

1 /);= '

$4%$'> 7

4)#04#3%3)

#$1'<2=4

/" !-*>"  5

5("15"2$2)

%$4.-&&$-

.ah8).;=)5;m3$4)

F{qbfqawAQv}kwhucp[Ootfpci{.Lp{fZFRDm}R[S

"?5&"5%3%5

/45'77.)'

PR_OpenTCPSocket

HTTP/1.1

hXXp://

hXXps://

HTTP/1.

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

.info

X-ID: %u=%s=%s

HTTP/1.1 200 OK

RapportUtil

GetProcessHeap

KERNEL32.dll

GetKeyboardState

MsgWaitForMultipleObjects

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

MapVirtualKeyW

SetKeyboardState

ExitWindowsEx

USER32.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

RegEnumKeyExW

ADVAPI32.dll

UrlUnescapeA

SHDeleteKeyW

PathIsURLW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

3 3$3(3,3

;&; ;1;{;

;$;-;<;'=

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

SysShadow

nspr4.dll

Global\XXX

C:\Users\"%CurrentUserName%"\AppData\Roaming\Upim\leong.noe

C:\Users\"%CurrentUserName%"\AppData\Roaming\Upim

leong.noe

C:\Users\"%CurrentUserName%"\AppData\Roaming

{02106CE3-BC8D-83FE-1B40-3488A5272D7D}

Global\{946BDEC6-0EA8-1585-1B40-3488A5272D7D}

Dwm.exe_2008_rwx_004C0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

HTTP/1.0

urlmon.dll

cabinet.dll

"8 '3)39

=!*73/;-~4*6

!5$=4>4|8$:

2652&436

;&% 60798.

1 /);= '

$4%$'> 7

4)#04#3%3)

#$1'<2=4

/" !-*>"  5

5("15"2$2)

%$4.-&&$-

.ah8).;=)5;m3$4)

F{qbfqawAQv}kwhucp[Ootfpci{.Lp{fZFRDm}R[S

"?5&"5%3%5

/45'77.)'

PR_OpenTCPSocket

HTTP/1.1

hXXp://

hXXps://

HTTP/1.

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

.info

X-ID: %u=%s=%s

HTTP/1.1 200 OK

RapportUtil

GetProcessHeap

KERNEL32.dll

GetKeyboardState

MsgWaitForMultipleObjects

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

MapVirtualKeyW

SetKeyboardState

ExitWindowsEx

USER32.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

RegEnumKeyExW

ADVAPI32.dll

UrlUnescapeA

SHDeleteKeyW

PathIsURLW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

3 3$3(3,3

;&; ;1;{;

;$;-;<;'=

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

SysShadow

nspr4.dll

Global\XXX

C:\Users\"%CurrentUserName%"\AppData\Roaming

{02106CE3-BC8D-83FE-1B40-3488A5272D7D}

Global\{946BDEC6-0EA8-1585-1B40-3488A5272D7D}

Explorer.EXE_2024_rwx_02D60000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

HTTP/1.0

urlmon.dll

cabinet.dll

"8 '3)39

=!*73/;-~4*6

!5$=4>4|8$:

2652&436

;&% 60798.

1 /);= '

$4%$'> 7

4)#04#3%3)

#$1'<2=4

/" !-*>"  5

5("15"2$2)

%$4.-&&$-

.ah8).;=)5;m3$4)

F{qbfqawAQv}kwhucp[Ootfpci{.Lp{fZFRDm}R[S

"?5&"5%3%5

/45'77.)'

PR_OpenTCPSocket

HTTP/1.1

hXXp://

hXXps://

HTTP/1.

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

.info

X-ID: %u=%s=%s

HTTP/1.1 200 OK

RapportUtil

GetProcessHeap

KERNEL32.dll

GetKeyboardState

MsgWaitForMultipleObjects

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

MapVirtualKeyW

SetKeyboardState

ExitWindowsEx

USER32.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

RegEnumKeyExW

ADVAPI32.dll

UrlUnescapeA

SHDeleteKeyW

PathIsURLW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

3 3$3(3,3

;&; ;1;{;

;$;-;<;'=

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

SysShadow

nspr4.dll

Global\XXX

C:\Users\"%CurrentUserName%"\AppData\Roaming

{02106CE3-BC8D-83FE-1B40-3488A5272D7D}

Global\{946BDEC6-0EA8-1585-1B40-3488A5272D7D}

conhost.exe_2520_rwx_00070000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

HTTP/1.0

urlmon.dll

cabinet.dll

"8 '3)39

=!*73/;-~4*6

!5$=4>4|8$:

2652&436

;&% 60798.

1 /);= '

$4%$'> 7

4)#04#3%3)

#$1'<2=4

/" !-*>"  5

5("15"2$2)

%$4.-&&$-

.ah8).;=)5;m3$4)

F{qbfqawAQv}kwhucp[Ootfpci{.Lp{fZFRDm}R[S

"?5&"5%3%5

/45'77.)'

PR_OpenTCPSocket

HTTP/1.1

hXXp://

hXXps://

HTTP/1.

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

.info

X-ID: %u=%s=%s

HTTP/1.1 200 OK

RapportUtil

GetProcessHeap

KERNEL32.dll

GetKeyboardState

MsgWaitForMultipleObjects

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

MapVirtualKeyW

SetKeyboardState

ExitWindowsEx

USER32.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

RegEnumKeyExW

ADVAPI32.dll

UrlUnescapeA

SHDeleteKeyW

PathIsURLW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

3 3$3(3,3

;&; ;1;{;

;$;-;<;'=

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

SysShadow

nspr4.dll

Global\XXX

C:\Users\"%CurrentUserName%"\AppData\Roaming

{02106CE3-BC8D-83FE-1B40-3488A5272D7D}

Global\{946BDEC6-0EA8-1585-1B40-3488A5272D7D}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2928
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp459c433b.bat (179 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Fauzli\olzau.exe (391 bytes)

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.