MD5: 03da32d55158d23cfd6576d9404c80f2
SHA1: e472455e96585284a99249595757ef6f708d86bd
SHA256: 3d96aa0d7219f49e921ee93674ada9078075cd651964d8b02b8e9468844d5f42
SSDeep: 3072:jxSccsWlXCFLcVygJKLCqvjM9YORns NweZqoa2jDiQt:jIDClLCqvjM9ts H Qt
Size: 196568 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2004-09-12 12:55:29
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ntvdm.exe:2044

The Trojan injects its code into the following process(es):

03da32d55158d23cfd6576d9404c80f2.usr:684
%original file name%.exe:1804

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ntvdm.exe:2044 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (269 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (0 bytes)

The process %original file name%.exe:1804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
C:\03da32d55158d23cfd6576d9404c80f2.usr (86442 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
C:\Windows\USR_Shohdi_Photo_USR.exe (6889123 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.usr (0 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.usr (0 bytes)

Registry activity

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
teredo.ipv6.microsoft.com	157.56.106.189
sys.zief.pl	148.81.111.121
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Reply Sinkhole - irc-sinkhole.cert.pl

Traffic

The Trojan connects to the servers at the folowing location(s):

`.rsrc

D$(PSSh

ccRegVfy.exe

ccApp.exe

IEXPLORE.EXE

windows

\*.exe

.text

.data

.rsrc

msvcrt.dll

KERNEL32.dll

nddeapir.pdb

_acmdln

m.Zw%

ADVAPI32.DLL

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Qoysys.zief.pl

core.ircgalaxy.pl

NICK avabcadz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x %s

JOIN

127.0.0.1 jL.chura.pl

#<iframe src="hXXp://jL.chura.pl/rc/" style="width:1px;height:1px"></iframe>

KERNEL32.DLL

windowsupdate

drweb

user32.dll

kernel32.dll

MSVCIRT.dll

MSVCRT.dll

5.1.2600.0 (xpclient.010817-1148)

NDDEAPIR.EXE

Windows

Operating System

5.1.2600.0

%original file name%.exe_1804_rwx_00401000_00002000:

D$(PSSh

%original file name%.exe_1804_rwx_00419000_00005000:

ADVAPI32.DLL

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Qoysys.zief.pl

core.ircgalaxy.pl

NICK avabcadz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x %s

JOIN

127.0.0.1 jL.chura.pl

#<iframe src="hXXp://jL.chura.pl/rc/" style="width:1px;height:1px"></iframe>

KERNEL32.DLL

windowsupdate

drweb

03da32d55158d23cfd6576d9404c80f2.usr_684:

.text

.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

.tTPV

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

RCv=kAv.SCv

fpmmcsat.dll

SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\4.0

{0A7443C7-6E9A-11D2-AAA2-00A0C90F57B0}

msi.dll

kernel32.dll

user32.dll

portuguese-brazilian

RegCloseKey

RegOpenKeyExA

GetCPInfo

c:\03da32d55158d23cfd6576d9404c80f2.usr

.at:L0

4.0.2.7523

FPMMC.DLL

, Windows

are registered trademarks of Microsoft Corporation, and WebBot is a trademark of Microsoft Corporation, in the United States and/or other countries.

03da32d55158d23cfd6576d9404c80f2.usr_684_rwx_00411000_00005000:

.at:L0

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   ntvdm.exe:2044
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (335 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (269 bytes)
   C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
   C:\03da32d55158d23cfd6576d9404c80f2.usr (86442 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
   C:\Windows\USR_Shohdi_Photo_USR.exe (6889123 bytes)

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.