Generic.ServStart.A.276C88ED_e51d220f7c
Susp_Dropper (Kaspersky), Generic.ServStart.A.276C88ED (B) (Emsisoft), Generic.ServStart.A.276C88ED (AdAware), DDoSNitol.YR (Lavasoft MAS)
Behaviour: Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
The sample has been submitted by Lavasoft customers.
| Requires JavaScript enabled! |
|---|
MD5: e51d220f7c36714e7b156e2b36ec80fe
SHA1: 11c3ca9bccf3ac024295f169e17474c1bed29f0f
SHA256: f1518e7cb8349ef02295a18bb612b1a3f11d0db6caff264c4e3a92d72f97d1ff
SSDeep: 768:DyQyXXEcU7vLyZ6RMMggd7mADjSYCv/UPnkrLlm/:DyQyXX96y1SdjSYCXOH/
Size: 35939 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2016-11-06 15:16:40
Analyzed on: Windows7 SP1 32-bit
Summary:
Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.
Payload
No specific payload has been found.
Process activity
The Generic creates the following process(es):
%original file name%.exe:600
The Generic injects its code into the following process(es):
No processes have been created.
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:600 makes changes in the file system.
The Generic creates and/or writes to the following file(s):
C:\Windows\hyhjyc.exe (35 bytes)
Registry activity
The process %original file name%.exe:600 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
"AutoDetect" = "1"
[HKLM\System\CurrentControlSet\services\Mnopqr Tubabb Def]
"Description" = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya"
The Generic deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
Company Name: zdfdcxsxawe r6yu567uasdfdsfg
Product Name: sertfhgjnxfvfhjhjm,dfgdgtf
Product Version: 1, 0, 0, 1
Legal Copyright: ????(C) 2016
Legal Trademarks: zsdfe5t6y 68isdf rtuyj
Original Filename: srfcvxbgfyj 6t7ydfgt uj
Internal Name: we4rxdfcvfghn yui8kdfg gfuj
File Version: w34rdgfxdcv rtyuwe3r e465y6i87
File Description: sdergfdgtfhfhjnxcvbvnmbjm,
Comments:
Language: Chinese (Simplified, PRC)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .data | 4096 | 30078 | 30208 | 4.35155 | 68a943c4352ecf83ae62df2b07db4aa6 |
| .rsrc | 36864 | 4608 | 4608 | 2.33805 | 679611033706c06814b787a68f830ea8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
5b4c8d318101eae0fba5492c5d5a83a1
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Generic connects to the servers at the folowing location(s):
.data
.rsrc
WS2_32.dll
KERNEL32.dll
ADVAPI32.dll
RegOpenKeyA
RegCloseKey
lhx.kfj.cc
hra%u.dll
kernel32.dll
%c%c%c%cÌn.exe
ddd
%c%c%c%c%c%c.exe
%s %s %s%d
%d*%u%s
%u MB
0.0.0.0
%u Gbps
%u Mbps
GET %s HTTP/1.1
Host: %s
User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0
Referer: hXXp://%s:80/hXXp://%s
%s %s%s
Host: %s:%d
User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)
User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
%d.%d.%d.%d
GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm
WinExec
GetWindowsDirectoryA
USER32.dll
RegOpenKeyExA
ShellExecuteExA
ShellExecuteA
SHELL32.dll
SHDeleteKeyA
SHLWAPI.dll
iphlpapi.dll
NETAPI32.dll
MSVCRT.dll
_acmdln
1, 0, 0, 1
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:600
- Delete the original Generic file.
- Delete or disinfect the following files created/modified by the Generic:
C:\Windows\hyhjyc.exe (35 bytes)
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
