Trojan.Rasftuby.Gen.10_3350fc92e8

by malwarelabrobot on July 2nd, 2017 in Malware Descriptions.

Trojan-Downloader.Win32.Alien.biy (Kaspersky), Trojan.Rasftuby.Gen.10 (B) (Emsisoft), Trojan.Rasftuby.Gen.10 (AdAware), Trojan.MSIL.Bladabindi.2.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 3350fc92e85f3304d38b8e06c14463fb
SHA1: 33f5e89c19c14d905f0420a1e01bd96c1cd96bf3
SHA256: f06e4519ee3696201794deee3eb5ce4614a09559bb541d9d00bf9910ee95844d
SSDeep: 6144:bc0h522p3l04ZMSmIp3Uy28uhyYaa6DtAECalYEV3YPolFgtPHF4z8yfafgbb:Lhxp3lZnT9bDdBApalHV3YPt1Ha9K6b
Size: 572172 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-08-14 22:15:49
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

csrs.exe:3756
WScript.exe:3280
wscript.exe:3900
svchot.sfx.exe:3412
%original file name%.exe:3724
svchot.exe:3692

The Trojan injects its code into the following process(es):

csrs.exe:1472

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process csrs.exe:3756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk (796 bytes)
C:\ProgramData\Windows\csrs.exe (4132 bytes)
C:\ProgramData\Windows\svchost.vbs (1 bytes)

The Trojan deletes the following file(s):

C:\ProgramData\Windows\__tmp_rar_sfx_access_check_1529823 (0 bytes)

The process WScript.exe:3280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Windows\csrs.exe (49 bytes)

The process wscript.exe:3900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\2970.tmp\csrs.exe (359033 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\csrs[1].exe (90351 bytes)

The process svchot.sfx.exe:3412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Windows\svchot.exe (72 bytes)

The Trojan deletes the following file(s):

C:\ProgramData\Windows\__tmp_rar_sfx_access_check_1517359 (0 bytes)

The process %original file name%.exe:3724 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Windows\1.bat (49 bytes)
C:\ProgramData\Windows\svchot.sfx.exe (1897 bytes)

The Trojan deletes the following file(s):

C:\ProgramData\Windows\__tmp_rar_sfx_access_check_1516298 (0 bytes)

The process svchot.exe:3692 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\2970.tmp\2971.vbs (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\2970.tmp\2971.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\2970.tmp\2971.vbs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\2970.tmp (0 bytes)

Registry activity

The process csrs.exe:3756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"