MD5: 76668dd0a8e316f79d7ce102bcda37f3
SHA1: 67a17e4744252b4734f75dc802e64ba8404321c4
SHA256: c9d6b5d14ea9c720581341cbe14ee1d7d8be5f2cfcfec0501aafea16723c95e3
SSDeep: 12288:Io4xtu252WenNL0JZE2aIfi4tfBPAg0rPYi57EcPOBn roFoOCHE03LnQfmSeIv6:Io43vymG2PBfJC9FOBnTaJ3LQfbeIXi
Size: 871136 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: /Soft company
Created at: 2007-03-31 18:09:55
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ACS Pro Patch 64 bits by Roonney.exe:1780
%original file name%.exe:2984

The Trojan injects its code into the following process(es):

Windows.exe:2504

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ACS Pro Patch 64 bits by Roonney.exe:1780 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files% (x86)\IObit\Advanced SystemCare\Add Host.cmd (5 bytes)
%Program Files% (x86)\IObit\Advanced SystemCare\ASC9.ico (841 bytes)
%Program Files% (x86)\IObit\Advanced SystemCare\OFCommon.dll (11231 bytes)

The Trojan deletes the following file(s):

%Program Files% (x86)\IObit\Advanced SystemCare\__tmp_rar_sfx_access_check_424244 (0 bytes)

The process Windows.exe:2504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Imminent\Logs\20-04-2017 (162 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Imminent\Geo.dat (54 bytes)

The process %original file name%.exe:2984 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ACS Pro Patch 64 bits by Roonney.exe (14595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Windows.exe (28495 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsc7760.tmp (0 bytes)

Registry activity

The process ACS Pro Patch 64 bits by Roonney.exe:1780 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Windows.exe:2504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\windows_RASAPI32]
"FileDirectory" = "%windir%\tracing"

The process %original file name%.exe:2984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1412 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
e87513e19bc3a8eaec3ad6a98db43396

URLs

URL	IP
hxxp://iptrackeronline.com/
hxxp://www.iptrackeronline.com/	132.148.73.239
teredo.ipv6.microsoft.com	157.56.106.189
dikosoft.zapto.org	41.102.194.134
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36

Host: VVV.iptrackeronline.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 20 Apr 2017 18:52:29 GMT

Server: Apache/2.4.6 (CentOS) PHP/5.4.16

X-Powered-By: PHP/5.4.16

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8
2b43..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft
-com:vml">.<head>...<meta name="viewport" content="width=d
evice-width" />..<meta name="google-site-verification" content="
CyeqoD4FJhDmQx8oZ3yZY1-4utytwBE97dvSqELW5UQ" />.<meta name="msva
lidate.01" content="6F8096A65FE90197E73B42CDE4CC4938" />..<meta 
http-equiv="Content-Type" content="text/html; charset=utf-8" />.<
;meta http-equiv="Content-Language" content="en-us">.<meta name=
"description" content="ipTRACKERonline is the Swiss Army Knife of IP A
ddress Tracking. From email header analysis to IP geolocation this is 
the only IP tracking website to use." />....<meta name="historic
" content="Geo Location, geomarketing, Geo Marketing, DNS tools, my ip
 ,ip, address, ,DNS Monitoring, Network Tools, my, what, is, find, get
, show, locate, geolocation, change, location, how, do, ip address, pr
oxy, server, anonymous, hide, conceal, stealth, surf, web, anonymizer,
 anonymize, changer, privacy, geolocation, geolocate, lookup, look up,
 locate, trace, track, email, source, headers" />....<link rel="
stylesheet" type="text/css" href="templates/fisubsilver/fisubsilver.cs
s" />.<!--<link rel='stylesheet' type='text/css' href='menu/s
tyles.css' />-->..<link rel='stylesheet' type='text/css' href
='css/menu-styles.css' />..<link rel='stylesheet' type='text
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

l.dlf

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   ACS Pro Patch 64 bits by Roonney.exe:1780
   %original file name%.exe:2984

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files% (x86)\IObit\Advanced SystemCare\Add Host.cmd (5 bytes)
   %Program Files% (x86)\IObit\Advanced SystemCare\ASC9.ico (841 bytes)
   %Program Files% (x86)\IObit\Advanced SystemCare\OFCommon.dll (11231 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Imminent\Logs\20-04-2017 (162 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Imminent\Geo.dat (54 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ACS Pro Patch 64 bits by Roonney.exe (14595 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Windows.exe (28495 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.