MD5: 439e8970a49597f1297a16c2a8d8254f
SHA1: 900ccf130e6691dfe581da877a586917a269d07a
SHA256: 0d92d5db4950c977a97b5cfcdece0bc0073c549d236a9219fc8f6b7b34c16ac4
SSDeep: 6144:rc0h522p3l04ZMSmIp3Uy28uhy45Il3u1dAgC1VqV0ulKSoZVFqfJ3XmSdPVlfj:bhxp3lZnT9bDkCl3IdX30HcWSFVlL
Size: 434695 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-08-14 22:15:49
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Zum creates the following process(es):

%original file name%.exe:2928
sever.exe:2980
porn.exe:1796

The Zum injects its code into the following process(es):

trojaner.exe:2528

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2928 makes changes in the file system.
The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_424572 (0 bytes)

The process sever.exe:2980 makes changes in the file system.
The Zum creates and/or writes to the following file(s):

C:\Windows\trojaner\trojaner.exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DF992C79608D27EEF3.TMP (0 bytes)

The process porn.exe:1796 makes changes in the file system.
The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\__tmp_rar_sfx_access_check_424915 (0 bytes)

Registry activity

The process %original file name%.exe:2928 makes changes in the system registry.
The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\WinRAR SFX]
"C%%Program Files%%temp&" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process trojaner.exe:2528 makes changes in the system registry.
The Zum creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Zum adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"trojaner" = "C:\Windows\trojaner\trojaner.exe"

The process porn.exe:1796 makes changes in the system registry.
The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Zum's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 7
7998a7f7e227c2e50ff5a7803cc68900
a31cf8a5c0878eb20b080e211edfa03b
fc5ec84bb3e7e2cb9fa8067ee38cfc2d
cd6886a90b9f806a9b54e9447d96c8cc
2bfa346a8352e82dcea968b994e2e4f9
6cf40788e674f459c9e414b8794ee3be
5c37d8d2322321dc9f2621b4e3f31b98

URLs

URL	IP
xfunx.ddns.net	77.20.141.107
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Zum connects to the servers at the folowing location(s):

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2928
   sever.exe:2980
   porn.exe:1796

2. Delete the original Zum file.
   
3. Delete or disinfect the following files created/modified by the Zum:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)
   C:\Windows\trojaner\trojaner.exe (96 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "trojaner" = "C:\Windows\trojaner\trojaner.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.