MD5: 3095062d5c13bf3698fa5b850bc0ffd8
SHA1: 47224c10e782a4ed163d233aa7749a6f96429c19
SHA256: b056e2fbce8b200320bfc2579368eae3985f8b224738cea248a300e9ea952688
SSDeep: 768:wbl/cAg05O9cCP41esVe2rGR1phlAMIquBNk9iUF8884daF:8l5iU7eUGR1V7QuFRQF
Size: 39936 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company:
Created at: 2018-01-26 15:17:40
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

%original file name%.exe:2028

The Application injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2028 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\VLIB6YW1NS\VLIB6YW1N.exe.config (1 bytes)
%Program Files%\VLIB6YW1NS\uninstaller.exe.config (1 bytes)
%Program Files%\VLIB6YW1NS\uninstaller.exe (196 bytes)
%Program Files%\VLIB6YW1NS\VLIB6YW1N.exe (50524 bytes)

Registry activity

The process %original file name%.exe:2028 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\3095062d5c13bf3698fa5b850bc0ffd8_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\3095062d5c13bf3698fa5b850bc0ffd8_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\3095062d5c13bf3698fa5b850bc0ffd8_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\3095062d5c13bf3698fa5b850bc0ffd8_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\3095062d5c13bf3698fa5b850bc0ffd8_RASMANCS]
"EnableFileTracing" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: 6K53JEPS
Product Name: 6K5
Product Version: 5.5.0.7
Legal Copyright: Copyright (c) 2520
Legal Trademarks:
Original Filename: Oa222.exe
Internal Name: Oa222.exe
File Version: 5.5.0.7
File Description: 6K53JEPSM
Comments: 6K5
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://asedownloadgate.com/download/3/wizzcaster_v2.exe	46.105.121.115
hxxp://asedownloadgate.com/download/3/wizzcaster_uninstaller_v2.exe	46.105.121.115

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

GET /download/3/wizzcaster_v2.exe HTTP/1.1

Host: asedownloadgate.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 10 Apr 2018 12:28:25 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="wizzcaster_v2.exe"

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-msdownload
a2a00..MZ......................@......................................
.........!..L.!This program cannot be run in DOS mode....$.......PE..L
...@..Z.........."...0..............4... ...@....@.. .................
...................@..................................4..O....@.......
................`.......4.............................................
.. ............... ..H............text........ ...................... 
..`.rsrc........@......................@..@.reloc.......`.......(.....
.........@..B.................4......H........!.............../..X....
........................................0..o.......(....~....o....s...
.o.............~....(....(......(....o....r...po.....(.....o....t"....
......%...o....&..&..*.........kk.......0..M........(.....s....%(.....
o....o ...%.o!...%.o"...%o#.......io$....o%...(.....o&...*Vr...p.....r
9..p.....*..('...*.~....-.rm..p.....((...o)...s*........~....*.~....*.
......*.~....*..( ...*Vs....(,...t.........*.BSJB............v2.0.5072
7......l...t...#~......$...#Strings............#US.........#GUID......
.D...#Blob...........W..........3........ ...................,........
...........................................Q.................c........
...4.................q.......................C.......................!
.....Q.....h.....(.......'...6.......e.....e.....................U....
.b.......................B..... ...........m.................s.....g..
.......................................8.=...........r.=...........r.e
.......~.......................N...P ............. ............5!.
<<< skipped >>>

GET /download/3/wizzcaster_uninstaller_v2.exe HTTP/1.1

Host: asedownloadgate.com

HTTP/1.1 200 OK

Date: Tue, 10 Apr 2018 12:28:25 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="wizzcaster_uninstaller_v2.exe"

Transfer-Encoding: chunked

Content-Type: application/x-msdownload
6e00..MZ......................@.......................................
........!..L.!This program cannot be run in DOS mode....$.......PE..L.
..B..Z.........."...0..Z..........fx... ........@.. ..................
..................@..................................x..O....... .....
.......................w..............................................
. ............... ..H............text...lX... ...Z.................. .
.`.rsrc... ............\..............@..@.reloc...............l......
........@..B................Gx......H........!.............../...G....
.......................................0..o.......(....~....o....s....
o.............~....(....(......(....o....r...po.....(.....o....t".....
.....%...o....&..&..*.........kk.......0..M........(.....s....%(.....o
....o ...%.o!...%.o"...%o#.......io$....o%...(.....o&...*Vr...p.....r9
..p.....*..('...*.~....-.rm..p.....((...o)...s*........~....*.~....*..
.....*.~....*..( ...*Vs....(,...t.........*.BSJB............v2.0.50727
......l...t...#~......$...#Strings............#US.........#GUID.......
D...#Blob...........W..........3........ ...................,.........
..........................................Q.................c.........
..4.................q.......................C.......................!.
....Q.....h.....(.......'...6.......e.....e.....................U.....
b.......................B..... ...........m.................s.....g...
......................................8.=...........r.=...........r.e.
......~.......................N...P ............. ............5!..
<<< skipped >>>

The Application connects to the servers at the folowing location(s):

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2028

2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:
   

   %Program Files%\VLIB6YW1NS\VLIB6YW1N.exe.config (1 bytes)
   %Program Files%\VLIB6YW1NS\uninstaller.exe.config (1 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.