MD5: 22f929ce1ca36cb691e688649ef87f06
SHA1: 8f52076e67ed47bd0fda0beb7b97376315761404
SHA256: 050d1c5d69c42adb1814d5d65c5f0e493392da5f91404ec8c299f44672de4bfa
SSDeep: 768:xkHUucR2Xy8sx5nzMRLuIzZuiD0DRuA0:yHUuq6oxtdIzciADRu9
Size: 25088 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PECompactV2X, PECompactv20, UPolyXv05_v6
Company: no certificate found
Created at: 2013-12-06 02:39:22
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):
No processes have been created.
The Backdoor injects its code into the following process(es):

%original file name%.exe:1396

File activity

The process %original file name%.exe:1396 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Program Files%\Common Files\%original file name%.exe (25088 bytes)
C:\koreaautoup.bmp (36 bytes)
%System%\drivers\etc\hosts (20712260 bytes)
%System%\drivers\etc\hosts.ics (20712260 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\919687\TemporaryFile (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\919687 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\919609\TemporaryFile (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\919609 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\919609\TemporaryFile\TemporaryFile (0 bytes)

Registry activity

The process %original file name%.exe:1396 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 2E 1D EB 21 FE 46 11 5B C5 61 BD E6 C5 62 BC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ServerInfoTimeOut" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"jinyo" = "%Program Files%\Common Files\%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"DnsCacheEnabled" = "0"
"DnsCacheTimeout" = "0"

Network activity (URLs)

No activity has been detected.

HOSTS file anomalies

The Backdoor modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 10488644 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Backdoor file.
   
3. Delete or disinfect the following files created/modified by the Backdoor:
   

   %Program Files%\Common Files\%original file name%.exe (25088 bytes)
   C:\koreaautoup.bmp (36 bytes)
   %System%\drivers\etc\hosts (20712260 bytes)
   %System%\drivers\etc\hosts.ics (20712260 bytes)
   

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.