Backdoor.Win32.Fynloski_dd3268054d
Artemis!DD3268054DCD (McAfee), AutoIt:MalOb-DV [Trj] (Avast), Backdoor.Win32.Fynloski.FD, Trojan.Win32.Iconomon.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR, GenericDownloader.YR, GenericInjector.YR, BackdoorFynloski.YR, TrojanDownloaderAndromeda.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Backdoor, Worm, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: dd3268054dcd35c9b61890095f59b08d
SHA1: eb57b691375f2ab0d835b8d59628b8c652e413db
SHA256: c26612eb7b525d62ddfa9381d9739b4d8c2339036fef49168e05d6327bad1244
SSDeep: 49152:VJZoQrbTFZY1ia/1hJnyk2uAI390Oqqtv:VtrbTA13XL0dqtv
Size: 1619940 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Firseria
Created at: 2012-01-29 23:32:28
Summary:
Backdoor. Malware that enables a remote control of victim's machine.
Payload
No specific payload has been found.
Process activity
The Backdoor creates the following process(es):
AntiVirusPRO.exe:572
%original file name%.exe:384
wuauclt.exe:344
jusched.exe:1056
The Backdoor injects its code into the following process(es):
AntiVirusPRO.exe:216
File activity
The process AntiVirusPRO.exe:572 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\res.ico2 (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\res.ico (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (7185 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
The process %original file name%.exe:384 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (7185 bytes)
%Documents and Settings%\%current user%\Local Settings\Tempscratch.cmd (160 bytes)
%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe (10177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\res.ico (4545 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
The process wuauclt.exe:344 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
The Backdoor deletes the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)
The process jusched.exe:1056 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)
Registry activity
The process AntiVirusPRO.exe:216 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 1F 27 62 01 13 5A 6C D4 64 01 C5 72 96 B8 71"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process AntiVirusPRO.exe:572 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 FF 05 CB 6B 8E 69 C2 F2 E0 FD 13 A2 BD 0E 17"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusPRO" = "%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusPRO" = "%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe"
The process %original file name%.exe:384 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 AF 89 C4 AA 32 F7 32 36 DE 30 8E 6F A3 7B CC"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Network activity (URLs)
No activity has been detected.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
AntiVirusPRO.exe:572
%original file name%.exe:384
wuauclt.exe:344 - Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\Temp\res.ico2 (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (7185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (7185 bytes)
%Documents and Settings%\%current user%\Local Settings\Tempscratch.cmd (160 bytes)
%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe (10177 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusPRO" = "%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusPRO" = "%Documents and Settings%\%current user%\Application Data\AntiVirusPRO.exe" - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
