MD5: e3e92b93d71987c5d8eb59d6dd325baf
SHA1: 4b1e1140f957ac1e76aedddd508a23b3985031f8
SHA256: c95060c7f6c48848a88e96d96ae6733e3e157084e604ef48f5646037e487c1b5
SSDeep: 1536:9RrC34NnifgjVdXPcFkCK98TNPzV2XhoBDVoFhfyqsZc0pTW:9RrgQPU920VgUyFhl9 W
Size: 147456 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: Appsinstall
Created at: 2009-06-21 13:18:26
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

Process activity

The Backdoor creates the following process(es):

taskkill.exe:980
taskkill.exe:680
taskkill.exe:840
sc.exe:1248
rundll32.exe:460
cacls.exe:1948
cacls.exe:828

The Backdoor injects its code into the following process(es):

%original file name%.exe:1320

Mutexes

The following mutexes were created/opened:

RasPbFile
WininetStartupMutex
WininetProxyRegistryMutex
WininetConnectionMutex
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
c:!documents and settings!adm!local settings!history!history.ie5!
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
DBWinMutex
ShimCacheMutex
7777UUUU

File activity

The process rundll32.exe:460 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (13 bytes)

The process %original file name%.exe:1320 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
C:\autorun.inf (21 bytes)
%System%\drivers\etc\hosts (5 bytes)
%WinDir% (1352 bytes)
C:\$Directory (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O5EF8PY3\desktop.ini (67 bytes)
%WinDir%\inf (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9HM3K1MR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\K5UNSPAJ\desktop.ini (67 bytes)
%System%\config\systemprofile (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4HI389Q3\desktop.ini (67 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (192 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (8 bytes)
%System%\drivers (776 bytes)
%System%\func.dll (17857847 bytes)
%WinDir%\phpi.dll (22141559 bytes)
%Documents and Settings%\%current user% (4 bytes)
C:\1.exe (673 bytes)
%System%\dllcache (4 bytes)
%System% (1296 bytes)

Registry activity

The process taskkill.exe:980 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 31 F6 BC 60 3D 0F BE F9 A4 07 54 49 24 98 4B"

The process taskkill.exe:680 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 23 ED EA C4 B8 0B 71 06 A0 72 3D 4C 33 20 14"

The process taskkill.exe:840 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 A5 73 3E 1D E1 26 AA B3 A8 23 D9 41 5E E7 C7"

The process sc.exe:1248 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 FB 81 82 51 00 15 E3 84 55 74 C9 69 AB 85 0E"

The process rundll32.exe:460 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 28 EC 48 4D 74 93 C0 18 27 E8 24 38 5D A8 D5"

The process cacls.exe:1948 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 94 0E 72 97 55 84 E7 28 F8 A6 07 8C 09 56 55"

The process cacls.exe:828 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD D1 6E E9 EA 3D 47 CE 77 CD C1 5C CB AA C4 B8"

Dropped PE files

HOSTS file anomalies

The Backdoor modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Backdoor installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Backdoor substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name: ????
Product Version: 4, 3, 1, 1
Legal Copyright: ???? (C) 2009
Legal Trademarks:
Original Filename: notepad.EXE
Internal Name: test
File Version: 1, 0, 0, 1
File Description: Microsoft ???????
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Backdoor connects to the servers at the folowing location(s):

.nsp0

.nsp1

.nsp2

GetWindowsDirectoryA

WinExec

\phpi.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAmemsetsprintfstrcatstrstrstrcpy

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) ) 

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3 

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)-- 

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53 

- .),, ),13)--,53 

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)-- 

20),-1).)--,

20),-1).)---

kjk.om\k)`s`

KERNEL32.DLL

MSVCRT.DLL

1, 0, 0, 1

notepad.EXE

4, 3, 1, 1

%original file name%.exe_1320_rwx_00401000_00018000:

GetWindowsDirectoryA

WinExec

\phpi.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAmemsetsprintfstrcatstrstrstrcpy

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) ) 

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3 

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)-- 

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53 

- .),, ),13)--,53 

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)-- 

20),-1).)--,

20),-1).)---

kjk.om\k)`s`

%original file name%.exe_1320_rwx_10000000_00001000:

.data

.rsrc

@.reloc

psapi.dll

\patch.exe

\dstdisk.exe

\defence.exe

192yuioealdjfiefjsdfas.txt

%SystemRoot%\System32\DRIVERS\puid.sys

\drivers\pcidump.sys

System32\DRIVERS\pcidump.sys

%SystemRoot%\system32\drivers\puid.sys

\\.\pcidump

\drivers\gm.dls

Windows

1.exe

autorun.inf

Open=1.exe

urlmon

\setup.exe

?mac=%s&ver=%s&key=%d&os=windows

.html

.hhqg

qq.exe

360safe.exe

\explorer.exe

\temp\explorer.exe

infect_exe

rundll32.exe_460:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

%original file name%.exe_1320_rwx_10005000_00001000:

\??\c:\%original file name%.exe

\??\%WinDir%\explorer.exe

ers\gm.dls

WinExec

CreatePipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

InternetOpenUrlA

WININET.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   taskkill.exe:980
   taskkill.exe:680
   taskkill.exe:840
   sc.exe:1248
   rundll32.exe:460
   cacls.exe:1948
   cacls.exe:828

3. Delete the original Backdoor file.
   
4. Delete or disinfect the following files created/modified by the Backdoor:
   

   %System%\drivers\acpiec.sys (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
   C:\autorun.inf (21 bytes)
   %System%\drivers\etc\hosts (5 bytes)
   C:\$Directory (300 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O5EF8PY3\desktop.ini (67 bytes)
   %WinDir%\inf (400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9HM3K1MR\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\K5UNSPAJ\desktop.ini (67 bytes)
   %System%\config\systemprofile (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4HI389Q3\desktop.ini (67 bytes)
   %System%\drivers\pcidump.sys (5404535 bytes)
   %WinDir%\Temp\Perflib_Perfdata_7ac.dat (8 bytes)
   %System%\func.dll (17857847 bytes)
   %WinDir%\phpi.dll (22141559 bytes)
   C:\1.exe (673 bytes)
   %System%\dllcache (4 bytes)
   

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.