MD5: 78e4b0808ea0927a271653ca250c7a2f
SHA1: 158ec465211afb8a40875433385ebadf8b9b69b9
SHA256: 7c2ea406ac393a473d61301014a6a4ea2a0e97b8eccd5a82c69bb0346e0ebf8c
SSDeep: 6144:7bI4gRyHj6C3G6Q1v9x8qo1Fyn9XOpzjET2SU8eFPEsT1KDOZL7uErr ix:7bIy6wz03W1U9 SvxeFPEsUDkL7uE7
Size: 444416 bytes
File type: DLL
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Cinema PlusV25.09
Created at: 2010-06-08 12:59:36
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:312
hrl1.tmp:1888

The Trojan injects its code into the following process(es):

qqokqe.exe:1508

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process regsvr32.exe:312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hrl1.tmp (1717 bytes)

The process qqokqe.exe:1508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\RCX2.tmp (24924 bytes)
%System%\hra33.dll (7 bytes)

The Trojan deletes the following file(s):

%System%\hra33.dll (0 bytes)

The process hrl1.tmp:1888 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\qqokqe.exe (2321 bytes)

Registry activity

The process regsvr32.exe:312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 40 47 EE 6F 98 7E B3 D5 55 2F CC D0 0B 10 63"

The process qqokqe.exe:1508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 73 49 9D 8E 99 6B CA E4 5E 1C 42 4E F0 D4 E9"

The process hrl1.tmp:1888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 4C 7E 31 68 E7 CD F9 85 10 B7 74 B0 C1 71 E4"

[HKLM\System\CurrentControlSet\Services\Distribuoyo]
"Description" = "Distribuajk Transaction Coordinator Service."

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SOFTWARE.LOG,"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
ilo.brenz.pl	148.81.111.121
fei9988.3322.org	221.130.179.36

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET CURRENT_EVENTS Known Hostile Domain ilo.brenz.pl Lookup

Traffic

.....h_f..._}...)..-..Y^....q.......7....v.0...X..TG.;.t`:...R~.N...(.



:irc 001 hffzefzh :Hi virtu.:irc 376 hffzefzh :End of /MOTD command.:i
rc 001 hffzefzh :Hi virtu.:irc 376 hffzefzh :End of /MOTD command..:hf
fzefzh JOIN #.364..:hffzefzh JOIN #.364.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

ole32.dll

regsvr32.pdb

_wcmdln

RegCloseKey

RegOpenKeyExW

Excessive # of DLL's on cmdline

5.1.2600.5512 (xpsp.080413-2105)

REGSVR32.EXE

Windows

Operating System

5.1.2600.5512

Usage: regsvr32 [/u] [/s] [/n] [/i[:cmdline]] dllname

Call DllInstall passing it an optional [cmdline]; when used with /u calls dll uninstall

Unrecognized flag: %1"Extra argument on command line: This command is only valid when an OLE Custom Control project is open.

LoadLibrary("%1") failed - ,%1 was loaded, but the %2 entry point was not found.

%1 does not appear to be a .DLL or .OCX file.V%1 was loaded, but the %2 entry point was not found.

OleUninitialize failed.["%1" is not an executable file and no registration

qqokqe.exe_1508:

.text

`.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

SHELL32.dll

WS2_32.dll

WINMM.dll

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm

RegCloseKey

RegOpenKeyExA

RegOpenKeyA

ShellExecuteA

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

fei9988.3322.org:8080

564528578564528578

%u.%u.%u.%u

hra%u.dll

iexplore.exe

stf%c%c%c%c%c.exe

PlusCtrl.dll

kernel32.dll

SOFTWARE.LOG

%c%c%c%c%c%c.exe

%u MB

%u MHz

Windows NT

Windows 7

Windows 2008

Windows Vista

Windows 2003

Windows XP

Windows 2000

SOFTWARE\Microsoft\Windows NT\CurrentVersion

\Program Files\Internet Explorer\iexplore.exe

#0%s!

%s/%s

GET %s HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)

Host: %s:%d

Host: %s

User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0

Referer: hXXp://%s:80/hXXp://%s

%s %s%s

User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

%d.%d.%d.%d

192.168.1.244

@.reloc

SHLWAPI.dll

lpk.dll

7.DDQz

z%upZ

XG

.wv_<;

.dR/r

.IcqE

Q-.yLP5_

Kg.PC

o(.Rx

%0ulg

en.Xt

%F?L`

p|%uY

9lP.Jt

$^H.Lb

ÂRo

xkG.ig

^N.BZ?

q%D><%

.CHt@

.KQB]

uJ.Bv

FX !>%D

%UB !Q

.iaP9

B.uf,

%xBTPt

%6x]!V

.SqvP

cmd /c RD /s /q "%s"

"%s" a -r -ep1"%s" "%s" "%s\lpk.dll"

"%s" x "%s" *.exe "%s\"

cmd /c %s vb "%s" lpk.dll|find /i "lpk.dll"

rar.exe

1, 0, 0, 1

server.EXE

qqokqe.exe_1508_rwx_0041B000_00001000:

.dR/r

qqokqe.exe_1508_rwx_00425000_00001000:

Kg.PC

qqokqe.exe_1508_rwx_0042D000_00001000:

Q-.yLP5_

qqokqe.exe_1508_rwx_0044B000_00001000:

q%D><%

qqokqe.exe_1508_rwx_00469000_00002000:

B.uf,

%xBTPt

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   regsvr32.exe:312
   hrl1.tmp:1888

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\hrl1.tmp (1717 bytes)
   C:\RCX2.tmp (24924 bytes)
   %System%\hra33.dll (7 bytes)
   %System%\qqokqe.exe (2321 bytes)

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.