MD5: 0501e04ace86a943d88c27ba58d266e9
SHA1: 151349bb063966743f3c25ade8118d71e53b43b6
SHA256: d145d0352e46b3bc2f2603c3277989d3fb4e262702b11580ebb3884132baf07c
SSDeep: 1536:GlehELCpJDL5KIoIWmJDRJacWnGpnyEctzyP4bGSenrUKz3xVdQZtACGU:Gle8Cj35gmJDRJgnGpn14bMrUQctAA
Size: 108313 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2007-03-31 18:09:36
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Dropped creates the following process(es):

%original file name%.exe:1588
asofsrvs.exe:652
Zer0xMod.exe:1252

The Dropped injects its code into the following process(es):
No processes have been created.

File activity

The process %original file name%.exe:1588 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Zer0xMod.exe (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\stub_2014-04-02.Bin (1568 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss1.tmp (0 bytes)

The process Zer0xMod.exe:1252 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\asofsrvs.exe (35 bytes)

Registry activity

The process %original file name%.exe:1588 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 78 69 8E ED 1F 06 3A 57 72 68 1B 2E 1E 35 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"Zer0xMod.exe" = "Zer0xMod"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process asofsrvs.exe:652 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 10 1A 2E 4F 8C 4C CA F6 92 05 3F 63 DD DC 7B"

The process Zer0xMod.exe:1252 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F ED 9A 9D DC 0C 0C 88 DE 4B 55 EA 4A B2 9F EA"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AsofServices" = "%Documents and Settings%\%current user%\Application Data\asofsrvs.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsofServices" = "%Documents and Settings%\%current user%\Application Data\asofsrvs.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Dropped's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

.text

`.rdata

@.data

user32.dll

GetWindowsDirectoryA

KERNEL32.dll

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

WS2_32.dll

SHLWAPI.dll

URLDownloadToFileA

urlmon.dll

GetCPInfo

%s\%s

del "%s">nul

if exist "%s" goto Repeat

ping 1.1.1.1 -w 5000 >nul

%s\removeMe%i%i%i%i.bat

NICK

JOIN

PRIVMSG

%s :%s

%s %s :%s

%s %s

%s %s %s

%s %s "" "lol" :%s

Gtfo! Wr0ng PaSS!

Vup.exe

Missing Parms: -IP- -Port- -Packets- -Size- -Delay- -TimeOut-

Missing Parms: -IP- -Port- -Packets- -TimeOut-

FAiLED 2 ExECuTe! [ A.V DETECTION ].

DoWnLoaDeD & ExECuTeD!

shlwapi.dll

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

login

join

asofsrvs.exe

VanaDiuM iRC BOT v1.3.0.

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%Documents and Settings%\%current user%\Application Data\asofsrvs.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1588
   asofsrvs.exe:652
   Zer0xMod.exe:1252

2. Delete the original Dropped file.
   
3. Delete or disinfect the following files created/modified by the Dropped:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\Zer0xMod.exe (1568 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\stub_2014-04-02.Bin (1568 bytes)
   %Documents and Settings%\%current user%\Application Data\asofsrvs.exe (35 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "AsofServices" = "%Documents and Settings%\%current user%\Application Data\asofsrvs.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "AsofServices" = "%Documents and Settings%\%current user%\Application Data\asofsrvs.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.