Gen.Variant.Graftor.124013_819068f3b1
Gen:Variant.Graftor.124013 (BitDefender), Trojan.DownLoader10.57659 (DrWeb), Gen:Variant.Graftor.124013 (B) (Emsisoft), Trojan-FCUG!819068F3B1D2 (McAfee), Trojan.Win32.FakeAV (Ikarus), Gen:Variant.Graftor.124013 (FSecure), Win32/DH{QgA1ICIl} (AVG)
Behaviour: Trojan, Fake-AV
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 819068f3b1d2ed0a01be4b61593fdac5
SHA1: 2380ad24e359e3ce5ddf3813f5e18d4f8bbcf990
SHA256: 88eda95091f615e97e1f688f4a521f4abc3648c6df5ae3d06597ee62383778f6
SSDeep: 6144:WYlMPrMOINFbr55dsEINM91gbNasfm4DG3nEahyBvy/AVoUq7iGxQFsAYr11jiHu:XE9INRV5BIjN31DMPhIy/Axi1D
Size: 450264 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Softonic
Created at: 2013-11-28 07:13:08
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
taskkill.exe:2404
%original file name%.exe:2396
The Trojan injects its code into the following process(es):
jlguaji.exe:2480
File activity
The process %original file name%.exe:2396 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\jlguaji.exe (292 bytes)
The process jlguaji.exe:2480 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\tongji[1].js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\bd.dat (676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\mini[1].js (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\urlgj[1].htm (692 bytes)
%Documents and Settings%\%current user%\Cookies\OCIQEQG4.txt (98 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\core[1].php (800 bytes)
%Documents and Settings%\%current user%\Cookies\0ENVVLP3.txt (96 bytes)
%Documents and Settings%\%current user%\Cookies\ICNKE55I.txt (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\LOADING_STATUS[1] (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\style[1].css (806 bytes)
%Documents and Settings%\%current user%\Cookies\Y3IMTIB8.txt (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\autorun[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\B8CGS1RC.txt (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sound_high[1].gif (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\4C0KKISC.txt (212 bytes)
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\product.dat (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
Registry activity
The process taskkill.exe:2404 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 1E 96 16 54 7B 5A B2 49 D3 2A 56 00 8F B8 A9"
The process jlguaji.exe:2480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 3E D1 2C 08 1A AD 54 ED 54 C5 56 D3 BE 4B 98"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1381371719"
"Name" = "jlguaji.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit]
"jlguaji.exe" = "%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\jlguaji.exe:*:Enabled:ç²¾çµè½¯ä»¶"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"urlspace"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://urlspirit.spiritsoft.cn/urlcore/olgjcfgs.dat?q=41 (Malicious) |  121.10.112.147 |
| hxxp://urlspirit.spiritsoft.cn/urlcore/svcreq9b06c391.js | |
| hxxp://urlspirit.spiritsoft.cn/urlcore/svcreq9b06c48b.html | |
| hxxp://urlspirit.spiritsoft.cn/v4/urlgj.html?v=4.0.3.101-0110 | |
| hxxp://urlspirit.spiritsoft.cn/v4/css/style.css | |
| hxxp://urlspirit.spiritsoft.cn/v4/js/mini.js | |
| hxxp://urlspirit.spiritsoft.cn/v4/images/sound_high.gif | |
| hxxp://urlspirit.spiritsoft.cn/v4/images/autorun.png | |
| hxxp://taurus.danuoyi.tbcache.com/1119670/tongji.js |  |
| hxxp://dt.tongji.linezing.com/tongji.do?unit_id=1119670&uv_id=63911351449324086&uv_new=1&cna=&cg=&mid=&mmland=&ade=&adtm=&sttm=&cpa=&ss_id=1390086195&ss_no=0&ec=1&ref=&url=http://info.spiritsoft.cn/v4/urlgj.html?v=4.0.3.101-0110&title=%u6D41%u91CF%u7CBE%u7075&charset=utf-8&domain=spiritsoft.cn&hashval=1366&filtered=0&app=Microsoft Internet Explorer&agent=Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)&color=32-bit&screen=1176x885&lg=en-us&je=1&fv=6.0&st=1386301008&vc=4384f765&ut=0&url_id=0&cnu=0.5874620623796882 | 110.75.80.118 |
| hxxp://c.cnzz.com/stat.php?id=3713157&web_id=3713157 | |
| hxxp://z4.cnzz.com/stat.htm?id=3713157&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1517884645-1386302868-http://info.spiritsoft.cn&showp=1176x885&st=0&sin=&t=undefinedundefinedundefinedundefined&rnd=1747342289 | |
| hxxp://c.cnzz.com/core.php?web_id=3713157&t=z | |
| hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=161807813 | |
| hxxp://pcookie.split.cnzz.com/app.gif?&cna=9VYoC9WSEAQCAbhrJibdOLIi | |
| hxxp://urlspirit.spiritsoft.cn/urlcore/svcreq9b076203.html | |
| hxxp://urlspirit.spiritsoft.cn/urlcore/svcreq9b0763e8.css | |
| hxxp://urlspirit.spiritsoft.cn/urlcore/svcreq9b0765cc.css | |
| s1.spiritsoft.cn |  122.110.61.222 |
| info.spiritsoft.cn | 121.10.112.147 |
| pcookie.cnzz.com | 42.121.149.41 |
| cnzz.mmstat.com | 42.121.149.44 |
| js.tongji.linezing.com | 195.27.31.240 |
| s24.cnzz.com |  1.99.192.16 |
| hzs24.cnzz.com | 42.156.140.17 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:2404
%original file name%.exe:2396 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\jlguaji.exe (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\tongji[1].js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\bd.dat (676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\mini[1].js (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\urlgj[1].htm (692 bytes)
%Documents and Settings%\%current user%\Cookies\OCIQEQG4.txt (98 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\core[1].php (800 bytes)
%Documents and Settings%\%current user%\Cookies\0ENVVLP3.txt (96 bytes)
%Documents and Settings%\%current user%\Cookies\ICNKE55I.txt (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\LOADING_STATUS[1] (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\style[1].css (806 bytes)
%Documents and Settings%\%current user%\Cookies\Y3IMTIB8.txt (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\autorun[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\B8CGS1RC.txt (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sound_high[1].gif (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\4C0KKISC.txt (212 bytes)
%Documents and Settings%\%current user%\Application Data\Spiritsoft\urlspirit\product.dat (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
