MD5: 5951164a1d237ea1d8d5806f5cbb48c4
SHA1: 157de7616c2507135274ebbe1237b70600c5f694
SHA256: 3d2a0f929306be22dc8b3217786143bd786d2821cf5e227ac6e4771943ecf922
SSDeep: 1536:h5nXUOV6yA08DoeMY M CQPOeQyHPzcgN3XN11NKxGqLQ7U Rj aqES:rECoAJm
Size: 212992 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: AirInstaller
Created at: 2015-02-24 17:07:00
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:704
csc.exe:1108
cvtres.exe:1032

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:704 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\LiteDB\UnicKey.xml (348 bytes)
%Documents and Settings%\%current user%\Application Data\LiteDB\ppiName.xml (241 bytes)
%Documents and Settings%\%current user%\Application Data\vk-pro\vk-pro-bot.exe (5935444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.0.cs (1444 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (5060 bytes)
%Documents and Settings%\%current user%\Application Data\vk-pro\update.exe (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.cmdline (424 bytes)
%Documents and Settings%\%current user%\Desktop\vk-pro.lnk (818 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (5288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.out (491 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.0.cs (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.err (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.cmdline (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.out (0 bytes)

The process csc.exe:1108 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CSC1.tmp (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.out (396 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.dll (4700 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CSC1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RES2.tmp (0 bytes)

The process cvtres.exe:1032 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RES2.tmp (2912 bytes)

Registry activity

The process %original file name%.exe:704 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 0D F5 6A 92 BA 0A 0A 47 75 0E 90 E7 E1 5B B8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"UpdateVKpro" = "%Documents and Settings%\%current user%\Application Data\vk-pro\update.exe"

The process csc.exe:1108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 24 50 36 AE FD 0B 44 B0 BA 74 C2 E7 7A F9 0B"

The process cvtres.exe:1032 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 6D EB 0E 9F B2 4E A5 CD 13 56 05 09 DA 17 FA"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: installer_webasm.exe
Internal Name: installer_webasm.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://winsofting.ru/vk-pro-bot.exe	159.253.19.170

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /vk-pro-bot.exe HTTP/1.1

Host: winsofting.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 16 Mar 2015 19:16:17 GMT

Content-Type: application/octet-stream

Content-Length: 48679059

Last-Modified: Fri, 13 Mar 2015 11:54:52 GMT

Connection: keep-alive

Accept-Ranges: bytes
[email protected].........
..!..L.!This program cannot be run in DOS mode....$........9I..X'..X'.
.X'.t....X'......Y'......X'......X'../...X'.. ...X'../...X'../...X'../
...X'..X&..\'../...X'..X'..X'......^'......D'......X'......X'..X...X'.
.....X'.Rich.X'.................PE..L....l.S.........."..........H....
................@.......................................@.............
............0.`...............m......................p...0............
........................`[email protected]....}`.@...................
.text............................... ..`.rdata....s.......s...........
......@[email protected][email protected].....
..d.............@[email protected].............@..._RDATA....
....m.......d.............@[email protected].............@..@
.rsrc.........m.......e.............@[email protected].......
[email protected][email protected]............
............................................SW1..X..5.. .P..X1.tN1....
[email protected]...........=....v...............t.
....._[....&....U..........$...e.SVW.H.....:...Q.p..H..>.^..V..<
[email protected].?.......shPR..I...t....1.......t....1.f.
........n.ZX...t.....n4..s. ......t..o..o.......$........t..o..o..ov..
..m..o..ov..on..o..s. .s. .h..s. .`..h..o..s. .s. .h..s. .`..h.....o..
`..h..o..`..h..o..`..h...E...M...e...m..o..a..i..o..o......k...5..k...
=..k...%..k...M...u........a..i..r...r...o-..k..............r...r.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:704
   csc.exe:1108
   cvtres.exe:1032

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\LiteDB\UnicKey.xml (348 bytes)
   %Documents and Settings%\%current user%\Application Data\LiteDB\ppiName.xml (241 bytes)
   %Documents and Settings%\%current user%\Application Data\vk-pro\vk-pro-bot.exe (5935444 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.0.cs (1444 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT (5060 bytes)
   %Documents and Settings%\%current user%\Application Data\vk-pro\update.exe (69 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.cmdline (424 bytes)
   %Documents and Settings%\%current user%\Desktop\vk-pro.lnk (818 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (5288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.out (491 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CSC1.tmp (652 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fnv-r2ht.dll (4700 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RES2.tmp (2912 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "UpdateVKpro" = "%Documents and Settings%\%current user%\Application Data\vk-pro\update.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.