MD5: dee4cfafca168eb9b065b1269ccb8b6a
SHA1: 579523329b2e9e894c5388e640362081b8424bf5
SHA256: 0810468469773425bc1bb239951dcbb9286db5b354bc6d877f3b65f9b0f86995
SSDeep: 384:JszLGoc1H8sQjiu2D0qrcEr3d7dBpymO89dY8bqQybPp1mHZ:Jsz7c1H8sd1DX7p79dY8bqQI3k
Size: 27648 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2011-01-20 02:38:21
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regedit.exe:664
%original file name%.exe:1152

The Trojan injects its code into the following process(es):

svchost.exe:912

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1152 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\[email protected] (48 bytes)
C:\%original file name%.exe.tmp1 (1780 bytes)

Registry activity

The process regedit.exe:664 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 36 29 CD AB BE 36 20 11 89 9B 13 AA E2 2F 5C"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"clr_optimization_v4.0.30319_32" = "%Documents and Settings%\%current user%\Local Settings\clr_optimization_v4.0.30319_32.exe"

The process %original file name%.exe:1152 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 77 B1 BA 83 33 57 7E FB 41 25 25 C1 A2 CA A1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Adobe Systems, Inc.
Product Name: Flash? Player Installer/Uninstaller
Product Version: 10,1,53,64
Legal Copyright: Copyright ? 1996-2010 Adobe, Inc.
Legal Trademarks: Adobe? Flash? Player
Original Filename: FlashUtil.exe
Internal Name: Adobe? Flash? Player Installer/Uninstaller 10.1
File Version: 10,1,53,64
File Description: Adobe? Flash? Player Installer/Uninstaller 10.1 r53
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 19
d7b175c4994714b2b8545dc1991dba02
d73291ba669b49bcb87bf2b37cb935d0
a69e9b12be42752aaba0b18a9ae06483
b80c0ac3e473db260da901206c2fb5c5
2ca798c49939cbaea17868b537109bb0
29ae66a29ee57abaef55627d4c46e620
047211416ceb896c6a78727d12ef3020
ff92c245af33c097ecb3ecec3bffd393
e6d39f539be3330e2a19da1fd796b1dd
e57e42ec25c2f6d40c0dd707acd10a76
02506ce80526e116ce887e57df6592ea
019ce6f574e3bbd9ca4f77ba182cc0b4
14f6158aa696f3521cbee17001e55a41
15e5c0a8f396c5df3b3241c173fd04d0
afa0b769dcaa0630a654b7ceb69aafd0
d99a5fa84fe6aa27e279c2d55433a47d
a6007c60befe053f8521ae15de7c370b
a4e3d511d52771d61d4b67a782f07cfb
ac23bfa013bdfdd3624274c0454dda4a

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

SSh@C@

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

USER32.dll

ADVAPI32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

WININET.dll

WS2_32.dll

iphlpapi.dll

SHLWAPI.dll

211.234.117.132

intweb.mobwork.net

regedit.exe /s

~dfds3.reg

Windows Registry Editor Version 5.00

"%s"="%s"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinHttp

%s.tmp1

[email protected]

hXXp://%s:%d/%s.php?id=d%s&ext=%s

/%s.php?id=d%s&ext=%s

hXXp://%s:%d/%s.php?id=d%s

%c%c%c%c%c

/%s.php?id=d%s

%%temp%%\%u

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

X-X-X-X-X-X

01-01-01-01-01-01

%c%c%c%c%c%c.exe

svchost.exe_912_rwx_00400000_00005000:

.text

`.rdata

@.data

SSh@C@

MFC42.DLL

MSVCRT.dll

_acmdln

WinExec

KERNEL32.dll

USER32.dll

ADVAPI32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

WININET.dll

WS2_32.dll

iphlpapi.dll

SHLWAPI.dll

211.234.117.132

intweb.mobwork.net

regedit.exe /s

~dfds3.reg

Windows Registry Editor Version 5.00

"%s"="%s"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinHttp

%s.tmp1

[email protected]

hXXp://%s:%d/%s.php?id=d%s&ext=%s

/%s.php?id=d%s&ext=%s

hXXp://%s:%d/%s.php?id=d%s

%c%c%c%c%c

/%s.php?id=d%s

%%temp%%\%u

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

X-X-X-X-X-X

01-01-01-01-01-01

%c%c%c%c%c%c.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   regedit.exe:664
   %original file name%.exe:1152
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\[email protected] (48 bytes)
   C:\%original file name%.exe.tmp1 (1780 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "clr_optimization_v4.0.30319_32" = "%Documents and Settings%\%current user%\Local Settings\clr_optimization_v4.0.30319_32.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.