MD5: 6a2d3cbf8f5bf92f9f1c5f112ef9509a
SHA1: 9e3bc33dc8989b52f0e3a188387138799dc6a87d
SHA256: eac171d620334a2a52fb0ed66102cade5601b011bae332b5fcb940decc3fcac9
SSDeep: 384:QIdmF TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmid6sdfbWky8lhzN8n:QIsF8HdbKjV8BX7Vy6K7eIVTdJdjg8b2
Size: 21504 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

%original file name%.exe:756

The Generic injects its code into the following process(es):

iexplore.exe:376

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:756 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg (2 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe (21 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\x.html (0 bytes)

Registry activity

The process %original file name%.exe:756 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 F8 BB 7D A9 79 CA 08 0E D9 BC 09 B5 65 14 CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe restart"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\((Mutex))]
"InstalledServer" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\((Mutex))]
"ServerStarted" = "7/24/2016 22:48:12 PM"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 11
b9ffa73998e6166898716d5f3b88600c
4afbc3e693a4681e0768549a15f8f7cb
d233e8728b224e9800fa9ccd7bd4e2c1
4d538ad482f369af7b24b912448f2cec
ba38fd5c840ad950df0a6ff8e6669bbb
1b78e52df145fa557c7cc933f80e1267
63c65001b35b6552d00ae7cfda357dd6
0294dce9a3a840448e47a5fd5d0efd30
a05123d23a26ad1ef52ba7c6a44d24ee
f97b8d2b40150ee05c6e9228bb9ded3a
eae896da619fc1eca71492b7f3129923

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Generic connects to the servers at the folowing location(s):

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_376_rwx_00C80000_00016000:

`.rsrc

Portions Copyright (c) 1999,2003 Avenger by NhT

Kernel32.dll

ntdll.dll

kernel32.dll

789:;<&'()* ,-./12345

user32.dll

urlmon.dll

wininet.dll

advapi32.dll

Shell32.dll

shell32.dll

shlwapi.dll

KWindows

UnitKeylogger

GetWindowsDirectoryW

GetProcessHeap

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyW

RegCloseKey

FindExecutableW

ShellExecuteW

SHDeleteKeyW

URLDownloadToFileW

UnhookWindowsHookEx

SetWindowsHookExW

MapVirtualKeyW

GetKeyboardLayout

GetKeyState

GetKeyboardState

FtpPutFileW

FtpSetCurrentDirectoryW

DeleteUrlCacheEntryW

.idata

.rdata

P.reloc

P.rsrc

DURLDr

KERNEL32.DLL

oleaut32.dll

PSAPI.dll

x.html

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows NT\CurrentVersion\Windows

explorer.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

[Execute]

KeyDelBackspace

XtremeKeylogger

hXXp://

.functions

ÞFAULTBROWSER%

\Microsoft\Windows\

svchost.exe

blakdave.ddns.net

Server.exe

{5460C4DF-B266-909E-CB58-E32B79832EB2}

PTF.ftpserver.com

E:\Wind

ftpuser

Iftppass

c:\%original file name%.exe

%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe

%Documents and Settings%\%current user%\Application Data\InstallDir\

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg

Software\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:756
   

2. Delete the original Generic file.
   
3. Delete or disinfect the following files created/modified by the Generic:
   

   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\((Mutex)).cfg (2 bytes)
   %Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe (21 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "HKCU" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "HKLM" = "%Documents and Settings%\%current user%\Application Data\InstallDir\Server.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.