MD5: 41ade8caf674f323e345c6a75bd85d13
SHA1: 0ffc462a3861f3795f6b6474af544d614dd90c58
SHA256: aef799343cb911d0c5414e35f5e2957cb35d21c54b33eb5bd5d390b4c4833cb6
SSDeep: 768:78QXvyTFpHrP/58ByHA/oEraNsNHPkUfb uTld9woHBX4QXsFwAbF1PGCwwtIa:BKFF358KAAErO4PrquZwor/4 Cf6
Size: 77984 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 1970-01-01 03:00:00
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

Process activity

The Generic creates the following process(es):

%original file name%.exe:2452

The Generic injects its code into the following process(es):

csrss.exe:2096

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2452 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\mfxixue.bat (104 bytes)
C:\Windows\Tasks\csrss.exe (11028 bytes)

Registry activity

Dropped PE files

HOSTS file anomalies

The Generic modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 912 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
liquan.5tf.net
teredo.ipv6.microsoft.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Generic connects to the servers at the folowing location(s):

TBAK.ex

del "%ss

mfxi@ue.balt

C%c@9HuHt

N^.un

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

hXXp://liquan.5tf.net/arp.exe

hXXp://liquan.5tf.net/wincap.exe

hXXp://liquan.5tf.net/kk/ct.asp

c:\_default.pif

SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}

FWMon.exe

del "%s"

start %s

c:\mfxixue.bat

%WinDir%\Tasks

AST.exe

360tray.exe

ast.exe

windows

hXXp://VVV.microsoft.com

autorun.inf

\GHOSTBAK.exe

recycle.{645FF040-5081-101B-9F08-00AA002F954E}

%s -idx 0 -ip %s -port 80 -insert "%s"

%s\arps.com

%d.%d.%d.2-%d.%d.%d.255

\wincap.exe

\arps.com

%d.%d.%d.%d

1314520

5201314

12345678

password

at \\%s %d:%d %s

F:\hackshen.exe

\\%s\F$\hackshen.exe

E:\hackshen.exe

\\%s\E$\hackshen.exe

D:\hackshen.exe

\\%s\D$\hackshen.exe

C:\hackshen.exe

\\%s\C$\hackshen.exe

\\%s\admin$\hackshen.exe

\\%s\ipc$

mpr.dll

hXXp://liquan.5tf.net/22banghou.exe

hXXp://liquan.5tf.net/tudide.exe

%s?mac=%s&ver=2.2

windows config

\mfxixue.ini

%s -ep a "%s" %s

\WinRAR\Rar.exe

\meupdate.ini

127.0.0.0 360.qihoo.com

127.0.0.1 qihoo.com

127.0.0.1 VVV.qihoo.com

127.0.0.1 VVV.qihoo.cn

127.0.0.1 124.40.51.17

127.0.0.1 58.17.236.92

127.0.0.1 VVV.kaspersky.com

127.0.0.1 60.210.176.251

127.0.0.1 VVV.cnnod32.cn

127.0.0.1 VVV.lanniao.org

127.0.0.1 VVV.nod32club.com

127.0.0.1 VVV.dswlab.com

127.0.0.1 bbs.sucop.com

127.0.0.1 VVV.virustotal.com

127.0.0.1 tool.ikaka.com

127.0.0.1 VVV.jiangmin.com

127.0.0.1 VVV.duba.net

127.0.0.1 VVV.eset.com.cn

127.0.0.1 VVV.nod32.com

127.0.0.1 shadu.duba.net

127.0.0.1 union.kingsoft.com

127.0.0.1 VVV.kaspersky.com.cn

127.0.0.1 kaspersky.com.cn

127.0.0.1 virustotal.com

127.0.0.1 VVV.360.cn

127.0.0.1 VVV.360safe.cn

127.0.0.1 VVV.360safe.com

127.0.0.1 VVV.chinakv.com

127.0.0.1 VVV.rising.com.cn

127.0.0.1 rising.com.cn

127.0.0.1 dl.jiangmin.com

127.0.0.1 jiangmin.com

\svchost.exe

ntdll.dll

Set rs=createObject("Wscript.shell")

rs.run "%%windir%%\Tasks\csrss.exe",0

\Tasks\hackshen.vbs

SOFTWARE\Microsoft\Windows Script Host\Settings

%windir%\Tasks\hackshen.vbs

%Documents and Settings%

%WinDir%

%s\%s

%s\*.*

\Tasks\wsock32.dll

\wsock32.dll

C:\Windows\system32\arps.com

C:\Windows\system32\wincap.exe

C:\Windows\system32

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VjXLslufQV.pif

C:\Windows\Tasks\

C:\Windows\Tasks\csrss.exe

.data

.reloc

%s\%s.pif

getservbyport

socket(af:%d,type:%d,proto:%d) rc=%d

WSAAsyncSelect(s=%d,hWnd,wMsg=%d,lEvent=%ld),rc=%d

connect,ip=%s:%d socket=%d

WSAGetLastError %d

inet_addr(%s)

getsockname(addr:%s,port:%d)

gethostbyname(hostname:%s)

gethostbyname(hostname:%s,addr:%s)

gethostname(hostname:%s)

accept,ip=%s:%d socket=%d

WSASetLastError(%d)

WSARecvEx(len=%d,buf:%s)

WSSSh8

WinExec

KERNEL32.dll

USER32.dll

MSVCRT.dll

URLDownloadToFileA

urlmon.dll

wsock32.dll

rcmd

rexec

rresvport

WSAAsyncGetServByPort

GetWindowsDirectoryA

keybd_event

EnumChildWindows

ADVAPI32.dll

RegCloseKey

RegCreateKeyA

RegDeleteKeyA

WININET.dll

InternetOpenUrlA

WS2_32.dll

.dat(

VCRT8A^

keyb

VCRT\E_

kernel32.dll

csrss.exe_2096_rwx_00401000_00001000:

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

hXXp://liquan.5tf.net/arp.exe

hXXp://liquan.5tf.net/wincap.exe

hXXp://liquan.5tf.net/kk/ct.asp

c:\_default.pif

SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}

FWMon.exe

del "%s"

start %s

c:\mfxixue.bat

%WinDir%\Tasks

AST.exe

360tray.exe

ast.exe

windows

csrss.exe_2096_rwx_00406000_00002000:

C:\Windows\system32\arps.com

C:\Windows\system32\wincap.exe

C:\Windows\system32

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VjXLslufQV.pif

C:\Windows\Tasks\

C:\Windows\Tasks\csrss.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2452
   

2. Delete the original Generic file.
   
3. Delete or disinfect the following files created/modified by the Generic:
   

   C:\mfxixue.bat (104 bytes)
   C:\Windows\Tasks\csrss.exe (11028 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.