MD5: e21bf4581e155c31fae2b096700a1125
SHA1: e929634c685cff0e17f345ec3bad32e2840f3b22
SHA256: 78871b31deacfb527b6b7569e99795ac936ea97cb456f607313eb26a06b29c81
SSDeep: 768:78QXvyTFpHrP/58ByHA/oEraNsNHPkUfb uTld9woHBX4QXsFwAbF1PGCwwtIa:BKFF358KAAErO4PrquZwor/4 Cf6
Size: 78006 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: Cloud Installer
Created at: 1970-01-01 03:00:00
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

Process activity

The Generic creates the following process(es):

%original file name%.exe:3380

The Generic injects its code into the following process(es):

csrss.exe:4040

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3380 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\mfxixue.bat (104 bytes)
C:\Windows\Tasks\csrss.exe (11028 bytes)

Registry activity

Dropped PE files

HOSTS file anomalies

The Generic modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 912 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
liquan.5tf.net
teredo.ipv6.microsoft.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Generic connects to the servers at the folowing location(s):

TBAK.ex

del "%ss

mfxi@ue.balt

C%c@9HuHt

N^.un

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

hXXp://liquan.5tf.net/arp.exe

hXXp://liquan.5tf.net/wincap.exe

hXXp://liquan.5tf.net/kk/ct.asp

c:\_default.pif

SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}

FWMon.exe

del "%s"

start %s

c:\mfxixue.bat

%WinDir%\Tasks

AST.exe

360tray.exe

ast.exe

windows

hXXp://VVV.microsoft.com

autorun.inf

\GHOSTBAK.exe

recycle.{645FF040-5081-101B-9F08-00AA002F954E}

%s -idx 0 -ip %s -port 80 -insert "%s"

%s\arps.com

%d.%d.%d.2-%d.%d.%d.255

\wincap.exe

\arps.com

%d.%d.%d.%d

1314520

5201314

12345678

password

at \\%s %d:%d %s

F:\hackshen.exe

\\%s\F$\hackshen.exe

E:\hackshen.exe

\\%s\E$\hackshen.exe

D:\hackshen.exe

\\%s\D$\hackshen.exe

C:\hackshen.exe

\\%s\C$\hackshen.exe

\\%s\admin$\hackshen.exe

\\%s\ipc$

mpr.dll

hXXp://liquan.5tf.net/22banghou.exe

hXXp://liquan.5tf.net/tudide.exe

%s?mac=%s&ver=2.2

windows config

\mfxixue.ini

%s -ep a "%s" %s

\WinRAR\Rar.exe

\meupdate.ini

127.0.0.0 360.qihoo.com

127.0.0.1 qihoo.com

127.0.0.1 VVV.qihoo.com

127.0.0.1 VVV.qihoo.cn

127.0.0.1 124.40.51.17

127.0.0.1 58.17.236.92

127.0.0.1 VVV.kaspersky.com

127.0.0.1 60.210.176.251

127.0.0.1 VVV.cnnod32.cn

127.0.0.1 VVV.lanniao.org

127.0.0.1 VVV.nod32club.com

127.0.0.1 VVV.dswlab.com

127.0.0.1 bbs.sucop.com

127.0.0.1 VVV.virustotal.com

127.0.0.1 tool.ikaka.com

127.0.0.1 VVV.jiangmin.com

127.0.0.1 VVV.duba.net

127.0.0.1 VVV.eset.com.cn

127.0.0.1 VVV.nod32.com

127.0.0.1 shadu.duba.net

127.0.0.1 union.kingsoft.com

127.0.0.1 VVV.kaspersky.com.cn

127.0.0.1 kaspersky.com.cn

127.0.0.1 virustotal.com

127.0.0.1 VVV.360.cn

127.0.0.1 VVV.360safe.cn

127.0.0.1 VVV.360safe.com

127.0.0.1 VVV.chinakv.com

127.0.0.1 VVV.rising.com.cn

127.0.0.1 rising.com.cn

127.0.0.1 dl.jiangmin.com

127.0.0.1 jiangmin.com

\svchost.exe

ntdll.dll

Set rs=createObject("Wscript.shell")

rs.run "%%windir%%\Tasks\csrss.exe",0

\Tasks\hackshen.vbs

SOFTWARE\Microsoft\Windows Script Host\Settings

%windir%\Tasks\hackshen.vbs

%Documents and Settings%

%WinDir%

%s\%s

%s\*.*

\Tasks\wsock32.dll

\wsock32.dll

C:\Windows\system32\arps.com

C:\Windows\system32\wincap.exe

C:\Windows\system32

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uq2hsuVb44.pif

C:\Windows\Tasks\

C:\Windows\Tasks\csrss.exe

.data

.reloc

%s\%s.pif

getservbyport

socket(af:%d,type:%d,proto:%d) rc=%d

WSAAsyncSelect(s=%d,hWnd,wMsg=%d,lEvent=%ld),rc=%d

connect,ip=%s:%d socket=%d

WSAGetLastError %d

inet_addr(%s)

getsockname(addr:%s,port:%d)

gethostbyname(hostname:%s)

gethostbyname(hostname:%s,addr:%s)

gethostname(hostname:%s)

accept,ip=%s:%d socket=%d

WSASetLastError(%d)

WSARecvEx(len=%d,buf:%s)

WSSSh8

WinExec

KERNEL32.dll

USER32.dll

MSVCRT.dll

URLDownloadToFileA

urlmon.dll

wsock32.dll

rcmd

rexec

rresvport

WSAAsyncGetServByPort

GetWindowsDirectoryA

keybd_event

EnumChildWindows

ADVAPI32.dll

RegCloseKey

RegCreateKeyA

RegDeleteKeyA

WININET.dll

InternetOpenUrlA

WS2_32.dll

.dat(

VCRT8A^

keyb

VCRT\E_

kernel32.dll

csrss.exe_4040_rwx_00401000_00001000:

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe

hXXp://liquan.5tf.net/arp.exe

hXXp://liquan.5tf.net/wincap.exe

hXXp://liquan.5tf.net/kk/ct.asp

c:\_default.pif

SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}

FWMon.exe

del "%s"

start %s

c:\mfxixue.bat

%WinDir%\Tasks

AST.exe

360tray.exe

ast.exe

windows

csrss.exe_4040_rwx_00406000_00002000:

C:\Windows\system32\arps.com

C:\Windows\system32\wincap.exe

C:\Windows\system32

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uq2hsuVb44.pif

C:\Windows\Tasks\

C:\Windows\Tasks\csrss.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:3380
   

2. Delete the original Generic file.
   
3. Delete or disinfect the following files created/modified by the Generic:
   

   C:\mfxixue.bat (104 bytes)
   C:\Windows\Tasks\csrss.exe (11028 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.