MD5: d59a22395ac37a7ffbc3440d3ed2dab2
SHA1: 19d3c4751e60d482a0ce7fb208ae08d53e5b6cb8
SHA256: df89d6f9a6585bae5162529b85e71cdf1d466ccafdee9687861dd5d589fe46a1
SSDeep: 384:mCW7cRe6DHkIG10k405LouQDQFyqbrNVdKcc1/NcpmvpozNav7p84Ln4e5zuw:mCW7yHEIC0u50zDgNVJc1 pI2zNav64a
Size: 23552 bytes
File type: EXE
Platform: WIN32
Entropy: Probably Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2017-09-30 21:09:42
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

%original file name%.exe:2604

The Generic injects its code into the following process(es):

jwtdww.exe:3380

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2604 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Windows\jwtdww.exe (23 bytes)

Registry activity

The process %original file name%.exe:2604 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\Anopqr Tuvwxyab Def]
"Description" = "Anopqrst Vwxyabcde Ghijklm Opqrstuv Xya"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Generic deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Borland ????
Product Name: ???
Product Version: 7.0
Legal Copyright: ???? ? 1996-2002 Borland ????
Legal Trademarks:
Original Filename: DELPHI32.EXE
Internal Name: DELPHI32
File Version: 7.0.4.453
File Description: Delphi-32 ????
Comments:
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
520hack.f3322.net	115.215.219.80

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Generic connects to the servers at the folowing location(s):

`.rsrc

t.Pj@

WS2_32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyA

RegCloseKey

520hack.f3322.net

at \\%s %d:%d %s

F:\g1fd.exe

\\%s\F$\g1fd.exe

E:\g1fd.exe

\\%s\E$\g1fd.exe

D:\g1fd.exe

C:\g1fd.exe

\\%s\C$\NewArean.exe

\\%s\admin$\g1fd.exe

\\%s\ipc$

mpr.dll

%d.%d.%d.%d

password@abc

33333333

11111111

0000000

0123456

windows

!@#$%^&*()

123456789

1234567

1314520

5201314

12345678

password

Password1

hra%u.dll

%c%c%c%cÌn.exe

kernel32.dll

%c%c%c%c%c%c.exe

%u Mbps

%u Gbps

0.0.0.0

%u MB

%d*%u%s

%s %s %s%d

GET %s HTTP/1.1

Host: %s

User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0

Referer: hXXp://%s:80/hXXp://%s

%s %s%s

Host: %s:%d

User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

_acmdln

ShellExecuteA

ShellExecuteExA

SHDeleteKeyA

.text

`.data

.rsrc

oOpenKey%S

\\%s %d:

\g1fd.exP

HTTP/1.1

.ms-"nl

x.cH7

3tftp

KERNEL32.DLL

iphlpapi.dll

MSVCRT.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

08040000

7.0.4.453

DELPHI32.EXE

jwtdww.exe_3380_rwx_00401000_0000C000:

t.Pj@

WS2_32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyA

RegCloseKey

520hack.f3322.net

at \\%s %d:%d %s

F:\g1fd.exe

\\%s\F$\g1fd.exe

E:\g1fd.exe

\\%s\E$\g1fd.exe

D:\g1fd.exe

C:\g1fd.exe

\\%s\C$\NewArean.exe

\\%s\admin$\g1fd.exe

\\%s\ipc$

mpr.dll

%d.%d.%d.%d

password@abc

33333333

11111111

0000000

0123456

windows

!@#$%^&*()

123456789

1234567

1314520

5201314

12345678

password

Password1

hra%u.dll

%c%c%c%cÌn.exe

kernel32.dll

%c%c%c%c%c%c.exe

%u Mbps

%u Gbps

0.0.0.0

%u MB

%d*%u%s

%s %s %s%d

GET %s HTTP/1.1

Host: %s

User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0

Referer: hXXp://%s:80/hXXp://%s

%s %s%s

Host: %s:%d

User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)

User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htmGET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

_acmdln

ShellExecuteA

ShellExecuteExA

SHDeleteKeyA

.text

`.data

.rsrc

oOpenKey%S

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2604

2. Delete the original Generic file.
   
3. Delete or disinfect the following files created/modified by the Generic:
   

   C:\Windows\jwtdww.exe (23 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.