Shiz_8ca8ec8f61
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Win32.SuspectCrc!IK (Emsisoft), Backdoor.Win32.Shiz.FD, Shiz.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 8ca8ec8f611f630c0bfc82572d373d45
SHA1: b84d05e9ce1a7f9230f9faaccad2d67990f36323
SHA256: d285a88a84ea88faa6720957ab178272ee8b6e907df5f9ddaaad0af28f85fc3b
SSDeep: 6144:uy/P1r3hSsYfhKqa5NG88wlT2T23bHIftiUFUrGRlotmTZXLfn9hvX9GS:N1r3hN8pT2LHIFiwUku4Xj9GS
Size: 279552 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2005-02-24 03:28:03
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:632
The Trojan injects its code into the following process(es):
ctfmon.exe:536
File activity
The process %original file name%.exe:632 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\config (28672 bytes)
%WinDir%\AppPatch\ywvdhd.exe (838656 bytes)
%System%\config\SOFTWARE (135168 bytes)
%System%\config\software.LOG (33792 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
Registry activity
The process %original file name%.exe:632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 9D 34 92 BF F6 0E E8 3D 60 CB 19 A5 BC 66 54"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"7077a96b" = "F†Ќ6Јi‚ШљH\Й}o qПЩY]*nЩA Ñ™)ÐŽ@EÐg8y,d…знLИч„ $њЕЩ5ЕÐПMH4'ђшхlБнo=mЎИЧеÑÑ„ÐŒ-±ЎЅU…toLµЧЙ‘l'â„–-€=Еmâ„¢A…g\TÑ… µ…Ф™¤Ѕ}ФЊ"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%WinDir%\apppatch\ywvdhd.exe_, \??\%WinDir%\apppatch\ywvdhd.exe"
The process ctfmon.exe:536 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://cihunemyror.eu/login.php |  50.116.56.144 |
| hxxp://digivehusyd.eu/login.php | 96.43.141.186 |
| hxxp://galokusemus.eu/login.php | 50.116.32.177 |
| hxxp://kefuwidijyp.eu/login.php | 173.230.133.99 |
| jefapexytar.eu | 50.116.56.144 |
| fokyxazolar.eu | 50.116.56.144 |
| xuqohyxeqak.eu | 50.116.56.144 |
| lyruxyxaxaw.eu | 50.116.56.144 |
| gadufiwabim.eu | 50.116.56.144 |
| www.bing.com | 204.79.197.200 |
| foxivusozuc.eu | 50.116.56.144 |
| ryqecolijet.eu | 50.116.56.144 |
| puregivytoh.eu |  |
| gahihezenal.eu | |
| qegytuvufoq.eu | |
| vojacikigep.eu | |
| makagucyraj.eu | |
| tucyguqaciq.eu | |
| nozoxucavaq.eu | |
| puvopalywet.eu | |
| ciliqikytec.eu | |
| xutekidywyp.eu | |
| tunujolavez.eu | |
| dikoniwudim.eu | |
| divywysigud.eu | |
| lyvejujolec.eu | |
| puzutuqeqij.eu | |
| fobonobaxog.eu | |
| rydinivoloh.eu | |
| lysovidacyx.eu | |
| qeqinuqypoq.eu | |
| magofetequb.eu | |
| tupazivenom.eu | |
| rytuvepokuv.eu | |
| qetoqolusex.eu | |
| masisokemep.eu | |
| gatedyhavyd.eu | |
| fodakyhijyv.eu | |
| cicaratupig.eu | |
| vocumucokaj.eu | |
| nofyjikoxex.eu | |
| tuwikypabud.eu | |
| kepymexihak.eu | |
| xuxusujenes.eu | |
| lymylorozig.eu | |
| jepororyrih.eu | |
| xubifaremin.eu | |
| dimutobihom.eu | |
| voniqofolyt.eu | |
| fogeliwokih.eu | |
| dixemazufel.eu | |
| qederepuduf.eu | |
| kemocujufys.eu | |
| nojuletacuf.eu | |
| rynazuqihoj.eu | |
| marytymenok.eu | |
| jejedudupuc.eu | |
| volebatijub.eu | |
| vofozymufok.eu | |
| ciqydofudyx.eu | |
| cinepycusaw.eu | |
| keraborigin.eu | |
| pumadypyruv.eu | |
| nopegymozow.eu | |
| jewuqyjywyv.eu | |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in CRYPT32.dll:
CertVerifyCertificateChainPolicy
The Trojan installs the following user-mode hooks in WININET.dll:
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFileExA
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpSendRequestA
InternetCloseHandle
The Trojan installs the following user-mode hooks in USER32.dll:
GetWindowTextA
GetClipboardData
SendInput
GetMessageA
GetMessageW
TranslateMessage
The Trojan installs the following user-mode hooks in ADVAPI32.dll:
CryptEncrypt
The Trojan installs the following user-mode hooks in WS2_32.dll:
WSASend
recv
gethostbyname
WSARecv
send
The Trojan installs the following user-mode hooks in kernel32.dll:
CreateFileW
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:632
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%System%\config (28672 bytes)
%WinDir%\AppPatch\ywvdhd.exe (838656 bytes)
%System%\config\SOFTWARE (135168 bytes)
%System%\config\software.LOG (33792 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
