Trojan.Delf.Agent.AH_b5b319a50a
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Delf.Agent.AH (B) (Emsisoft), Trojan.Delf.Agent.AH (AdAware), Backdoor.Win32.Farfli.FD, Backdoor.Win32.Xtrat.FD, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: b5b319a50a55a2af7b589e6fe45d66b6
SHA1: 9b681dfb35d9722e4ce443f8b35956876dbfd873
SHA256: ac2db288324bbfe61b1cc6fd4696c1d0804727c3deac8221e1ef1216e6110885
SSDeep: 3072:iNW7dEvotvXR8azvNU7y01zV/y9XMjalqtU4TQ151YKpq9BKPROXltADUnpGQQgS:iNW7mvI2eNWNhpC8hax1lmkk1W81O
Size: 196096 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):
%original file name%.exe:628
332Point Bad Premium 1.2 autoshot.exe:1928
svchost.exe:1728
Mutexes
The following mutexes were created/opened:
RasPbFile
WininetConnectionMutex
WininetProxyRegistryMutex
DDrawWindowListMutex
DDrawDriverObjectListMutex
__DDrawExclMode__
__DDrawCheckExclMode__
gkzSy6lbkK
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
ShimCacheMutex
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
File activity
The process %original file name%.exe:628 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\332Point Bad Premium 1.2 autoshot.exe.exe (4 bytes)
%WinDir%\332Point Bad Premium 1.2 autoshot.exe (144 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\gkzSy6lbkK.dat (360 bytes)
%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe (673 bytes)
Registry activity
The process %original file name%.exe:628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3AX6N8R2-84O6-073Q-FFTH-87P6K18M5VO8}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe restart"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\gkzSy6lbkK]
"332Point Bad Premium 1.2 autoshot.exe" = "OK"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\XtremeRAT]
"Mutex" = "gkzSy6lbkK"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%]
"332Point Bad Premium 1.2 autoshot.exe" = "WindowsApplication1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 C6 9F ED 65 AF 17 A2 C9 D5 89 AB 2C DB 60 CD"
[HKCU\Software\gkzSy6lbkK]
"ServerName" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\gkzSy6lbkK]
"ServerStarted" = "07/08/2014 15:13:15"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsUpdate" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Java" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%Documents and Settings%\%current user%\Application Data\system32\wuauc"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process 332Point Bad Premium 1.2 autoshot.exe:1928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 0E FD 6A 3F 9D 31 D2 DD 26 90 F2 29 74 D7 A7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
Dropped PE files
| MD5 | File path |
|---|---|
| f0e96161a7a3a8c0f384d34988741edc | c:\WINDOWS\332Point Bad Premium 1.2 autoshot.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 270336 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 274432 | 196608 | 194048 | 5.40371 | 80e8ac7f727ff7e4a35aafeaa6f5dac0 |
| .rsrc | 471040 | 4096 | 1024 | 2.54963 | d2c8b397abcee429dfd88f985f1343c9 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
`.rsrc
ServerKeyloggerU
789:;<&'()* ,-./12345
%SERVER%
URLMON.DLL
shell32.dll
hXXp://
advapi32.dll
kernel32.dll
mpr.dll
version.dll
comctl32.dll
gdi32.dll
opengl32.dll
user32.dll
wintrust.dll
msimg32.dll
KWindows
TServerKeylogger
?qB.Yh
UV%FP
#O&*
.XdP(>j.
.EZ7dDC
.pJ$E
pza%C
X93%U
|H.VS
òDO
.Lz^4s
<(%xw
m#.ie
N 0$.DEP,S
GetWindowsDirectoryW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExA
FindExecutableW
ShellExecuteW
SHDeleteKeyW
URLDownloadToCacheFileW
UnhookWindowsHookEx
SetWindowsHookExW
MapVirtualKeyW
GetKeyboardLayout
GetKeyState
GetKeyboardType
GetKeyboardState
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
N 0$.DEP,S8
URLDo
KERNEL32.DLL
ntdll.dll
oleaut32.dll
shlwapi.dll
wininet.dll
x.html
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
[Execute]
KeyDelBackspace
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
.html
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
.functions
icon=shell32.dll,4
shellexecute=
autorun.inf
\Microsoft\Windows\
ÞFAULTBROWSER%
svchost.exe
ztreme.no-ip.org
VVV.tp-link.com
wuauclt.exe
wuaucltr.exe
windowsUpdate
{3AX6N8R2-84O6-073Q-FFTH-87P6K18M5VO8}HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PTF.ftpserver.com
ftpuser
c:\%original file name%.exe
%original file name%.exe_628_rwx_10001000_0006E000:
ServerKeyloggerU
789:;<&'()* ,-./12345
%SERVER%
URLMON.DLL
shell32.dll
hXXp://
advapi32.dll
kernel32.dll
mpr.dll
version.dll
comctl32.dll
gdi32.dll
opengl32.dll
user32.dll
wintrust.dll
msimg32.dll
KWindows
TServerKeylogger
?qB.Yh
UV%FP
#O&*
.XdP(>j.
.EZ7dDC
.pJ$E
pza%C
X93%U
|H.VS
òDO
.Lz^4s
<(%xw
m#.ie
N 0$.DEP,S
GetWindowsDirectoryW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExA
FindExecutableW
ShellExecuteW
SHDeleteKeyW
URLDownloadToCacheFileW
UnhookWindowsHookEx
SetWindowsHookExW
MapVirtualKeyW
GetKeyboardLayout
GetKeyState
GetKeyboardType
GetKeyboardState
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
x.html
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
[Execute]
KeyDelBackspace
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
.html
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
.functions
icon=shell32.dll,4
shellexecute=
autorun.inf
\Microsoft\Windows\
ÞFAULTBROWSER%
svchost.exe
ztreme.no-ip.org
VVV.tp-link.com
wuauclt.exe
wuaucltr.exe
windowsUpdate
{3AX6N8R2-84O6-073Q-FFTH-87P6K18M5VO8}HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PTF.ftpserver.com
ftpuser
c:\%original file name%.exe
svchost.exe_1728:
.text
`.data
.rsrc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
RPCRT4.dll
NETAPI32.dll
ole32.dll
ntdll.dll
RegCloseKey
RegOpenKeyExW
GetProcessHeap
NtOpenKey
svchost.pdb
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
Windows
Operating System
5.1.2600.5512
svchost.exe_1728_rwx_10000000_00074000:
`.rsrc
ServerKeyloggerU
789:;<&'()* ,-./12345
%SERVER%
URLMON.DLL
shell32.dll
hXXp://
advapi32.dll
kernel32.dll
mpr.dll
version.dll
comctl32.dll
gdi32.dll
opengl32.dll
user32.dll
wintrust.dll
msimg32.dll
KWindows
TServerKeylogger
?qB.Yh
UV%FP
#O&*
.XdP(>j.
.EZ7dDC
.pJ$E
pza%C
X93%U
|H.VS
òDO
.Lz^4s
<(%xw
m#.ie
N 0$.DEP,S
GetWindowsDirectoryW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExA
FindExecutableW
ShellExecuteW
SHDeleteKeyW
URLDownloadToCacheFileW
UnhookWindowsHookEx
SetWindowsHookExW
MapVirtualKeyW
GetKeyboardLayout
GetKeyState
GetKeyboardType
GetKeyboardState
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
N 0$.DEP,S8
URLDo
KERNEL32.DLL
ntdll.dll
oleaut32.dll
shlwapi.dll
wininet.dll
x.html
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
[Execute]
KeyDelBackspace
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
.html
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
.functions
icon=shell32.dll,4
shellexecute=
autorun.inf
\Microsoft\Windows\
ÞFAULTBROWSER%
svchost.exe
ztreme.no-ip.org
VVV.tp-link.com
wuauclt.exe
wuaucltr.exe
windowsUpdate
{3AX6N8R2-84O6-073Q-FFTH-87P6K18M5VO8}HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PTF.ftpserver.com
ftpuser
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\332Point Bad Premium 1.2 autoshot.exe.exe (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\gkzSy6lbkK.dat (360 bytes)
%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe (673 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsUpdate" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Java" = "%Documents and Settings%\%current user%\Application Data\system32\wuauclt.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "%Documents and Settings%\%current user%\Application Data\system32\wuauc" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
