MD5: b90b0c6c614036fec3644a2dfba03c43
SHA1: f785f7e696355c8414e2d7d13f06913da296852b
SHA256: b7da24a1c457e6f0c63fd4c13b646fb5bae2f5bf9c8d0d6399d1fc604526c7b4
SSDeep: 384:BkSnmQgodRN5iqEDvTwFVm91kChhEMora:nnfgoDziqWrwTg0Dra
Size: 18604 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-07-29 05:38:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

syuhu.exe:204
viewpdf_updater.exe:196
tasklist.exe:1272
%original file name%.exe:1156
attrib.exe:2008
systeminfo.exe:1500
makecab.exe:1508
driverquery.exe:676
wmp018.exe:920
ump018.exe:1064
reg.exe:1772

The Trojan injects its code into the following process(es):

syuhu.exe:456
Explorer.EXE:128

File activity

The process syuhu.exe:456 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\drivers\123d20.sys (745 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (2208 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (924 bytes)

The process viewpdf_updater.exe:196 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wmp018.exe (1780 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\testa[1].din (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1103UKp[1].din (1760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ump018.exe (325 bytes)

The process tasklist.exe:1272 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (117728 bytes)

The process %original file name%.exe:1156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\viewpdf_updater.exe (18 bytes)

The process systeminfo.exe:1500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (32045 bytes)

The process makecab.exe:1508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~2.tmp (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab3 (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab2 (1040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab5 (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab4 (1040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab6 (8 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cab11 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab9 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab8 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab10 (0 bytes)

The process driverquery.exe:676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (431908 bytes)

The process wmp018.exe:920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WUT399B.bat (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Rekou\syuhu.exe (3572 bytes)

The process ump018.exe:1064 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\client.dll (228 bytes)
%WinDir%\aplib64.dll (12 bytes)
%WinDir%\aplib.dll (11 bytes)
%WinDir%\zlib1.dll (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1152468.cmd (111 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (0 bytes)

The process reg.exe:1772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (577282 bytes)

Registry activity

The process syuhu.exe:456 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 23 F5 67 3A 43 0E 1E CE 01 AF 51 77 16 6F 94"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Uxnexasymau]
"475c88i" = "33 7A 0C E9 4B AD 72 08 01 41 1B C7 00 6F"

The process viewpdf_updater.exe:196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"ump018.exe" = "ump018"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"wmp018.exe" = "wmp018"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 25 AD 5B 56 7A 33 EE 25 D1 DC EB 56 1D C3 08"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process tasklist.exe:1272 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 F3 0C 3B D8 BD A9 64 70 83 79 43 81 C8 15 45"

The process %original file name%.exe:1156 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C FB B0 C4 71 91 E1 A3 86 14 CD CF 53 70 3D F4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"viewpdf_updater.exe" = "viewpdf_updater"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process attrib.exe:2008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 D9 FC 3E FC 25 90 D3 92 08 2F A6 60 73 34 3F"

The process systeminfo.exe:1500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 49 AE C4 64 22 6F D6 DD 73 57 FD 7A 78 9A CB"

The process makecab.exe:1508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 56 CD 68 C9 AD DF 80 6C 28 E3 A5 45 99 30 CA"

The process driverquery.exe:676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 7A AB 41 21 45 38 1E 99 29 64 7E 08 8C B6 EB"

The process wmp018.exe:920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 27 E3 D5 AA 67 52 B0 E4 63 A8 9D AA A2 2B 68"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process ump018.exe:1064 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C BB 77 24 48 AE E9 EF 1B BF 63 26 4B DE E3 5E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dumphare" = "rundll32 %WinDir%\client.dll,CreateProcessNotify"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process reg.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 71 30 45 B9 67 0C 7D 80 3A 4B DD B1 E0 C7 B8"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\Drivers\2d36d0f5d34345b.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver "%System%\Drivers\2d36d0f5d34345b.sys" the Trojan controls operations with a system registry by installing the registry notifier.
The Trojan installs the following kernel-mode hooks:

ZwOpenProcess
ZwOpenThread

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 7
4ed0e5f70cea5345f5d467469173161f
ddb24fc4432da3299b013c7a80e2f901
74b69d906d469eec64119465162ee056
3f28fecab47c3bd146f051d3ec82a4c9
b98c27a70af1d159796c68c699c52b4f
0cfea08590acc27662efaebd163942ce
80bbb5ccc37b8c952c820718e89beb07

URLs

URL	IP
hxxp://95.211.192.195/tasks?version=109&group=0311a&client=7ab306c297395744d3167db8b7aa016c&computer=XP10&os=5.1&latency=0.0
hxxp://95.211.192.195/data?version=1009&group=0311a&client=7ab306c297395744d3167db8b7aa016c&computer=XP10&os=5.1&latency=0.0&type=8

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /tasks?version=109&group=0311a&client=7ab306c297395744d3167db8b7aa016c&computer=XP10&os=5.1&latency=0.0 HTTP/1.1

User-Agent: Microsoft-CryptoAPI/6.1

Host: 95.211.192.195

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Sat, 17 May 2014 10:59:53 GMT

Content-Type: text/html; charset=utf8

Content-Length: 162

Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>....

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.idata

@.reloc

PSSSSSSh

bcdedit.exe -set TESTSIGNING ON

%s\drivers\%s.sys

\\.\NtSecureSys

ntdll.dll

svchost.exe

EUDC\%d

KeDelayExecutionThread

WinExec

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

RegCloseKey

RegFlushKey

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

msvcrt.dll

Invalid parameter passed to C runtime function.

0123456789

%C#m n

m .mm

m .GO

m B.bs

m %syI

4$4,444<4

.me~(

*d%uf

Wu Ø

b#h.qK

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

http://www.google.com/

http://www.bing.com/

REPORT

gdiplus.dll

GdiplusShutdown

F>.yYG\Z-hbv`:

0;-1.3%6

.&6!5"2$2 )>)9!9">;;.

0,#$=<#?

6=42$-?!

RegDeleteKeyExW

HTTP/1.1

m9.td

w%fkN

t.Ht$HHt

L$$

zcÁ

`g%F
GetKeyboardState
MsgWaitForMultipleObjects
RegCreateKeyExW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
PathIsURLW
UrlUnescapeA
SHLWAPI.dll
ShellExecuteW
Secur32.dll
ole32.dll
WS2_32.dll
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXImportCertStore
CRYPT32.dll
HttpSendRequestExA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
WININET.dll
OLEAUT32.dll
NETAPI32.dll
IPHLPAPI.DLL
VERSION.dll
7 7$7(7,7074787<7@7
8'898 <%<
748~8"9=9
8 8&8<8{8
?#?'? ?/?
C"%s"
"%s" %s
/c "%s"
urlmon.dll
cabinet.dll
launchpadshell.exe
dirclt32.exe
wtng.exe
prologue.exe
pcsws.exe
fdmaster.exe
D.tmp
kernel32.dll
shell32.dll
D.dat
Wadvapi32.dll
rapport
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s
\StringFileInfo\xx\%s
%Documents and Settings%\%current user%\Local Settings\Temp
%Documents and Settings%\%current user%\Local Settings\Application Data
Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

syuhu.exe_456_rwx_003F0000_00006000:


PSSSSSSh
bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
\\.\NtSecureSys
ntdll.dll
svchost.exe
EUDC\%d
KeDelayExecutionThread
WinExec
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegFlushKey
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
msvcrt.dll

syuhu.exe_456_rwx_00401000_0006D000:


PSSSSSSh
bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
\\.\NtSecureSys
ntdll.dll
svchost.exe
EUDC\%d
KeDelayExecutionThread
WinExec
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegFlushKey
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
msvcrt.dll
Invalid parameter passed to C runtime function.
0123456789
%C#m n
m .mm
m .GO
m B.bs
m %syI
4$4,444<4
.me~(
*d%uf
Wu Ø
b#h.qK
userenv.dll
del "%s"
if exist "%s" goto d
del /F "%s"
http://www.google.com/
http://www.bing.com/
REPORT
gdiplus.dll
GdiplusShutdown
F>.yYG\Z-hbv`:
0;-1.3%6
.&6!5"2$2 )>)9!9">;;.
0,#$=<#?
6=42$-?!
RegDeleteKeyExW
HTTP/1.1
m9.td
w%fkN
t.Ht$HHt
L$$
zcÁ
`g%F
GetKeyboardState
MsgWaitForMultipleObjects
RegCreateKeyExW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
PathIsURLW
UrlUnescapeA
SHLWAPI.dll
ShellExecuteW
Secur32.dll
ole32.dll
WS2_32.dll
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXImportCertStore
CRYPT32.dll
HttpSendRequestExA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
WININET.dll
OLEAUT32.dll
NETAPI32.dll
IPHLPAPI.DLL
VERSION.dll
7 7$7(7,7074787<7@7
8'898 <%<
748~8"9=9
8 8&8<8{8
?#?'? ?/?
C"%s"
"%s" %s
/c "%s"
urlmon.dll
cabinet.dll
launchpadshell.exe
dirclt32.exe
wtng.exe
prologue.exe
pcsws.exe
fdmaster.exe
D.tmp
kernel32.dll
shell32.dll
D.dat
Wadvapi32.dll
rapport
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s
\StringFileInfo\xx\%s
%Documents and Settings%\%current user%\Local Settings\Temp
%Documents and Settings%\%current user%\Local Settings\Application Data
Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

syuhu.exe_456_rwx_00FD0000_0006E000:


.text
`.data
.idata
@.reloc
PSSSSSSh
bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
\\.\NtSecureSys
ntdll.dll
svchost.exe
EUDC\%d
KeDelayExecutionThread
WinExec
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegFlushKey
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
msvcrt.dll
Invalid parameter passed to C runtime function.
0123456789
%C#m n
m .mm
m .GO
m B.bs
m %syI
4$4,444<4
.me~(
*d%uf
Wu Ø
b#h.qK
userenv.dll
del "%s"
if exist "%s" goto d
del /F "%s"
http://www.google.com/
http://www.bing.com/
REPORT
gdiplus.dll
GdiplusShutdown
F>.yYG\Z-hbv`:
0;-1.3%6
.&6!5"2$2 )>)9!9">;;.
0,#$=<#?
6=42$-?!
RegDeleteKeyExW
HTTP/1.1
m9.td
w%fkN
t.Ht$HHt
L$$
zcÁ
.kF{8
GetKeyboardState
MsgWaitForMultipleObjects
RegCreateKeyExW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
PathIsURLW
UrlUnescapeA
SHLWAPI.dll
ShellExecuteW
Secur32.dll
ole32.dll
WS2_32.dll
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXImportCertStore
CRYPT32.dll
HttpSendRequestExA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
WININET.dll
OLEAUT32.dll
NETAPI32.dll
IPHLPAPI.DLL
VERSION.dll
7 7$7(7,7074787<7@7
8'898 <%<
748~8"9=9
8 8&8<8{8
?#?'? ?/?
"%s" %s
/c "%s"
urlmon.dll
cabinet.dll
launchpadshell.exe
dirclt32.exe
wtng.exe
prologue.exe
pcsws.exe
fdmaster.exe
kernel32.dll
shell32.dll
Wadvapi32.dll
rapport
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s
\StringFileInfo\xx\%s
%Documents and Settings%\%current user%\Local Settings\Temp
%Documents and Settings%\%current user%\Local Settings\Application Data
Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

Explorer.EXE_128_rwx_02270000_0006E000:


.text
`.data
.idata
@.reloc
PSSSSSSh
bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
\\.\NtSecureSys
ntdll.dll
svchost.exe
EUDC\%d
KeDelayExecutionThread
WinExec
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegFlushKey
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
msvcrt.dll
Invalid parameter passed to C runtime function.
0123456789
%C#m n
m .mm
m .GO
m B.bs
m %syI
4$4,444<4
.me~(
*d%uf
Wu Ø
b#h.qK
userenv.dll
del "%s"
if exist "%s" goto d
del /F "%s"
http://www.google.com/
http://www.bing.com/
REPORT
gdiplus.dll
GdiplusShutdown
F>.yYG\Z-hbv`:
0;-1.3%6
.&6!5"2$2 )>)9!9">;;.
0,#$=<#?
6=42$-?!
RegDeleteKeyExW
HTTP/1.1
m9.td
w%fkN
t.Ht$HHt
L$$
zcÁ
%UEhe
GetKeyboardState
MsgWaitForMultipleObjects
RegCreateKeyExW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
PathIsURLW
UrlUnescapeA
SHLWAPI.dll
ShellExecuteW
Secur32.dll
ole32.dll
WS2_32.dll
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXImportCertStore
CRYPT32.dll
HttpSendRequestExA
HttpQueryInfoA
InternetCrackUrlA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
WININET.dll
OLEAUT32.dll
NETAPI32.dll
IPHLPAPI.DLL
VERSION.dll
7 7$7(7,7074787<7@7
8'898 <%<
748~8"9=9
8 8&8<8{8
?#?'? ?/?
"%s" %s
/c "%s"
urlmon.dll
cabinet.dll
launchpadshell.exe
dirclt32.exe
wtng.exe
prologue.exe
pcsws.exe
fdmaster.exe
kernel32.dll
shell32.dll
Wadvapi32.dll
rapport
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s
\StringFileInfo\xx\%s
%Documents and Settings%\%current user%\Local Settings\Temp
%Documents and Settings%\%current user%\Local Settings\Application Data
Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   syuhu.exe:204
   viewpdf_updater.exe:196
   tasklist.exe:1272
   %original file name%.exe:1156
   attrib.exe:2008
   systeminfo.exe:1500
   makecab.exe:1508
   driverquery.exe:676
   wmp018.exe:920
   ump018.exe:1064
   reg.exe:1772
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %System%\drivers\123d20.sys (745 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (2208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wmp018.exe (1780 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\testa[1].din (252 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1103UKp[1].din (1760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ump018.exe (325 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_1.tmp (117728 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\viewpdf_updater.exe (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\~2.tmp (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cab3 (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cab2 (1040 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cab5 (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cab4 (1040 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cab6 (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WUT399B.bat (175 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Rekou\syuhu.exe (3572 bytes)
   %WinDir%\client.dll (228 bytes)
   %WinDir%\aplib64.dll (12 bytes)
   %WinDir%\aplib.dll (11 bytes)
   %WinDir%\zlib1.dll (59 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\1152468.cmd (111 bytes)
   

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "dumphare" = "rundll32 %WinDir%\client.dll,CreateProcessNotify"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.