MD5: 6fdfd598f057f274e8f3eac678dd9856
SHA1: 24bb19ab7dcef363adbb9af86ca45c7f2c4de2ca
SHA256: c2cc10d49db312b487ebc312661f58470054efd16c2ba7294fb74429aa4396ca
SSDeep: 6144:JZXBsWqsE/Ao mv8Qv0LVmwq4FU0nN876cFbuje8XaqweEpQ9s :XXmwRo mv8QD4 0N46ch18KqwH4x
Size: 292608 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

crypt.exe:1060
%original file name%.exe:1944
WScript.exe:1764
WScript.exe:1088

The Trojan injects its code into the following process(es):

crypt.exe:2140

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1944 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Gorn\Gorn\prostoigra.bat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (194 bytes)
%Program Files%\Gorn\Gorn\2.txt (27 bytes)
%Program Files%\Gorn\Gorn\Uninstall.exe (4235 bytes)
%Program Files%\Gorn\Gorn\crypt.exe (2792 bytes)
%Program Files%\Gorn\Gorn\neznoesvidanie.vbs (276 bytes)
%Program Files%\Gorn\Gorn\dns_bablo.vbs (818 bytes)
%Program Files%\Gorn\Gorn\Uninstall.ini (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
%Program Files%\Gorn\Gorn\1.txt (16 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\$inst (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (0 bytes)

The process WScript.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ITWPI1EJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YAQPODX9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HSZ2VGL\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MD03GXC1\desktop.ini (67 bytes)

Registry activity

The process crypt.exe:1060 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 4D 68 97 46 4D B3 2C 8A C1 75 98 EA F3 CC C9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process crypt.exe:2140 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 23 58 CE B4 D7 02 B6 48 4E EB F7 1B F9 48 00"

[HKCU\Software\NVIDIA Corporation\Global\nvUpdate]
"Value" = "20150108"
"Guid" = "05618456-23c5-42be-af9b-c15b746c8a33"

The process %original file name%.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"EstimatedSize" = "179"
"Publisher" = "Gorn"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"DisplayIcon" = "%Program Files%\Gorn\Gorn\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"NoModify" = "1"
"UninstallString" = "%Program Files%\Gorn\Gorn\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"DisplayName" = "Gorn 1.3"
"InstallDate" = "20150111"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Gorn\Gorn]
"CRYPT.EXE" = "Closure"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Gorn\Gorn]
"prostoigra.bat" = "prostoigra"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 BC B1 39 BD 7E B4 E8 48 4F DB 94 14 CF 57 9C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"VersionMajor" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"InstallSource" = "c:\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"Language" = "1033"
"VersionMinor" = "3"
"InstallLocation" = "%Program Files%\Gorn\Gorn\"
"DisplayVersion" = "1.3"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gorn" = "%Program Files%\Gorn\Gorn\crypt.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The process WScript.exe:1764 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 6C F8 52 9E 32 7A E0 E3 54 EE 11 CF 85 DB 4A"

The process WScript.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA 98 88 28 AB EC DA 0F A6 6C B3 B9 AF 73 41 95"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1178 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Gorn
Product Name:
Product Version:
Legal Copyright: Gorn
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.3
File Description: Gorn 1.3 Installation
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 7
03b42612688b3f9459683b1bdd0acd89
62c899631bfeeaff81ffb879196c689c
e685cf50ca1c1e253a8be29dc06d9bb9
3519312b0a92dcb093ac525d44038bdc
f717bbc6e9aea02f3ebf7745d71f6497
e3e08e9db110948605a5a4a94253ff33
4e18bc489a10f37d0b0c65bcc75f9e03

URLs

URL	IP
hxxp://108.61.183.181/apologi/gisgis/515/?mwa=217
time.windows.com	198.23.250.133
server-7.googletestadminwin.com	198.23.250.133

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /apologi/gisgis/515/?mwa=217 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 108.61.183.181

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx/1.6.2

Date: Sun, 11 Jan 2015 18:45:05 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.22

Set-Cookie: ci_session=fbDKZiFphO/xR8mfR8He5QHhlCNRXATWEIobJSrOFkxEHvTkEIJYXl0F1fnbigwuO/6L6Qmdjtg5bXr4goypzYE4wpDzgfFuegRj/6aZa3Vnam3ZekfRl1fmS2dfUyq5FccTp72VECF1WydDlZd5Q28RPMgiKomGOxqLMxtxUgT55rInpOl5rX3G5eS8TX1NGqQ9Pt/cNnNgQcbOl7lZ8E1Sbd85suO/MQTmJI3FYLaPEMAIgVUh+LS5thIlYqPLRAjO2E/iNGCM+eX4C9ZyE/pK/YrCCcSPHoi9wCGMke1WJAgIl9YpJy7bH6AuGTx6QH6dJvP8bIE93kHLHPjBousDuIfcnybdN6Z+49igPrKhj7iPW72ZnsY3sWVloTtl+ibBm/wjbSuxGdW3VqE+83F2fdzXmHxrcPq8OlHNHnQSvD1eFi8qYKLyQ2gXsqhC727ITWeavhC+2q92JF6R8Q==; path=/
4d3..<!DOCTYPE html>..<html lang="en">..<head>..<
title>404 Page Not Found</title>..<style type="text/css"&g
t;..::selection{ background-color: #E13300; color: white; }..::moz-sel
ection{ background-color: #E13300; color: white; }..::webkit-selection
{ background-color: #E13300; color: white; }..body {...background-colo
r: #fff;...margin: 40px;...font: 13px/20px normal Helvetica, Arial, sa
ns-serif;...color: #4F5155;..}..a {...color: #003399;...background-col
or: transparent;...font-weight: normal;..}..h1 {...color: #444;...back
ground-color: transparent;...border-bottom: 1px solid #D0D0D0;...font-
size: 19px;...font-weight: normal;...margin: 0 0 14px 0;...padding: 14
px 15px 10px 15px;..}..code {...font-family: Consolas, Monaco, Courier
 New, Courier, monospace;...font-size: 12px;...background-color: #f9f9
f9;...border: 1px solid #D0D0D0;...color: #002166;...display: block;..
.margin: 14px 0 14px 0;...padding: 12px 10px 12px 10px;..}..#container
 {...margin: 10px;...border: 1px solid #D0D0D0;...-webkit-box-shadow: 
0 0 8px #D0D0D0;..}..p {...margin: 12px 15px 12px 15px;..}..</style
>..</head>..<body>...<div id="container">....<
h1>404 Page Not Found</h1>....<p>The page you requested
 was not found.</p>.</div>..</body>..</html>..
0..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

P`.data

.rdata

0@.eh_fram

0@.bss

.idata

bpass

q05618456-23c5-42be-af9b-c15b746c8a33

libgcj-13.dll

@%s:%s:%d

-_.!~*'()

GET /stat?uptime=%d&downlink=%d&uplink=%d&id=%s&statpass=%s&version=%d&features=%d&guid=%s&comment=%s&p=%d&s=%s HTTP/1.0

badpass

%s:%s

20150108

server-%s.googletestadminwin.com:35

8kernel32.dll

advapi32.dll

rpcrt4.dll

shlwapi.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

ws2_32.dll

VirtualQuery failed for %d bytes at address %p

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (tdm-2) 4.8.1

KERNEL32.dll

msvcrt.dll

crypt.exe_2140_rwx_00400000_00010000:

.text

P`.data

.rdata

0@.eh_fram

0@.bss

.idata

bpass

q05618456-23c5-42be-af9b-c15b746c8a33

libgcj-13.dll

@%s:%s:%d

-_.!~*'()

GET /stat?uptime=%d&downlink=%d&uplink=%d&id=%s&statpass=%s&version=%d&features=%d&guid=%s&comment=%s&p=%d&s=%s HTTP/1.0

badpass

%s:%s

20150108

server-%s.googletestadminwin.com:35

8kernel32.dll

advapi32.dll

rpcrt4.dll

shlwapi.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

ws2_32.dll

VirtualQuery failed for %d bytes at address %p

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (tdm-2) 4.8.1

KERNEL32.dll

msvcrt.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   crypt.exe:1060
   %original file name%.exe:1944
   WScript.exe:1764
   WScript.exe:1088

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files%\Gorn\Gorn\prostoigra.bat (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (194 bytes)
   %Program Files%\Gorn\Gorn\2.txt (27 bytes)
   %Program Files%\Gorn\Gorn\Uninstall.exe (4235 bytes)
   %Program Files%\Gorn\Gorn\crypt.exe (2792 bytes)
   %Program Files%\Gorn\Gorn\neznoesvidanie.vbs (276 bytes)
   %Program Files%\Gorn\Gorn\dns_bablo.vbs (818 bytes)
   %Program Files%\Gorn\Gorn\Uninstall.ini (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
   %Program Files%\Gorn\Gorn\1.txt (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ITWPI1EJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YAQPODX9\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HSZ2VGL\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MD03GXC1\desktop.ini (67 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Gorn" = "%Program Files%\Gorn\Gorn\crypt.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.