MD5: 08fc130a6d3bb8cdc4dd5836e8fb2bb4
SHA1: a1a790f0b32cd0350436d89058895e80252bac99
SHA256: a36c8e720314bc535a660930608d79a315e8643f253bc6195441775e138ee8ee
SSDeep: 6144:Qn/kFtP0VF9/0lFFNlfSp8XR9fLpJSvzvIpqGC4Cv9br7NZK:QnoMLxwNt9BdCzIpszrK
Size: 314368 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-06-16 14:22:34

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

08fc130a6d3bb8cdc4dd5836e8fb2bb4.exe:1232
huobe.exe:1328

The Trojan-PSW injects its code into the following process(es):

ntvdm.exe:1756

File activity

The process 08fc130a6d3bb8cdc4dd5836e8fb2bb4.exe:1232 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DPA67D5.bat (173 bytes)
%Documents and Settings%\%current user%\Application Data\Gidei\huobe.exe (1739 bytes)

The process ntvdm.exe:1756 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\Default User\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir%\Temp (4 bytes)
%WinDir%\WinSxS (12 bytes)
%WinDir%\Installer (8 bytes)
%WinDir%\SoftwareDistribution (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
C:\Perl\html\faq (4 bytes)
%WinDir%\Help (248 bytes)
%WinDir%\security (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
%WinDir%\Microsoft.NET (4 bytes)
%WinDir%\REGISTRATION (4 bytes)
%WinDir% (672 bytes)
%Documents and Settings%\%current user%\Application Data (4 bytes)
%WinDir%\Temp\scs2.tmp (10145 bytes)
%System% (9440 bytes)
%Documents and Settings%\LocalService\Local Settings (4 bytes)
C:\Perl\eg\PerlEx (4 bytes)
%Documents and Settings%\NetworkService\Local Settings (4 bytes)
C:\Perl\html\lib (45 bytes)
%WinDir%\msagent (4 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%WinDir%\Web (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\test.pml (4272 bytes)
%WinDir%\assembly (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%WinDir%\Temp\scs1.tmp (33880 bytes)
%WinDir%\ime (4 bytes)
%Documents and Settings%\All Users\Application Data (4 bytes)

The Trojan-PSW deletes the following file(s):

%WinDir%\Temp\scs1.tmp (0 bytes)
%WinDir%\Temp\scs2.tmp (0 bytes)

The process huobe.exe:1328 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (6448 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (5180 bytes)

Registry activity

The process 08fc130a6d3bb8cdc4dd5836e8fb2bb4.exe:1232 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 8A B9 E1 06 E3 A8 97 97 30 DF C7 C6 52 8E 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process ntvdm.exe:1756 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 81 1B 48 D3 93 9B A7 07 C7 98 0E 9B F5 3E 12"

The process huobe.exe:1328 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 AF DD 84 52 7A B1 2E CC B3 AA A3 92 90 59 69"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Afaspikyfuso]
"349j74j4" = "0E 5D D6 DB 92 05 6C 05 87 28 6C 09 93 38 66 7C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Network activity (URLs)

URL	IP
hxxp://www.google.com/	74.125.226.210
hxxp://www.google.ca/?gws_rd=cr	74.125.226.216
hxxp://ronallen.me/zNkzAbPw.exe	50.22.11.45

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan-PSW installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   08fc130a6d3bb8cdc4dd5836e8fb2bb4.exe:1232
   huobe.exe:1328

3. Delete the original Trojan-PSW file.
   
4. Delete or disinfect the following files created/modified by the Trojan-PSW:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\DPA67D5.bat (173 bytes)
   %Documents and Settings%\%current user%\Application Data\Gidei\huobe.exe (1739 bytes)
   %Documents and Settings%\Default User\Local Settings (4 bytes)
   %Documents and Settings%\%current user%\Favorites (4 bytes)
   %WinDir%\Temp (4 bytes)
   %WinDir%\WinSxS (12 bytes)
   %WinDir%\Installer (8 bytes)
   %WinDir%\SoftwareDistribution (4 bytes)
   C:\Perl\html\faq (4 bytes)
   %WinDir%\Help (248 bytes)
   %WinDir%\security (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
   %WinDir%\Microsoft.NET (4 bytes)
   %WinDir%\REGISTRATION (4 bytes)
   %WinDir%\Temp\scs2.tmp (10145 bytes)
   %System% (9440 bytes)
   %Documents and Settings%\LocalService\Local Settings (4 bytes)
   C:\Perl\eg\PerlEx (4 bytes)
   %Documents and Settings%\NetworkService\Local Settings (4 bytes)
   C:\Perl\html\lib (45 bytes)
   %WinDir%\msagent (4 bytes)
   %Documents and Settings%\All Users\Documents (4 bytes)
   %WinDir%\Web (4 bytes)
   %Documents and Settings%\%current user%\My Documents (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\test.pml (4272 bytes)
   %WinDir%\assembly (4 bytes)
   %System%\config (4 bytes)
   %WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
   %Documents and Settings%\All Users\Start Menu (4 bytes)
   %WinDir%\Temp\scs1.tmp (33880 bytes)
   %WinDir%\ime (4 bytes)
   %Documents and Settings%\All Users\Application Data (4 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (6448 bytes)
   

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.