MD5: 32a7c824206dff18e65007d811879495
SHA1: 30ce3cda3490ec90aef6eeb29b0333a96341b1e7
SHA256: dda6b98294ae172ebeaaa06df85333df0d1730b5787b8e92bfb19790b465d905
SSDeep: 6144:5mbnOtRYzejaYw/Ur9A1K3Vj66rLIyAJDoXH:kngjaH0W1KlQNJs
Size: 312320 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-06-16 14:22:34

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

32a7c824206dff18e65007d811879495.exe:516
RSQ96D8:424
koxowe.exe:908
koxowe.exe:1948

File activity

The process 32a7c824206dff18e65007d811879495.exe:516 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LJMC940.bat (173 bytes)
%Documents and Settings%\%current user%\Application Data\Xoodyb\koxowe.exe (1737 bytes)

The process RSQ96D8:424 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LDE8C5D.bat (169 bytes)
%Documents and Settings%\%current user%\Application Data\Xoodyb\koxowe.exe (2763 bytes)

The Trojan-PSW deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Xoodyb\koxowe.exe (0 bytes)

The process koxowe.exe:908 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7080 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (5660 bytes)

Registry activity

The process 32a7c824206dff18e65007d811879495.exe:516 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 C5 32 CB 6F 81 58 E0 1F A7 CE A9 15 38 65 07"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process RSQ96D8:424 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F CC 46 1B FC B3 06 A9 41 E1 25 62 7F 2D D3 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process koxowe.exe:908 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E EA BA F4 26 EF F4 63 45 47 AD EE C9 38 61 D5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Hyakfisiq]
"17jih2gh" = "D5 58 46 D1 A3 FC F4 BD E6 D9 8B 77 C9 1B C7 9C"

The process koxowe.exe:1948 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 0D 52 C4 75 2F F0 08 F6 63 ED 6D 7A DB A8 F3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Network activity (URLs)

URL	IP
hxxp://www.google.com/	74.125.226.148
hxxp://www.google.ca/?gws_rd=cr	74.125.226.151

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan-PSW installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   32a7c824206dff18e65007d811879495.exe:516
   RSQ96D8:424
   koxowe.exe:908
   koxowe.exe:1948
   

3. Delete the original Trojan-PSW file.
   
4. Delete or disinfect the following files created/modified by the Trojan-PSW:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\LJMC940.bat (173 bytes)
   %Documents and Settings%\%current user%\Application Data\Xoodyb\koxowe.exe (1737 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LDE8C5D.bat (169 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (7080 bytes)
   

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.