MD5: a7f002f83b383ddc2bc3b615a83f2405
SHA1: 582046e3c2c324e1a7dafec6098f22a537395c98
SHA256: 655f5b0d15887fda58813eb9ac4f54874b0e926d36f587ad044b0da496b2968b
SSDeep: 6144:kA6ohswcrej/cc8uOQFeE8y3jDDfL T0AVGgHJ90sTs/cyMAqHozEjRD9:kA6oGwseTHTFe2jffST04GAS Uc62R
Size: 332601 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: QuickSet
Created at: 2014-01-20 20:42:54
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

%original file name%.exe:460
%original file name%.exe:456
aqhy.exe:2008
aqhy.exe:240

The Trojan-PSW injects its code into the following process(es):

Explorer.EXE:692

File activity

The process %original file name%.exe:460 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Xizose\aqhy.exe (2437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCR3760.bat (173 bytes)

The process %original file name%.exe:456 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)

The process aqhy.exe:2008 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)

The process aqhy.exe:240 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (8472 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (5236 bytes)

Registry activity

The process %original file name%.exe:460 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 A7 A3 74 95 3E 66 32 7A 15 D5 23 44 97 7F A8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:456 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 86 FD 16 83 C8 C6 E6 B6 3A 25 09 07 27 15 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

The process aqhy.exe:2008 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 75 E7 55 CF EF 9E 36 15 86 A3 CB CA FB 7C 69"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"

The process aqhy.exe:240 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 92 66 1D CA 38 5A 44 48 A7 64 42 BD 54 E6 15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Ydkaosywbor]
"2e38jeei" = "ELI/s1EkoE6/HO nNag=\"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan-PSW installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
f04d2b1200fd2194f25e433ad9e0e33a

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

.text

`.data

.idata

@.reloc

Invalid parameter passed to C runtime function.

>$>,>4><>

0123456789

http://www.google.com/

http://www.bing.com/

REPORT

HTTP/1.1

RegDeleteKeyExW

gdiplus.dll

GdiplusShutdown

.TJFZAIY]JD^"

?:527|:!;8

!1 (##!(

Kmv`jn`%fnfnzg,bt3crd~da4

1&,$=OJ-:&#O-

-.ynp<

'2$4>%|903

: 8? 1 !

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

w%fkN

t.Ht$HHt

L$$

m9.td

zcÁ

ntdll.dll

KERNEL32.dll

ExitWindowsEx

GetKeyboardState

MsgWaitForMultipleObjects

USER32.dll

CryptGetKeyParam

CryptImportKey

CryptDestroyKey

RegCreateKeyExW

RegCloseKey

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegFlushKey

RegEnumKeyExW

ADVAPI32.dll

UrlUnescapeA

PathIsURLW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

ole32.dll

GDI32.dll

WS2_32.dll

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXImportCertStore

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

IPHLPAPI.DLL

VERSION.dll

msvcrt.dll

9 9$9(9,9094989

> >$>(>,>0>4>|>

00D0K0_0q0z0

:!:(:,:1:8:^:

\StringFileInfo\xx\%s

urlmon.dll

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s

kernel32.dll

launchpadshell.exe

dirclt32.exe

wtng.exe

prologue.exe

pcsws.exe

fdmaster.exe

shell32.dll

cabinet.dll

Wadvapi32.dll

"%s" %s

/c "%s"

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Local Settings\Application Data

Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:460
   %original file name%.exe:456
   aqhy.exe:2008
   aqhy.exe:240
   

3. Delete the original Trojan-PSW file.
   
4. Delete or disinfect the following files created/modified by the Trojan-PSW:
   

   %Documents and Settings%\%current user%\Application Data\Xizose\aqhy.exe (2437 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DCR3760.bat (173 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (2105 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (2105 bytes)
   %Documents and Settings%\%current user%\Application Data\InstallDir\help.exe (2105 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (8472 bytes)
   

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "help" = "%Documents and Settings%\%current user%\Application Data\InstallDir\help.exe"
   
   

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.