MD5: 9d69d4a52fc9232425c742e230214ec3
SHA1: c86b2326bc6325b5dc89c9b98e9257562d1ffb56
SHA256: 5ddd622c7c9aa8629b5818fdb3506a5a185ad81186acd05e352168390c5a3cf3
SSDeep: 3072:Va/qxwDd8QqLZ84dmAHctCyW2 W8SSYeQqiavU6ZUQBTfZbLqoVlVeWkn35/p4Wf:VaVDdSG4O7W7Y/GZUGLhVVyGPJm
Size: 265372 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: Armadillov171, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, UPolyXv05_v6
Company: no certificate found
Created at: 2013-08-21 13:16:42

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

net.exe:212
net.exe:368
net1.exe:1312
net1.exe:1800
akhu.exe:468
akhu.exe:1144
9d69d4a52fc9232425c742e230214ec3.exe:840
9d69d4a52fc9232425c742e230214ec3.exe:1808

File activity

The process akhu.exe:1144 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (1425 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (1425 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe (1425 bytes)

The process 9d69d4a52fc9232425c742e230214ec3.exe:840 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmpf344019b.bat (177 bytes)
%Documents and Settings%\%current user%\Application Data\Otvau\akhu.exe (265 bytes)

The process 9d69d4a52fc9232425c742e230214ec3.exe:1808 makes changes in a file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (1425 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (1425 bytes)
%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe (1425 bytes)

Registry activity

The process net.exe:212 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 CF D1 BD 97 87 A6 A3 EF 02 A2 E8 5A F3 8D 4C"

The process net.exe:368 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 F8 7A 37 70 A4 74 85 46 A3 8C D4 D2 B6 62 71"

The process net1.exe:1312 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 AF A9 47 40 CE BB C6 AE 91 1C 09 FE 14 2A 83"

The process net1.exe:1800 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 D9 D1 83 B6 CC 4D 98 21 E1 11 DA CD C8 BE 03"

The process akhu.exe:468 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 84 57 96 36 C4 B1 BD E1 F6 3C 54 6D 17 35 1A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process akhu.exe:1144 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 5F 8F 77 6B D5 7A E4 4D 56 93 35 8C FB 0D 61"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"

The process 9d69d4a52fc9232425c742e230214ec3.exe:840 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 C4 BD 96 D7 53 6B AE 35 1C 8E FA E2 C9 ED A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process 9d69d4a52fc9232425c742e230214ec3.exe:1808 makes changes in a system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 11 8E 3F 85 A9 D2 29 D8 2D 7A A0 66 DF 6F C1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"

Network activity (URLs)

URL	IP
hxxp://93.188.160.27/css2/zconfg.bin
hxxp://192.40.113.80/landing/?403

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSASend
send
closesocket

The Trojan-PSW installs the following user-mode hooks in kernel32.dll:

GetFileAttributesExW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   net.exe:212
   net.exe:368
   net1.exe:1312
   net1.exe:1800
   akhu.exe:468
   akhu.exe:1144
   9d69d4a52fc9232425c742e230214ec3.exe:840
   9d69d4a52fc9232425c742e230214ec3.exe:1808

3. Delete the original Trojan-PSW file.
   
4. Delete or disinfect the following files created/modified by the Trojan-PSW:
   

   %Documents and Settings%\%current user%\Start Menu\Programs\Startup\system.pif (1425 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Startup\system.pif (1425 bytes)
   %Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmpf344019b.bat (177 bytes)
   %Documents and Settings%\%current user%\Application Data\Otvau\akhu.exe (265 bytes)
   

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "live update" = "%Documents and Settings%\%current user%\Application Data\InstallDir\system update.exe"
   
   

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.