MD5: 5314b4581733f8e4e875c9fd66818dba
SHA1: 83845c65caae6c58ebd96ee668cca6fbcbf943e6
SHA256: 95631a9b4b6b768c5f38d07036b73d24beebbcf228023429169b334cf597d940
SSDeep: 6144:yUZRDPVwdXzpQCJQnwTkKJunS8UsbrJl0M4ZQLENVcRr3R/Lb9tTeqQyyzmPatY3:FZIhJTMvUsnYRvmr3vtXBy0D5go6W
Size: 837632 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: QuickSet
Created at: 2013-11-05 17:54:53

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

service.exe:1184
%original file name%.exe:600
%original file name%.exe:1800

The Trojan injects its code into the following process(es):

%original file name%.exe:1408

File activity

The process %original file name%.exe:1800 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\FSdML\libcurl-4.dll (4830 bytes)
%Documents and Settings%\%current user%\Application Data\FSdML\service.exe (2344 bytes)
%Documents and Settings%\%current user%\Application Data\FSdML\ltc.exe (5873 bytes)
%Documents and Settings%\%current user%\Application Data\FSdML\pthreadGC2.dll (774 bytes)

Registry activity

The process service.exe:1184 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 21 B1 52 A3 01 C4 B7 C8 DD DF E9 21 63 83 0D"

The process %original file name%.exe:1408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 AF 47 E5 96 D9 34 C0 15 AE 1E C5 57 3E 3B 51"

The process %original file name%.exe:600 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 8D BA 47 FF 87 CD A9 04 25 40 A8 B6 4D A2 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:1800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 3B 8B 92 26 62 77 03 EC D7 B3 E3 FF 79 A7 13"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype" = "%Documents and Settings%\%current user%\Application Data\FSdML\ltc.exe"

Network activity (URLs)

URL	IP
hxxp://141.101.116.209/ltcfiles/pthreadGC2.dll
mine.pool-x.eu	178.33.111.19

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   service.exe:1184
   %original file name%.exe:600
   %original file name%.exe:1800

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\FSdML\libcurl-4.dll (4830 bytes)
   %Documents and Settings%\%current user%\Application Data\FSdML\service.exe (2344 bytes)
   %Documents and Settings%\%current user%\Application Data\FSdML\ltc.exe (5873 bytes)
   %Documents and Settings%\%current user%\Application Data\FSdML\pthreadGC2.dll (774 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Skype" = "%Documents and Settings%\%current user%\Application Data\FSdML\ltc.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.