MD5: 45d93e6f1b50cd4809efdcbd5f3afddf
SHA1: 18ad978057f28c3b1ed907d2b8f44193826c3f96
SHA256: bb7f2f151870ad30ccc4dbc0cf0582a3ad112140eb39305accb52f42bc6b14cb
SSDeep: 6144:TZulQoBkb6sX3OlajgdZ7 0BrsvD 89iKF5deujXdOGNSwzMKzQgMEFBzc2kWiQM:boBurIZ7BrO C0u5OGNhVdnW2khQM
Size: 454656 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: P i r i f o r m L t d .
Created at: 2011-07-23 16:56:19
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1852
regedit.exe:1240
regedit.exe:892
attrib.exe:452
taskkill.exe:1244

The Trojan injects its code into the following process(es):
No processes have been created.

File activity

The process %original file name%.exe:1852 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\system\addis\svchost.reg (332 bytes)
%System%\addis\svchost.exe (3830 bytes)
%WinDir%\wsjv9nG.bat (1 bytes)
%WinDir%\system\addis\svchost.exe (3830 bytes)

Registry activity

The process %original file name%.exe:1852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 0F 09 17 A4 D3 B4 95 CD C6 9C C9 59 6D 49 B8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

The process regedit.exe:1240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 AA BD 4F D6 BC 1C CB 2E 09 F1 79 9C EB E9 25"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]
"Startup" = "EventStartup"
"Asynchronous" = "1"
"Impersonate" = "0"
"DllName" = "wminotify.dll"

The process regedit.exe:892 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 D9 AD C8 E6 16 3A E0 06 3C 7A AC C1 E6 B7 1E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"360safe" = "c:\windows\system32\addis\svchost.exe"

The process attrib.exe:452 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F C5 B1 93 E7 97 8D 35 A4 A4 30 6C 58 51 6D 76"

The process taskkill.exe:1244 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 7B 6C 4C 1D 10 63 8E 1B 25 33 21 56 F5 21 9C"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
062bfc362f28aca2234b9653b28e7226

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u.hLvJ

.tTPV

FTPjK

FtPj;

F.PjRWj

u.hX&I

u.WWj

u.VVj

u$SShe

wininet.dll

kernel32.dll

user32.dll

advapi32.dll

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

EnumWindows

@.reloc

__MSVCRT_HEAP_SELECT

KERNEL32.dll

USER32.dll

GetCPInfo

Hookmsgina.dll

msgina.dll

\boot.dat

%d/%d/%d/%d:%d:%d

7"72787|7"8

%System%\wminotify.dll

%System%\On.reg

regedit -s %System%\On.reg

%System%\boot.dat

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

http://www.ip138.com/ips.asp?ip=

smtp.163.com

[email protected]

[email protected]

Pass =

OldPass =

http://www.net.cn/static/customercare/yourIP.asp

http://

https://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

portuguese-brazilian

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

GetKeyState

GetKeyboardLayout

GetViewportOrgEx

GDI32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

COMCTL32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

SMTP

AUTH LOGIN

LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

Service Pack %d

Windows 2003

Windows XP

Windows 2000

Windows NT

Windows ??

Windows Millenium Edition

Windows 98 Second Edition

Windows 98 SP1

Windows 98

Windows 95 OSR2

Windows 95 SP1

Windows 95

Windows CE

Windows

Microsoft Windows Me

Microsoft Windows 98

Microsoft Windows 95

Microsoft Windows 2003

Microsoft Windows XP

Microsoft Windows 2000

Microsoft Windows NT

KERNEL32.DLL

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

%System%\addis\svchost.exe

#include "l.chs\afxres.rc" // Standard components

%#.ippqrvvvu

User = %s

Domain = %s

Pass = %s

OldPass = %s

5.1.2600.2180

termsrv.exe

wminotify.dll

Microsoft(R) Windows(R) Operating System

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]

"DllName"="wminotify.dll"

(*.*)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1852
   regedit.exe:1240
   regedit.exe:892
   attrib.exe:452
   taskkill.exe:1244

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %WinDir%\system\addis\svchost.reg (332 bytes)
   %System%\addis\svchost.exe (3830 bytes)
   %WinDir%\wsjv9nG.bat (1 bytes)
   %WinDir%\system\addis\svchost.exe (3830 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "360safe" = "c:\windows\system32\addis\svchost.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.