MD5: 1a16ef39d1bc379cef069fc5965871cd
SHA1: 90232570b7efbcd46915ee291b96899754b9879c
SHA256: 7b8bf60b13c631fe6b4e584909e2748dcb2940c6a21fe07037275837b7754691
SSDeep: 3072:0 xGY6Bcau6ewbX Ds3bi9dwACY8 kbexTD:LgizSODsIdwtYkmTD
Size: 101888 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

svcnost.exe:1520
wuauclt.exe:1880
%original file name%.exe:1516
%original file name%.exe:424

The Trojan injects its code into the following process(es):

svcnost.exe:252

File activity

The process svcnost.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\ntuser.dat (55 bytes)
%Documents and Settings%\%current user%\Application Data\desktop.ini (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\desktop.ini (0 bytes)

The process wuauclt.exe:1880 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process %original file name%.exe:1516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\drivers\etc\hosts (5 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process svcnost.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 75 F9 6A 42 BD 8D 58 4D 2E 38 71 7C 15 9D 54"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"SavedLegacySettingsML" = "37 37 34 33 33 36 37 31 36"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data\xfkzjo12lguiypv1tfln3lntlxsib1qb2]
"svcnost.exe" = "%Documents and Settings%\%current user%\Application Data\xfkzjo12lguiypv1tfln3lntlxsib1qb2\svcnost.exe:*:Enabled:ldrsoft"

The process svcnost.exe:1520 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 38 E3 EB 26 77 51 2A D0 28 1A 0B 67 65 17 DE"

The process %original file name%.exe:1516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Init" = "%Documents and Settings%\%current user%\Application Data\xfkzjo12lguiypv1tfln3lntlxsib1qb2\svcnost.exe"

The process %original file name%.exe:424 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E C6 E2 69 52 DC F6 28 6B F5 78 FC 6D E5 D7 4D"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 5915 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

`.rsrc

kernel32.dll

PSAPI.dll

shell32.dll

\svcnost.exe

2\svcnost.exe"

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Init

.text

`.rdata

@.data

.reloc

1.2.3

LDR.ML.STARTED

user32.dll

ws2_32.dll

RegCloseKey

RegCreateKeyA

RegEnumKeyA

RegOpenKeyA

advapi32.dll

FindCloseUrlCache

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryW

FindNextUrlCacheEntryA

wininet.dll

ole32.dll

dnsapi.dll

crypt32.dll

Mailer.dll

87.75.44.12

:9:::>:::

':::*:::

*%:*"%:*

s:\5E;

::;:::<:::<:::

9::::;::>:::

q.jlk

y.hlj

.lmD]

:*>:>:2:>:

:*>:?:*:2:

:*>:>:*:*:*

:8;8;:**

: =7::2^::2

:*==::2`::2 ::3

: =5::2\::2

:*=0::2[::2

: =7::2_::2

: =5::2]::2

(?3: ?;2,?

(?7: ?;6,?

::9:>:?:<:=:2:3:0:1:7:5: :):-:!:%:

:::;:8:9:>:?:=:3:7: :#:

;;8;9;>;<;2;6;*;";

:2:):3:);3:

;3:1:3:1;3:

;3:!:3:!;3:

;3:=:3:=;3:

;3:}:3:};3:

;3:]:3:];3:

;3:-:3:-;3:

;3:5:3:5;3:

;3:%:3:%;3:

;:::8:::9:::>:::<:::2:::6:::*:::":::

::::;:8:9:>:?:<:=:2:3:0:1:6:7:4:5:*: :(:):.:/:,:-:":#: :!:&:':$:%:

::;:8:;:::8:8:;:::8:

6h6C6V6i6

2'2-23292C2I2}2

KWindows

RegOpenKeyExA

RegCreateKeyExA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

>">0>5>;

`]VY\URLW

KERNEL32.DLL

gdi32.dll

SHFolder.dll

svcnost.exe_252_rwx_00400000_00062000:

`.rsrc

kernel32.dll

PSAPI.dll

shell32.dll

\svcnost.exe

2\svcnost.exe"

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Init

.text

`.rdata

@.data

.reloc

1.2.3

LDR.ML.STARTED

user32.dll

ws2_32.dll

RegCloseKey

RegCreateKeyA

RegEnumKeyA

RegOpenKeyA

advapi32.dll

FindCloseUrlCache

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryW

FindNextUrlCacheEntryA

wininet.dll

ole32.dll

dnsapi.dll

crypt32.dll

Mailer.dll

87.75.44.12

:9:::>:::

':::*:::

*%:*"%:*

s:\5E;

::;:::<:::<:::

9::::;::>:::

q.jlk

y.hlj

.lmD]

:*>:>:2:>:

:*>:?:*:2:

:*>:>:*:*:*

:8;8;:**

: =7::2^::2

:*==::2`::2 ::3

: =5::2\::2

:*=0::2[::2

: =7::2_::2

: =5::2]::2

(?3: ?;2,?

(?7: ?;6,?

::9:>:?:<:=:2:3:0:1:7:5: :):-:!:%:

:::;:8:9:>:?:=:3:7: :#:

;;8;9;>;<;2;6;*;";

:2:):3:);3:

;3:1:3:1;3:

;3:!:3:!;3:

;3:=:3:=;3:

;3:}:3:};3:

;3:]:3:];3:

;3:-:3:-;3:

;3:5:3:5;3:

;3:%:3:%;3:

;:::8:::9:::>:::<:::2:::6:::*:::":::

::::;:8:9:>:?:<:=:2:3:0:1:6:7:4:5:*: :(:):.:/:,:-:":#: :!:&:':$:%:

::;:8:;:::8:8:;:::8:

6h6C6V6i6

2'2-23292C2I2}2

KWindows

RegOpenKeyExA

RegCreateKeyExA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

>">0>5>;

`]VY\URLW

KERNEL32.DLL

gdi32.dll

SHFolder.dll

svcnost.exe_252_rwx_00901000_0001C000:

1.2.3

LDR.ML.STARTED

kernel32.dll

user32.dll

ws2_32.dll

RegCloseKey

RegCreateKeyA

RegEnumKeyA

RegOpenKeyA

advapi32.dll

FindCloseUrlCache

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryW

FindNextUrlCacheEntryA

wininet.dll

ole32.dll

dnsapi.dll

crypt32.dll

Mailer.dll

87.75.44.12

/stat1.php

/stat2.php

/smtps.php

/u.php?

/error.php?

/logacc.php

774336716

:9:::>:::

':::*:::

*%:*"%:*

s:\5E;

::;:::<:::<:::

9::::;::>:::

q.jlk

y.hlj

.lmD]

:*>:>:2:>:

:*>:?:*:2:

:*>:>:*:*:*

:8;8;:**

: =7::2^::2

:*==::2`::2 ::3

: =5::2\::2

:*=0::2[::2

: =7::2_::2

: =5::2]::2

(?3: ?;2,?

(?7: ?;6,?

::9:>:?:<:=:2:3:0:1:7:5: :):-:!:%:

:::;:8:9:>:?:=:3:7: :#:

;;8;9;>;<;2;6;*;";

:2:):3:);3:

;3:1:3:1;3:

;3:!:3:!;3:

;3:=:3:=;3:

;3:}:3:};3:

;3:]:3:];3:

;3:-:3:-;3:

;3:5:3:5;3:

;3:%:3:%;3:

;:::8:::9:::>:::<:::2:::6:::*:::":::

::::;:8:9:>:?:<:=:2:3:0:1:6:7:4:5:*: :(:):.:/:,:-:":#: :!:&:':$:%:

::;:8:;:::8:8:;:::8:

6h6C6V6i6

2'2-23292C2I2}2

svcnost.exe_252_rwx_00920000_0001A000:

kernel32.dll

|user32.dll

A~ws2_32.dll

qadvapi32.dll

wwininet.dll

wole32.dll

Nwdnsapi.dll

vcrypt32.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   svcnost.exe:1520
   wuauclt.exe:1880
   %original file name%.exe:1516
   %original file name%.exe:424

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\ntuser.dat (55 bytes)
   %Documents and Settings%\%current user%\Application Data\desktop.ini (9 bytes)
   %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
   %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2448 bytes)
   %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
   %System%\drivers\etc\hosts (5 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Init" = "%Documents and Settings%\%current user%\Application Data\xfkzjo12lguiypv1tfln3lntlxsib1qb2\svcnost.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.