Trojan.Win32.Sasfis_0dac11d9c9
Gen:Win32.Malware.Sq0@aqi00PVi (BitDefender), Worm:Win32/Rebhip.A (Microsoft), Trojan.Win32.Llac.dcro (Kaspersky), Worm.Win32.Rebhip.ac (v) (VIPRE), Win32.HLLW.SpyNet.113 (DrWeb), Gen:Win32.Malware.Sq0@aqi00PVi (B) (Emsisoft), Artemis!0DAC11D9C914 (McAfee), Trojan-Dropper.Delf (Ikarus), Gen:Variant.Zusy.47696 (FSecure), Delf.AGPM.dropper (AVG), Win32:Malware-gen (Avast), TROJ_GEN.R047C0DAJ14 (TrendMicro), Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR, GenericDownloader.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan, Worm, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 0dac11d9c91449f45c33933e6f73143e
SHA1: d545ee8b0941e2952d22004e61d3f1084a77b54b
SHA256: 6ac09372e046074f867b9b7a49f600a8807382b32c354b61522f59deec9c40be
SSDeep: 12288:9Lo5y906O64eN2qZ1brFr2nXA1RGDh LKbskg/2GXHOBIrclTsxTEnvuhE:CyWxqj9I6CmKbvg/2G CwlTwT0w
Size: 736768 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-07-14 02:42:43
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:472
The Trojan injects its code into the following process(es):
No processes have been created.
File activity
The process %original file name%.exe:472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\csrss.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\svchost.exe (5660 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\csrss.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\svchost.exe (0 bytes)
Registry activity
The process %original file name%.exe:472 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B AB 84 BE 7B 59 61 9F 86 77 25 43 1A 9F 91 BE"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"
Network activity (URLs)
No activity has been detected.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:472
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\csrss.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\svchost.exe (5660 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\" - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
