Trojan.Win32.Swrort.3_31556b1bf6
Gen:Variant.Zusy.77887 (BitDefender), Trojan.Win32.Neurevt.zv (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.PWS.Siggen1.8719 (DrWeb), Gen:Variant.Zusy.77887 (B) (Emsisoft), RDN/Generic.grp!gs (McAfee), WS.Reputation.1 (Symantec), Trojan.Win32.Neurevt (Ikarus), Gen:Variant.Zusy.77887 (FSecure), Crypt2.CGWC (AVG), TROJ_GEN.R0CBC0UAG14 (TrendMicro), Trojan.Win32.Swrort.3.FD, Sinowal.YR (Lavasoft MAS)
Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 31556b1bf65dbe178c5662bd1193bae5
SHA1: 08df6292fe9ecfed8775d6599c6138d6c8f1c0e6
SHA256: 785d06298dbbb5dad87cec853bd336dd9822bdae3aa9495205a175f21a3980da
SSDeep: 6144:sWl/WaYAvoTlF1O14 8IVpf2pTt66yYQtt4x/uNa:V/LXvoVOrbdm9
Size: 253952 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-12-27 23:45:49
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1848
The Trojan injects its code into the following process(es):
No processes have been created.
File activity
The process %original file name%.exe:1848 makes changes in the file system.
The Trojan deletes the following file(s):
%Program Files%\Common Files\Usertray0\0009400a.txt (0 bytes)
Registry activity
The process %original file name%.exe:1848 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 B2 B3 16 D9 43 14 32 4F 31 C1 47 03 AF 02 52"
[HKCU\Software\Classes\CLSID\{FC28BA09-BA9B-444D-AE7F-98A983B69094}\2042049C\CG1]
"HAL" = "05 EE 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKCU\Software\Win7zip]
"Uuid" = "FC 28 BA 09 BA 9B 44 4D AE 7F 98 A9 83 B6 90 94"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bfvjkphyr.exe]
"DisableExceptionChainValidation" = ""
[HKCU\Software\Classes\CLSID\{FC28BA09-BA9B-444D-AE7F-98A983B69094}\2042049C\CG1]
"BID" = "20 00 08 00 1B 00 01 00 DE 07 00 00 14 00 88 FF"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://206.72.201.132/panel/order.php |  |
| microsoft.com | 65.55.58.201 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in dnsapi.dll:
DnsQuery_W
The Trojan installs the following user-mode hooks in WS2_32.dll:
gethostbyname
getaddrinfo
GetAddrInfoW
The Trojan installs the following user-mode hooks in ntdll.dll:
KiFastSystemCall
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1848
- Delete the original Trojan file.
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
