MD5: 17e40d5d1937ea630710308e541b7690
SHA1: bd0ae36453e4c4eed81f55fa7bdc2d69de52a84b
SHA256: 772575dce579745ef375bcf7fed0fd98e05057a11ee98423970103e221a0d7a0
SSDeep: 98304:RwenrjAKkQNyGkfohuqCcUZVAtTD9tMAOYPk0PDyrjcR/ojsXv:Rwu47Q4GkaPUZVKTD9dPk0mXuwjs
Size: 4783104 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-10-31 05:28:47
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

schtasks.exe:2012
rundll32.exe:1548
rundll32.exe:816
dumprep.exe:1980
dumprep.exe:596
%original file name%.exe:320

The Worm injects its code into the following process(es):

svchost.exe:1924

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process rundll32.exe:816 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\rundll32.exe (1813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (1 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (0 bytes)

The process dumprep.exe:1980 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.mdmp (93289 bytes)

The process dumprep.exe:596 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.hdmp (191785 bytes)

The process %original file name%.exe:320 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\rundll32.exe (10448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\TOTALC~1.EXE (70216 bytes)

Registry activity

The process schtasks.exe:2012 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 72 16 B7 60 D3 82 2A 20 0B 4F BB 68 C2 F7 65"

The process rundll32.exe:1548 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 C6 92 EE A2 91 8D 76 88 F7 48 11 EA D4 A8 E4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"svchost.exe" = "Generic Host Process for Win32 Services"

[HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility]
"AppCompatCache" = "EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\%System%]
"svchost.exe" = "EnableNXShowUI"

The process rundll32.exe:816 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 B5 25 DA D4 FA 04 4F 8C AB 0E D1 5C EA 3D 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"schtasks.exe" = "Schedule Tasks"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process dumprep.exe:1980 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 57 B2 CF C9 93 5D A6 D3 B5 94 62 C1 26 F5 DE"

The process dumprep.exe:596 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 B3 13 20 1F 9E 4F 54 F0 A5 C2 1E E1 FC 5E 23"

The process %original file name%.exe:320 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 86 6F 8B 3B 42 2C 42 E3 0A 99 88 94 10 3D D0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.17416
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE
Internal Name: Wextract
File Version: 11.00.9600.17416 (winblue_r4.141030-1500)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Worm connects to the servers at the folowing location(s):

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

SSSh<

PSSShp

PSShp

t.ShB

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

SHELL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

%C DF

rundll32.exe

TOTALC~1.EXE

tcRt

.evH^

.wlkJ

&Y-o}

%sUP5

?_Gg@W.(>D)L8GSLeSh.MF

d@WI`%x

.GmY3

s.ZX^

T.roy

OY.TKc

.bW&r

*2m%C

[.ED'wG

w.IC^

%FXPD

#N-Y}

|.ta&`

V..hM

Aa.Fj

| \.nb00&

H.WP}j

f-t}o

%S.D!

\.BGM

kØ-

;.jHF

nudP

6T.Jx*

]>n%xiQ

l.vR,i

Z%f[r

5].VU

.WfG<

%,.ky

:1.fIR

H.JGo

I.uvS

!eQ.MlM

.Vpr2

%y"C_.fS

D.iNR

nm)%.s

[email protected]

,&z%d

!.Hjn>

s_.MN

eT.gt

Hz.GN

t%7UoJ

.rg}2

lT.NpB

7l.bO`

(.jBU

%S;f%b

,k.Ib

wÍ1T

9nb$%s

qUF  %x;

-^/.pXG]v

PEXe

*IEJY%c

.ZLu,

i/g%S

7~Q%c

x.Ks)

wk.yU

%U~}uv

3.SWc

6Y%fR6

npY.yL

;%UB`

x%f_l

R%x('

.AolK!

j~m.sQ."L9

%x!zG,

a!]%x

lK.Ql

.Bb/L

^.oI1[

KeYip

".SjL3j

?XS%0U

ML.LQ

.Bq-)3

.lvMG

.MEdv

":.Yb:HU

u9.fu

MsG4jUH\

<.Lc~9

.xZ7@

BDpL%D{

N%u&i

6.Fy2

o%U8L

X.Lnt

?.OvP

o%x`%

*'%Xws

ie)%C

BuR%X

] %DhmD

NM?.Tn

El0%U

T.jLz

K.xZ|

%U|>~

lQ.MR_

.Wj*@

w.vRK

Q.hPSr

r8E%X;Dv

E.oac

p9L8%c

}.Crk

?%?.wI

br%U6$

pOÇz0

3:.bL

:>}-u}

_k.DIIr

]K.CV

.Ekf4

`0.WU

Ü-D

.IZwn

2kI.Skxy`qk

o:\O^p

%XOV&_v

7=u

'.TC7

X .El 

.PBkC

IpUE%f

y14?.rN

C|Y.LA

9.mP(

 %Xn\

DsQl

g.TjL

.RINJ

WTN.bZ

.tZV17

.OMd6

5%CyM?h

(.GGqMs{E

m.MD;

.RF.)xV

h".ONM

vIvl

.bblW

%f`RP[}

}3.nA{

J].lN

DG zK.PT

c>.adB

/[ý

.TlW^_

@%.Xb

msgy

~vZ%s

rT.Kz

2z.KVq

 #H-Xi}V

.wXAm

.QkR(

)l%Xz

w.vVi

:I).MGs

-f%FU

AGL{lP.gE

o?%.eS]

GN97Ftp

fL0.Xn

}i6h%u

my.iX

.JrpuF

.Tz5@

%uWl 0

l%d_U

{M.FH=

(-[,_[<.

j3þ

.lP.U

n:\,<M

%sIE2

c.xko

rA?.sZ

7.Upe4

][email protected]

8.ok!.

Sb.TvE

|6m%S

.gB,[

9J%XR

{Zbh.Fvt'

$.nJ3

xL.EfY

S5.OleL

CS.yye

PÝZ

ayö

Frq;<Ý

b 

gv.EmY

Ê$_9;

H^{x%%C|?

;U%dw

}4w

.aIHy

5P}%c&XjO

".DlV

.zqAw&

s%dPU

-n}rP

.vDo@!H=gOD

HPS%S

d\V.Cm

j %c'

^kb.Kn

0ÜPn

cG.mM

.fBY;

T<%DX

]"QF.bt5

c0|'#~%d.

W.lw^

%u3.&

B.AL/

.DRO3

F%dQSL

c.SW@DNN

 p?8jG<%Sr

.wQ'Fw

.ZW*e

|=|=|=|=

,`.twGo

0eo!.tqY

.xbcCI

s.tuXs

%uTQ[$

H.yEd

/-km}

H[6%s

%}L

.odC?7H3

.lUbSn

.Jh ?G2

{x.Xd

ZGt%S>

.tvYD

.cK~v

J_al.CAcT

.eFlv

.Rdqe

[%DM6

b\.Ew

a.lah3

%xN{`n

)%s:IR

<;%CG

!\'.yc&

6v%8s

0\.vcD

?8 .ci

oQ-%DW

5B.FAw-

=.pMZ

Z.ZA?

%u)r@

.he#r

P2`.Jj/

amSG

b}z%c

.tYEb

w%SiY

8&.wC

Yg.cj

%U)nv

.DdC|

.As^{

[%ut?:h

e%U,1

m.uqVw

-;.uz~T$

,F%dM

z#=%d

.nc#>ns

R5fq).BSVO

sr

*!.zJm

z-Q} o

-z.DR

!/!/!/!/

yeX%C

Ph.EtM

cl.AJU

a.BL[d0

8%.bZ

.Zxn[

m.MVM#

q\.Pt

Xr.Qi

 pÒ

.g G%X

[.Meo"

pcRtU

A.JN%

0[0{0{0{0{!

?fX T.Uv

×. 

*M`s%c

.kcHP

*%c`f

.DuP] 

ÿ{g

,.pw54

.dO|Y

.NKC3

L{

_n%Xn

/0.Or

.jc[B

&.bjr

53.DB

Ck)|

"O%F@w

b.TsQr

'x.sP1

1%s",

IMp

.syhGw

-w}!:qJ

ti.Jru

Y.YXF,T

.RT]<1

.PJSI Ox

]%so3

QÕ>A

c6%UO

Fz}%d

|T.cjjk

N.Swu

tJ
;u.XV
%sjuG
Vþ\3
..tU5
|:~$=<~(=>~~>
6.Bd@
|öS
M%du^
r%U6e
vD.xY0
G%uTe
3/.jD
;f.Rb
FÛ&_
INSTALL.INF[Installation]
<assemblyIdentity version="5.1.0.0"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
9 9$9<9@9\9`9
Kernel32.dll
l: %s.
zenet: %s.&Egy sz
ll %s KB szabad ter
nak kell lennie.JAdjon meg egy mapp
k be.BA tall
ges Shell32.dll nem t
n: <%s>. Oka: %s/A rendszer szektorcsoportm
lt.cA telep
shez a Windows 95 vagy a Windows NT 4.0 2-es vagy magasabb sz
pett fel a(z) %s bet
sekor.bA GetProcAddress() sikertelen a(z) '%s' f
nytelen advpack.dll verzi
shez Windows 95 vagy Windows NT 4.0 sz
tre: '%s'.
hez %s KB szabad ter
g a(z) %s: meghajt
&Hiba a Windows mappa lek
s: ExitWindowsEx hiba
jl.hA telep
t: %s.
zenet: %s.tA Telep
lt %s KB szabad ter
jra.OA telep
KA(z) '%s' csomag m
: %s.
tezik: '%s'. L
trehozza?cA(z) '%s' csomag m
.=A(z) '%s' csomag nem kompatibilis a Windows ezen verzi
val.RA(z) '%s' csomag nem kompatibilis a(z) %s f
11.00.9600.17416 (winblue_r4.141030-1500)
WEXTRACT.EXE
11.00.9600.17416
11.00.9600.16384 (winblue_rtm.130821-1623)
WEXTRACT.EXE .MUI
11.00.9600.16384

svchost.exe_1924:


.text
`.data
.rsrc
MSVBVM60.DLL
bss_server.usrReverseRelay
bss_server.usrRelay
tmrWebHide
bss_server.Socket
mswinsck.ocx
MSWinsockLib.Winsock
modLaunchWeb
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\SysWOW64\ieframe.dll
winmm.dll
user32.dll
advapi32.dll
shell32.dll
kernel32.dll
avicap32.dll
advpack.dll
GetAsyncKeyState
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
SHFileOperationA
CreatePipe
PSAPI.DLL
GetTcpTable
ExitWindowsEx
EnumWindows
WinInet.dll
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
ShellExecuteA
keybd_event
CHAT_ADDMSG
cmdShowfiles
UDPSocket
G%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca
tmrTCP
tmrUDP
UDPFlood
VBA6.DLL
C:\Windows\SysWow64\msvbvm60.dll\3
ws2_32.dll
AddMsg
GdiplusShutdown
RemotePort
LocalPort
WSOCK32.DLL
RegCloseKey
RegOpenKeyExA
FtpUpload
ntdll.dll
ole32.dll
crypt32.dll
oleaut32.dll
RegOpenKeyA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
gdi32.dll
olepro32.dll
InternetOpenUrlA
FtpDownload
FtpGetFileA
FtpPutFileA
FtpSetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpOpenFileA
FtpGetFileSize
FtpDeleteFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpRenameFileA
FtpGetDirectory
Http_DownloadFile
msvbvm60.dll
?8??8??8??8??8?
uMsg
strMsg
MsgNum
AllMsgs
lngPort
Port
Password
WebURL
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Occurs after a send operation has completed
*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
{00020404-0000-0000-C000-000000000046}
data.dat
\nir_cmd.bss speak text
\nir_cmd.bss setsysvolume 65535
\nir_cmd.bss mutesysvolume 1
\nir_cmd.bss mutesysvolume 0
\nir_cmd.bss screensaver
\nir_cmd.bss monitor off
\nir_cmd.bss monitor on
PORT
TRANSFERPORT
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\
Keylog
Wscript.Shell
HKEY_CLASSES_ROOT\HTTP\shell\open\command\
\winlogon.exe
iexplore.exe
hXXp://VVV.facebook.com/?ref=home
hXXp://VVV.facebook.com
ADVAPI32.dll
Windows Firewall/Internet Connection Sharing (ICS)
WebCamCapture
\Vuze\Azureus.exe
\LimeWire\LimeWire.exe
\uTorrent\uTorrent.exe
\uTorrent\uTorrent.exe /HIDE
\BitTorrent\bittorrent.exe
\MSWINSCK.OCX
\cmd.exe
dkey
\data.dat
nkey
regsvr32.exe
\pws_mail.bss
\pws_mess.bss
\pws_cdk.bss
\nir_cmd.bss
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "
:*:Enabled:Windows Messanger" /f
winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2
00000000
winmgmts:\\.\root\cimv2
Select * from Win32_Keyboard
api.ipinfodb.com
GET /v2/ip_query.php?key=
&timezone=off HTTP/1.1
Host: api.ipinfodb.com
GET /v2/ip_query_country.php?key=
Portable
winmgmts:\\.\root\SecurityCenter
\wallpaper.bmp
\wallpaper.jpg
WScript.Shell
WinServer 2003, Web Edition
Autorun.ini
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
__oxFrame.class__
Scripting.FileSystemObject
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}
Address family not supported by protocol family.
Operation already in progress.
Operation now in progress.
Socket operation on nonsocket.
Operation not supported.
Protocol family not supported.
Protocol not supported.
Socket type not supported.
Winsock.dll version out of range.
CSocketMaster.SocketExists
CSocketMaster.PostSocket
CSocketMaster.ConnectToIP
CSocketMaster.ResolveIfHostname
CSocketMaster.SendBufferedDataUDP
CSocketMaster.SendBufferedData
sqlite3.dll
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_finalize
\mail.dat
sqlite3_column_text
abe2869f-9b47-4cd9-a358-c22904dba7f7
/stext mess.dat
\mess.dat
/stext mail.dat
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion
Windows
SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
\Mozilla Firefox\
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
softokn3.dll
nss3.dll
\Mozilla\Firefox\
profiles.ini
\signons.sqlite
select * from moz_logins
PK11_GetInternalKeySlot
http\shell\open\command
127.0.0.1
\dump.txt
\uTorrent\uTorrent.exe /DIRECTORY
255.255.255.255
finalizarprocessoportas
drvloadn.dll
CONNECT %s:%i HTTP/1.0
SOFTWARE\Classes\http\shell\open\command
Software\Classes\http\shell\open\command
Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
bnfa.exe
code.is.a.winner
Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId
bps1.exe
bhookpl.dll
drvloadx.dll
VNCHooks.dll
xr4tdwa.exe
shutdown.exe
TCnRawKeyBoard
HuntHTTPDownload
autorun.inf
hXXps://onlineeast#.bankofamerica.com
winlogon.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\system32\userinit.exe,
@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

svchost.exe_1924_rwx_00400000_0005A000:


.text
`.data
.rsrc
MSVBVM60.DLL
bss_server.usrReverseRelay
bss_server.usrRelay
tmrWebHide
bss_server.Socket
mswinsck.ocx
MSWinsockLib.Winsock
modLaunchWeb
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\SysWOW64\ieframe.dll
winmm.dll
user32.dll
advapi32.dll
shell32.dll
kernel32.dll
avicap32.dll
advpack.dll
GetAsyncKeyState
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
SHFileOperationA
CreatePipe
PSAPI.DLL
GetTcpTable
ExitWindowsEx
EnumWindows
WinInet.dll
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
ShellExecuteA
keybd_event
CHAT_ADDMSG
cmdShowfiles
UDPSocket
G%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca
tmrTCP
tmrUDP
UDPFlood
VBA6.DLL
C:\Windows\SysWow64\msvbvm60.dll\3
ws2_32.dll
AddMsg
GdiplusShutdown
RemotePort
LocalPort
WSOCK32.DLL
RegCloseKey
RegOpenKeyExA
FtpUpload
ntdll.dll
ole32.dll
crypt32.dll
oleaut32.dll
RegOpenKeyA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
gdi32.dll
olepro32.dll
InternetOpenUrlA
FtpDownload
FtpGetFileA
FtpPutFileA
FtpSetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpOpenFileA
FtpGetFileSize
FtpDeleteFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpRenameFileA
FtpGetDirectory
Http_DownloadFile
msvbvm60.dll
?8??8??8??8??8?
uMsg
strMsg
MsgNum
AllMsgs
lngPort
Port
Password
WebURL
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Occurs after a send operation has completed
*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
2c49f800-c2dd-11cf-9ad6-0080c7e7b78d
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
{00020404-0000-0000-C000-000000000046}
data.dat
\nir_cmd.bss speak text
\nir_cmd.bss setsysvolume 65535
\nir_cmd.bss mutesysvolume 1
\nir_cmd.bss mutesysvolume 0
\nir_cmd.bss screensaver
\nir_cmd.bss monitor off
\nir_cmd.bss monitor on
PORT
TRANSFERPORT
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\
Keylog
Wscript.Shell
HKEY_CLASSES_ROOT\HTTP\shell\open\command\
\winlogon.exe
iexplore.exe
hXXp://VVV.facebook.com/?ref=home
hXXp://VVV.facebook.com
ADVAPI32.dll
Windows Firewall/Internet Connection Sharing (ICS)
WebCamCapture
\Vuze\Azureus.exe
\LimeWire\LimeWire.exe
\uTorrent\uTorrent.exe
\uTorrent\uTorrent.exe /HIDE
\BitTorrent\bittorrent.exe
\MSWINSCK.OCX
\cmd.exe
dkey
\data.dat
nkey
regsvr32.exe
\pws_mail.bss
\pws_mess.bss
\pws_cdk.bss
\nir_cmd.bss
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "
:*:Enabled:Windows Messanger" /f
winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2
00000000
winmgmts:\\.\root\cimv2
Select * from Win32_Keyboard
api.ipinfodb.com
GET /v2/ip_query.php?key=
&timezone=off HTTP/1.1
Host: api.ipinfodb.com
GET /v2/ip_query_country.php?key=
Portable
winmgmts:\\.\root\SecurityCenter
\wallpaper.bmp
\wallpaper.jpg
WScript.Shell
WinServer 2003, Web Edition
Autorun.ini
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
__oxFrame.class__
Scripting.FileSystemObject
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}
Address family not supported by protocol family.
Operation already in progress.
Operation now in progress.
Socket operation on nonsocket.
Operation not supported.
Protocol family not supported.
Protocol not supported.
Socket type not supported.
Winsock.dll version out of range.
CSocketMaster.SocketExists
CSocketMaster.PostSocket
CSocketMaster.ConnectToIP
CSocketMaster.ResolveIfHostname
CSocketMaster.SendBufferedDataUDP
CSocketMaster.SendBufferedData
sqlite3.dll
sqlite3_open
sqlite3_close
sqlite3_prepare_v2
sqlite3_step
sqlite3_finalize
\mail.dat
sqlite3_column_text
abe2869f-9b47-4cd9-a358-c22904dba7f7
/stext mess.dat
\mess.dat
/stext mail.dat
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion
Windows
SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
\Mozilla Firefox\
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
softokn3.dll
nss3.dll
\Mozilla\Firefox\
profiles.ini
\signons.sqlite
select * from moz_logins
PK11_GetInternalKeySlot
http\shell\open\command
127.0.0.1
\dump.txt
\uTorrent\uTorrent.exe /DIRECTORY
255.255.255.255
finalizarprocessoportas
drvloadn.dll
CONNECT %s:%i HTTP/1.0
SOFTWARE\Classes\http\shell\open\command
Software\Classes\http\shell\open\command
Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
bnfa.exe
code.is.a.winner
Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule
SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId
bps1.exe
bhookpl.dll
drvloadx.dll
VNCHooks.dll
xr4tdwa.exe
shutdown.exe
TCnRawKeyBoard
HuntHTTPDownload
autorun.inf
hXXps://onlineeast#.bankofamerica.com
winlogon.exe
explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\system32\userinit.exe,
@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

rundll32.exe_1548:


.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   schtasks.exe:2012
   rundll32.exe:1548
   rundll32.exe:816
   dumprep.exe:1980
   dumprep.exe:596
   %original file name%.exe:320
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Application Data\rundll32.exe (1813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\z625.xml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.mdmp (93289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WER8d3d.dir00\svchost.exe.hdmp (191785 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\rundll32.exe (10448 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\TOTALC~1.EXE (70216 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.