Analysis Date2015-11-14 06:29:24
MD55bebbba82ee2c7ec72acf7e4cd0f7e03
SHA10deb09b55a0720909c77b70e59264f454583a45c

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: e37f05ae58f010c3d5be205602130f0d sha1: 05e95dc3049b757d059ab376ed926345be1669b4 size: 1154560
Section.rdata md5: c5c817da057883a7018ae80bb03bc741 sha1: e1d966df16041a9a38090958f31bab35465f7cf6 size: 311296
Section.data md5: 2e688e925510cc45fcd75b0aa0cf2419 sha1: 90ecbf8d75dde835adb7d2f17ce27b502bc3703a size: 8192
Section.reloc md5: 921965d8ec377b364e18bfe7f4e0a41b sha1: a3371199b800c30fce99e64a251c715d3653a19d size: 143360
Timestamp2015-05-11 03:57:52
PackerVC8 -> Microsoft Corporation
PEhashef861fea7c49aad2ce1aa292d9d383a918ba34c1
IMPhash93943bfec19791a74646f30e45549770
AVRisingno_virus
AVMcafeeTrojan-FGIJ!5BEBBBA82EE2
AVAvira (antivir)no_virus
AVTwisterno_virus
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Z
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusno_virus
AVEmsisoftGen:Variant.Diley.1
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend Microno_virus
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Zusy.141331
AVArcabit (arcavir)Gen:Variant.Zusy.141331
AVClamAVno_virus
AVDr. WebTrojan.Bayrob.5
AVF-SecureGen:Variant.Zusy.141331
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeTrojan-FGIJ!5BEBBBA82EE2
AVAvira (antivir)no_virus
AVTwisterno_virus
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Z
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusno_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\svyyg5r41knxj6gmftaxyha.exe
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\svyyg5r41knxj6gmftaxyha.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\svyyg5r41knxj6gmftaxyha.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Topology Protected PC ➝
C:\WINDOWS\system32\sryvucnpyeij.exe
Creates FileC:\WINDOWS\system32\sryvucnpyeij.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\lck
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\etc
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\sryvucnpyeij.exe
Creates ServiceHelper Internet Event Auto Mapper Registry - C:\WINDOWS\system32\sryvucnpyeij.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 800

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝
NULL
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1164

Process
↳ C:\WINDOWS\system32\sryvucnpyeij.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\cfg
Creates FileC:\WINDOWS\TEMP\svyyg5r41qtpj6gm.exe
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\rng
Creates FileC:\WINDOWS\system32\vxchnbrlyjpg.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\tst
Creates FileC:\WINDOWS\system32\zchzaaryvlbi\run
Creates ProcessC:\WINDOWS\TEMP\svyyg5r41qtpj6gm.exe -r 41370 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\sryvucnpyeij.exe"

Process
↳ C:\WINDOWS\system32\sryvucnpyeij.exe

Creates FileC:\WINDOWS\system32\zchzaaryvlbi\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\sryvucnpyeij.exe"

Creates FileC:\WINDOWS\system32\zchzaaryvlbi\tst

Process
↳ C:\WINDOWS\TEMP\svyyg5r41qtpj6gm.exe -r 41370 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSrecordsoldier.net
Type: A
208.91.197.241
DNSfliersurprise.net
Type: A
208.91.197.241
DNShistorybright.net
Type: A
208.91.197.241
DNSchiefsoldier.net
Type: A
208.91.197.241
DNSclasssurprise.net
Type: A
208.91.197.241
DNSthosecontinue.net
Type: A
208.91.197.241
DNSthroughcontain.net
Type: A
208.91.197.241
DNSbelongguard.net
Type: A
208.91.197.241
DNSmaybellinethaddeus.net
Type: A
208.91.197.241
DNSkimberleyshavonne.net
Type: A
208.91.197.241
DNSnaildeep.com
Type: A
74.220.215.218
DNSriddenstorm.net
Type: A
66.147.240.171
DNSdestroystorm.net
Type: A
216.239.138.86
DNSsignvoice.net
Type: A
208.100.26.234
DNSroomfive.net
Type: A
217.160.193.90
DNSroomeight.net
Type: A
220.124.143.32
DNSjumpfive.net
Type: A
82.165.21.75
DNSthreefive.net
Type: A
184.168.221.54
DNShusbandfound.net
Type: A
DNSleadershort.net
Type: A
DNSeggbraker.com
Type: A
DNSithouneed.com
Type: A
DNSroomvoice.net
Type: A
DNSsignfive.net
Type: A
DNSsigneight.net
Type: A
DNSroomthey.net
Type: A
DNSsignthey.net
Type: A
DNSmovevoice.net
Type: A
DNSjumpvoice.net
Type: A
DNSmovefive.net
Type: A
DNSmoveeight.net
Type: A
DNSjumpeight.net
Type: A
DNSmovethey.net
Type: A
DNSjumpthey.net
Type: A
DNShillvoice.net
Type: A
DNSwhomvoice.net
Type: A
DNShillfive.net
Type: A
DNSwhomfive.net
Type: A
DNShilleight.net
Type: A
DNSwhomeight.net
Type: A
DNShillthey.net
Type: A
DNSwhomthey.net
Type: A
DNSfeltvoice.net
Type: A
DNSlookvoice.net
Type: A
DNSfeltfive.net
Type: A
DNSlookfive.net
Type: A
DNSfelteight.net
Type: A
DNSlookeight.net
Type: A
DNSfeltthey.net
Type: A
DNSlookthey.net
Type: A
DNSthreevoice.net
Type: A
DNSlordvoice.net
Type: A
DNSlordfive.net
Type: A
DNSthreeeight.net
Type: A
DNSlordeight.net
Type: A
DNSthreethey.net
Type: A
DNSlordthey.net
Type: A
DNSdrinkvoice.net
Type: A
DNSwifevoice.net
Type: A
DNSdrinkfive.net
Type: A
DNSwifefive.net
Type: A
DNSdrinkeight.net
Type: A
DNSwifeeight.net
Type: A
DNSdrinkthey.net
Type: A
DNSwifethey.net
Type: A
DNSknowaunt.net
Type: A
DNSableaunt.net
Type: A
DNSknowscene.net
Type: A
DNSablescene.net
Type: A
DNSknowgreat.net
Type: A
DNSablegreat.net
Type: A
DNSknowdont.net
Type: A
DNSabledont.net
Type: A
DNSpickaunt.net
Type: A
DNSsongaunt.net
Type: A
DNSpickscene.net
Type: A
DNSsongscene.net
Type: A
DNSpickgreat.net
Type: A
DNSsonggreat.net
Type: A
DNSpickdont.net
Type: A
DNSsongdont.net
Type: A
DNSroomaunt.net
Type: A
DNSsignaunt.net
Type: A
DNSroomscene.net
Type: A
DNSsignscene.net
Type: A
DNSroomgreat.net
Type: A
DNSsigngreat.net
Type: A
DNSroomdont.net
Type: A
DNSsigndont.net
Type: A
DNSmoveaunt.net
Type: A
DNSjumpaunt.net
Type: A
DNSmovescene.net
Type: A
DNSjumpscene.net
Type: A
DNSmovegreat.net
Type: A
DNSjumpgreat.net
Type: A
DNSmovedont.net
Type: A
DNSjumpdont.net
Type: A
DNShillaunt.net
Type: A
DNSwhomaunt.net
Type: A
DNShillscene.net
Type: A
DNSwhomscene.net
Type: A
DNShillgreat.net
Type: A
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://kimberleyshavonne.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://riddenstorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://destroystorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://signvoice.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomeight.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://jumpfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://threefive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://recordsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1043 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1045 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1046 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1047 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1048 ➝ 66.147.240.171:80
Flows TCP192.168.1.1:1049 ➝ 216.239.138.86:80
Flows TCP192.168.1.1:1050 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1051 ➝ 217.160.193.90:80
Flows TCP192.168.1.1:1052 ➝ 220.124.143.32:80
Flows TCP192.168.1.1:1053 ➝ 82.165.21.75:80
Flows TCP192.168.1.1:1054 ➝ 184.168.221.54:80
Flows TCP192.168.1.1:1055 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1058 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1059 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1060 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1061 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1062 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1063 ➝ 208.91.197.241:80

Raw Pcap

Strings