Analysis | #totalhash

Analysis Date	2015-11-01 14:33:38
MD5	c67c94060549f89eb0443b0e6b36d4fc
SHA1	3150c7fb976b81a601d79623bc61a65b3e2d0744

Static Details:

File type	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section	.text md5: 5a1ca5c8463668cf5e8708cc1392d79c sha1: c307dbaa953371181622e83c224703e1705cedc4 size: 829952
Section	.rdata md5: 28d5f33d73f42682f58adc1ed3cbbd33 sha1: b9344029e11352924391cbcee1aa435fadbb61e9 size: 331264
Section	.data md5: 21fd477c702c4320ee26ac274d7a28c8 sha1: 95ff9c912a7a1350a2bc2e7ba4aa36700afd3a62 size: 7680
Timestamp	2015-04-10 02:45:36
Packer	Microsoft Visual C++ ?.?
PEhash	82b4fc8a3a7d64395d84ac1282c8b49429e0909d
IMPhash	a7930c8a175836787f36a1266cb2969a
AV	Dr. Web	Trojan.DownLoader17.34118
AV	Authentium	W32/Zusy.X.gen!Eldorado
AV	Arcabit (arcavir)	Gen:Variant.Zusy.133308
AV	Emsisoft	Gen:Variant.Zusy.133308
AV	Microsoft Security Essentials	TrojanSpy:Win32/Nivdort.BN
AV	Symantec	Downloader.Upatre!g15
AV	Eset (nod32)	Win32/Kryptik.DDQD
AV	Padvish	no_virus
AV	CA (E-Trust Ino)	no_virus
AV	Fortinet	W32/Kryptik.DDQD!tr
AV	Avira (antivir)	TR/Crypt.ZPACK.196746
AV	Trend Micro	no_virus
AV	Frisk (f-prot)	no_virus
AV	Alwil (avast)	Malware-gen:Win32:Malware-gen
AV	ClamAV	no_virus
AV	F-Secure	Gen:Variant.Zusy.133308
AV	Mcafee	no_virus
AV	Twister	no_virus
AV	Grisoft (avg)	Win32/Cryptor
AV	BitDefender	Gen:Variant.Zusy.133308
AV	Rising	no_virus
AV	Ikarus	Trojan.Win32.Crypt
AV	Ad-Aware	Gen:Variant.Zusy.133308
AV	CAT (quickheal)	no_virus
AV	K7	Trojan ( 004cd0081 )
AV	VirusBlokAda (vba32)	no_virus
AV	MicroWorld (escan)	Gen:Variant.Zusy.133308
AV	Kaspersky	Trojan.Win32.Generic
AV	BullGuard	Gen:Variant.Zusy.133308
AV	MalwareBytes	no_virus
AV	Zillya!	no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates File	C:\WINDOWS\system32\ijcitwmshnedph\tst
Creates File	C:\Documents and Settings\Administrator\Local Settings\Temp\xs7amg4h1khfxo3xl8tfewf.exe
Creates Process	C:\Documents and Settings\Administrator\Local Settings\Temp\xs7amg4h1khfxo3xl8tfewf.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\xs7amg4h1khfxo3xl8tfewf.exe

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Panel Transfer Class Internet Management ➝ C:\WINDOWS\system32\tejnitjkewnn.exe
Creates File	C:\WINDOWS\system32\tejnitjkewnn.exe
Creates File	C:\WINDOWS\system32\drivers\etc\hosts
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\etc
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\lck
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\tst
Deletes File	C:\WINDOWS\system32\\drivers\etc\hosts
Creates Process	C:\WINDOWS\system32\tejnitjkewnn.exe
Creates Service	Socket Audio Peer iSCSI Print Configuration - C:\WINDOWS\system32\tejnitjkewnn.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 800

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝ NULL
Creates File	PIPE\lsarpc
Creates File	C:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG
Creates File	C:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

Registry	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝ NULL
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝ 7
Registry	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝ NULL
Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝ C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1172

Process
↳ C:\WINDOWS\system32\tejnitjkewnn.exe

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝ 1
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\run
Creates File	C:\WINDOWS\TEMP\xs7amg4h1qu5xo3.exe
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\tst
Creates File	pipe\net\NtControlPipe10
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\lck
Creates File	C:\WINDOWS\system32\imzsypuyneag.exe
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\rng
Creates File	\Device\Afd\Endpoint
Creates File	C:\WINDOWS\system32\ijcitwmshnedph\cfg
Creates Process	C:\WINDOWS\TEMP\xs7amg4h1qu5xo3.exe -r 52087 tcp
Creates Process	WATCHDOGPROC "c:\windows\system32\tejnitjkewnn.exe"

Process
↳ C:\WINDOWS\system32\tejnitjkewnn.exe

Creates File	C:\WINDOWS\system32\ijcitwmshnedph\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\tejnitjkewnn.exe"

Creates File	C:\WINDOWS\system32\ijcitwmshnedph\tst

Process
↳ C:\WINDOWS\TEMP\xs7amg4h1qu5xo3.exe -r 52087 tcp

Creates File	\Device\Afd\Endpoint
Winsock DNS	239.255.255.250

Network Details:

DNS	melbourneit.hotkeysparking.com Type: A 8.5.1.16
DNS	nailthere.net Type: A 98.139.135.129
DNS	groupgrain.net Type: A 208.91.197.241
DNS	threeonly.net Type: A 208.91.197.241
DNS	naildeep.com Type: A 74.220.215.218
DNS	humancolor.net Type: A 219.94.203.116
DNS	haircolor.net Type: A 185.53.177.30
DNS	haironly.net Type: A 62.116.130.8
DNS	musicfeel.net Type: A 89.161.255.8
DNS	musichigh.net Type: A 64.29.151.221
DNS	musiconly.net Type: A 207.148.248.143
DNS	spendhigh.net Type: A 208.100.26.234
DNS	frontfeel.net Type: A 195.22.26.253
DNS	frontfeel.net Type: A 195.22.26.254
DNS	frontfeel.net Type: A 195.22.26.231
DNS	frontfeel.net Type: A 195.22.26.252
DNS	wishhigh.net Type: A 69.64.147.242
DNS	rockfeel.net Type: A 211.196.153.94
DNS	humanguide.net Type: A 141.8.226.15
DNS	hairguide.net Type: A 69.172.201.208
DNS	ableread.net Type: A
DNS	fearstate.net Type: A
DNS	longcold.net Type: A
DNS	fridayloss.net Type: A
DNS	wrongbelow.net Type: A
DNS	hilldance.net Type: A
DNS	eggbraker.com Type: A
DNS	ithouneed.com Type: A
DNS	rocktell.net Type: A
DNS	wrongdare.net Type: A
DNS	madedare.net Type: A
DNS	wrongdance.net Type: A
DNS	madedance.net Type: A
DNS	wrongbody.net Type: A
DNS	madebody.net Type: A
DNS	wrongtell.net Type: A
DNS	madetell.net Type: A
DNS	humanfeel.net Type: A
DNS	hairfeel.net Type: A
DNS	humanhigh.net Type: A
DNS	hairhigh.net Type: A
DNS	humanonly.net Type: A
DNS	yardfeel.net Type: A
DNS	yardhigh.net Type: A
DNS	yardcolor.net Type: A
DNS	musiccolor.net Type: A
DNS	yardonly.net Type: A
DNS	wentfeel.net Type: A
DNS	spendfeel.net Type: A
DNS	wenthigh.net Type: A
DNS	wentcolor.net Type: A
DNS	spendcolor.net Type: A
DNS	wentonly.net Type: A
DNS	spendonly.net Type: A
DNS	offerfeel.net Type: A
DNS	fronthigh.net Type: A
DNS	offerhigh.net Type: A
DNS	frontcolor.net Type: A
DNS	offercolor.net Type: A
DNS	frontonly.net Type: A
DNS	offeronly.net Type: A
DNS	hangfeel.net Type: A
DNS	septemberfeel.net Type: A
DNS	hanghigh.net Type: A
DNS	septemberhigh.net Type: A
DNS	hangcolor.net Type: A
DNS	septembercolor.net Type: A
DNS	hangonly.net Type: A
DNS	septemberonly.net Type: A
DNS	joinfeel.net Type: A
DNS	wishfeel.net Type: A
DNS	joinhigh.net Type: A
DNS	joincolor.net Type: A
DNS	wishcolor.net Type: A
DNS	joinonly.net Type: A
DNS	wishonly.net Type: A
DNS	deadfeel.net Type: A
DNS	deadhigh.net Type: A
DNS	rockhigh.net Type: A
DNS	deadcolor.net Type: A
DNS	rockcolor.net Type: A
DNS	deadonly.net Type: A
DNS	rockonly.net Type: A
DNS	wrongfeel.net Type: A
DNS	madefeel.net Type: A
DNS	wronghigh.net Type: A
DNS	madehigh.net Type: A
DNS	wrongcolor.net Type: A
DNS	madecolor.net Type: A
DNS	wrongonly.net Type: A
DNS	madeonly.net Type: A
DNS	humanhalf.net Type: A
DNS	hairhalf.net Type: A
DNS	humanname.net Type: A
DNS	hairname.net Type: A
DNS	humanlate.net Type: A
DNS	hairlate.net Type: A
DNS	yardhalf.net Type: A
DNS	musichalf.net Type: A
DNS	yardname.net Type: A
DNS	musicname.net Type: A
HTTP GET	http://ableread.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://nailthere.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://groupgrain.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://threeonly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://naildeep.com/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://humancolor.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://haircolor.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://haironly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musicfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musichigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musiconly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://spendhigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://frontfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://wishhigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://rockfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://humanguide.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://hairguide.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://ableread.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://nailthere.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://groupgrain.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://threeonly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://naildeep.com/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://humancolor.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://haircolor.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://haironly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musicfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musichigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://musiconly.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://spendhigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://frontfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://wishhigh.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://rockfeel.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://humanguide.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
HTTP GET	http://hairguide.net/index.php?method=validate&mode=sox&v=045&sox=3bb4d404&lenhdr User-Agent:
Flows TCP	192.168.1.1:1036 ➝ 8.5.1.16:80
Flows TCP	192.168.1.1:1038 ➝ 98.139.135.129:80
Flows TCP	192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP	192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP	192.168.1.1:1041 ➝ 74.220.215.218:80
Flows TCP	192.168.1.1:1042 ➝ 219.94.203.116:80
Flows TCP	192.168.1.1:1043 ➝ 185.53.177.30:80
Flows TCP	192.168.1.1:1044 ➝ 62.116.130.8:80
Flows TCP	192.168.1.1:1045 ➝ 89.161.255.8:80
Flows TCP	192.168.1.1:1046 ➝ 64.29.151.221:80
Flows TCP	192.168.1.1:1047 ➝ 207.148.248.143:80
Flows TCP	192.168.1.1:1048 ➝ 208.100.26.234:80
Flows TCP	192.168.1.1:1049 ➝ 195.22.26.253:80
Flows TCP	192.168.1.1:1050 ➝ 69.64.147.242:80
Flows TCP	192.168.1.1:1051 ➝ 211.196.153.94:80
Flows TCP	192.168.1.1:1052 ➝ 141.8.226.15:80
Flows TCP	192.168.1.1:1053 ➝ 69.172.201.208:80
Flows TCP	192.168.1.1:1054 ➝ 8.5.1.16:80
Flows TCP	192.168.1.1:1055 ➝ 98.139.135.129:80
Flows TCP	192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP	192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP	192.168.1.1:1058 ➝ 74.220.215.218:80
Flows TCP	192.168.1.1:1059 ➝ 219.94.203.116:80
Flows TCP	192.168.1.1:1060 ➝ 185.53.177.30:80
Flows TCP	192.168.1.1:1061 ➝ 62.116.130.8:80
Flows TCP	192.168.1.1:1062 ➝ 89.161.255.8:80
Flows TCP	192.168.1.1:1063 ➝ 64.29.151.221:80
Flows TCP	192.168.1.1:1064 ➝ 207.148.248.143:80
Flows TCP	192.168.1.1:1065 ➝ 208.100.26.234:80
Flows TCP	192.168.1.1:1066 ➝ 195.22.26.253:80
Flows TCP	192.168.1.1:1067 ➝ 69.64.147.242:80
Flows TCP	192.168.1.1:1068 ➝ 211.196.153.94:80
Flows TCP	192.168.1.1:1069 ➝ 141.8.226.15:80
Flows TCP	192.168.1.1:1070 ➝ 69.172.201.208:80

Raw Pcap

Strings