Analysis Date2015-07-29 14:18:05
MD56fb1304b6d99a0b299d486c0510ef6ba
SHA1bc8081d47b6c58f052425ed9498b147bbb3c89cc

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 1a921cefaf9ff12cc9a46c2b0f7531fa sha1: 975df02a9f0a0dc45905becfa65c1869ea463557 size: 625152
Section.rdata md5: 246195fb5236870cd227177b1c8071f8 sha1: c227bcfc3a3cd5dbac028a0c33fc3838528b21fe size: 52224
Section.data md5: 8f117d6aa6c9448bff8cc8fa2cacb0a9 sha1: afc243cb449ec4e33f7ea8ea4fee8ca4aa59ad9f size: 123904
Timestamp2014-02-12 17:49:23
PackerMicrosoft Visual C++ ?.?
PEhash751d862b74dd5cbb328cc8eababb05f0b7ac318c
IMPhash2993db6bb9f14d10a52d97cd4aaeb62f
AVSymantecDownloader.Upatre!g15
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVAvira (antivir)TR/Crypt.ZPACK.81522
AVEset (nod32)Win32/Kryptik.CCLE
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.Y
AVIkarusVirus.Win32.Cryptor
AVBitDefenderGen:Variant.Symmi.22722
AVTwisterTrojan.Girtk.BCFJ.cpsn.mg
AVVirusBlokAda (vba32)no_virus
AVAlwil (avast)Kryptik-PLS [Trj]
AVFortinetW32/Agent.VNC!tr
AVPadvishno_virus
AVTrend MicroTSPY_NIVDORT.SM
AVEmsisoftGen:Variant.Symmi.22722
AVMalwareBytesno_virus
AVK7no_virus
AVGrisoft (avg)Win32/Cryptor
AVAd-AwareGen:Variant.Symmi.22722
AVRising0x58e522e2
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVMcafeeRDN/Generic PWS.y
AVCA (E-Trust Ino)no_virus
AVFrisk (f-prot)no_virus
AVClamAVno_virus
AVDr. WebTrojan.DownLoader15.9852
AVBullGuardGen:Variant.Symmi.22722
AVCAT (quickheal)no_virus
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVF-SecureGen:Variant.Symmi.22722
AVAuthentiumW32/Symmi.AH.gen!Eldorado

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\aghobxk1lvcj8ronxwlp.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\aghobxk1lvcj8ronxwlp.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\aghobxk1lvcj8ronxwlp.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Reports SNMP Socket Spooler DHCP Server ➝
C:\WINDOWS\system32\ghqcttbmq.exe
Creates FileC:\WINDOWS\system32\ghqcttbmq.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\jsypkrgidqs\lck
Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates FileC:\WINDOWS\system32\jsypkrgidqs\etc
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\ghqcttbmq.exe
Creates ServiceSearch Authentication IPsec Software - C:\WINDOWS\system32\ghqcttbmq.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates Filepipe\PCHFaultRepExecPipe

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1196

Process
↳ C:\WINDOWS\system32\ghqcttbmq.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\TEMP\aghobxk1s5wj8.exe
Creates FileC:\WINDOWS\system32\jsypkrgidqs\cfg
Creates FileC:\WINDOWS\system32\jsypkrgidqs\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\lrjygsp.exe
Creates FileC:\WINDOWS\system32\jsypkrgidqs\run
Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\jsypkrgidqs\rng
Creates ProcessC:\WINDOWS\TEMP\aghobxk1s5wj8.exe -r 45502 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\ghqcttbmq.exe"

Process
↳ C:\WINDOWS\system32\ghqcttbmq.exe

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\ghqcttbmq.exe"

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst

Process
↳ C:\WINDOWS\TEMP\aghobxk1s5wj8.exe -r 45502 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNStablefruit.net
Type: A
69.195.129.70
DNSstickmarch.net
Type: A
69.195.129.70
DNSlifecount.net
Type: A
50.63.202.59
DNSmouthcount.net
Type: A
95.211.230.75
DNSlonghope.net
Type: A
192.254.233.60
DNSlifehope.net
Type: A
208.91.197.26
DNSdonaven4guia.com
Type: A
DNSfredesecas.com
Type: A
DNSlaloponea.com
Type: A
DNSdavedekilai.com
Type: A
DNSstickfell.net
Type: A
DNSballfell.net
Type: A
DNSstickcount.net
Type: A
DNSballcount.net
Type: A
DNSenemycompe.net
Type: A
DNSlifecompe.net
Type: A
DNSenemyhour.net
Type: A
DNSlifehour.net
Type: A
DNSenemyfell.net
Type: A
DNSlifefell.net
Type: A
DNSenemycount.net
Type: A
DNSmouthcompe.net
Type: A
DNStillcompe.net
Type: A
DNSmouthhour.net
Type: A
DNStillhour.net
Type: A
DNSmouthfell.net
Type: A
DNStillfell.net
Type: A
DNStillcount.net
Type: A
DNSshallcompe.net
Type: A
DNSdeepcompe.net
Type: A
DNSshallhour.net
Type: A
DNSdeephour.net
Type: A
DNSshallfell.net
Type: A
DNSdeepfell.net
Type: A
DNSshallcount.net
Type: A
DNSdeepcount.net
Type: A
DNSpushcompe.net
Type: A
DNSfridaycompe.net
Type: A
DNSpushhour.net
Type: A
DNSfridayhour.net
Type: A
DNSpushfell.net
Type: A
DNSfridayfell.net
Type: A
DNSpushcount.net
Type: A
DNSfridaycount.net
Type: A
DNSalongcompe.net
Type: A
DNSdecembercompe.net
Type: A
DNSalonghour.net
Type: A
DNSdecemberhour.net
Type: A
DNSalongfell.net
Type: A
DNSdecemberfell.net
Type: A
DNSalongcount.net
Type: A
DNSdecembercount.net
Type: A
DNSsoilhope.net
Type: A
DNSlongleft.net
Type: A
DNSsoilleft.net
Type: A
DNSlongthirteen.net
Type: A
DNSsoilthirteen.net
Type: A
DNSlonghurry.net
Type: A
DNSsoilhurry.net
Type: A
DNSwheelhope.net
Type: A
DNSsaidhope.net
Type: A
DNSwheelleft.net
Type: A
DNSsaidleft.net
Type: A
DNSwheelthirteen.net
Type: A
DNSsaidthirteen.net
Type: A
DNSwheelhurry.net
Type: A
DNSsaidhurry.net
Type: A
DNSstickhope.net
Type: A
DNSballhope.net
Type: A
DNSstickleft.net
Type: A
DNSballleft.net
Type: A
DNSstickthirteen.net
Type: A
DNSballthirteen.net
Type: A
DNSstickhurry.net
Type: A
DNSballhurry.net
Type: A
DNSenemyhope.net
Type: A
DNSenemyleft.net
Type: A
DNSlifeleft.net
Type: A
DNSenemythirteen.net
Type: A
DNSlifethirteen.net
Type: A
DNSenemyhurry.net
Type: A
DNSlifehurry.net
Type: A
DNSmouthhope.net
Type: A
DNStillhope.net
Type: A
DNSmouthleft.net
Type: A
DNStillleft.net
Type: A
DNSmouththirteen.net
Type: A
DNStillthirteen.net
Type: A
DNSmouthhurry.net
Type: A
DNStillhurry.net
Type: A
DNSshallhope.net
Type: A
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifecount.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://mouthcount.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://longhope.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifehope.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifecount.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://mouthcount.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://longhope.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifehope.net/forum/search.php?method=validate&mode=sox&v=023&sox=3bc5aa00
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1037 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1038 ➝ 50.63.202.59:80
Flows TCP192.168.1.1:1039 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1041 ➝ 192.254.233.60:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.26:80
Flows TCP192.168.1.1:1043 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1044 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1045 ➝ 50.63.202.59:80
Flows TCP192.168.1.1:1046 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1047 ➝ 192.254.233.60:80
Flows TCP192.168.1.1:1048 ➝ 208.91.197.26:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665636f 756e742e 6e65740d   : lifecount.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746863 6f756e74 2e6e6574   : mouthcount.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6e67686f 70652e6e 65740d0a   : longhope.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665686f 70652e6e 65740d0a   : lifehope.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665636f 756e742e 6e65740d   : lifecount.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746863 6f756e74 2e6e6574   : mouthcount.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6e67686f 70652e6e 65740d0a   : longhope.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336263 35616130   =023&sox=3bc5aa0
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665686f 70652e6e 65740d0a   : lifehope.net..
0x00000080 (00128)   0d0a0d0a                              ....


Strings