Analysis Date2015-11-14 07:05:14
MD5040112a13a944b8545257d823fc3d5a3
SHA1dfcd7056202b030b7c511bcb190658f164208c18

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 0715b77b25741cf92ba42058843230cc sha1: b8d79cbee644da17340021c70ca1a614cef002ba size: 1372160
Section.rdata md5: 0d351302fa37a77470ac4b3d9063179f sha1: 7619d863b5925e0d07fa0dec89e75bb2eaec6ca8 size: 343040
Section.data md5: 53a7a16761aa603bfd534f0b5ddd8c23 sha1: 9beb42235a2b3e54898aeeb3d9ab36495d845948 size: 8192
Section.reloc md5: d78641c17b704c9ca606d182a836d9bf sha1: 9b9866128dda4136604f406ac6a2eced79e4754a size: 192000
Timestamp2015-05-11 04:25:22
PackerVC8 -> Microsoft Corporation
PEhash362b5209dbd776bbf28504167f0577ecd42f116d
IMPhash81b7d1f2117001576e5cc80ba3956add
AVRisingno_virus
AVMcafeeTrojan-FGIJ!040112A13A94
AVAvira (antivir)no_virus
AVTwisterno_virus
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Y
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.Win32.Bayrob
AVEmsisoftGen:Variant.Diley.1
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend Microno_virus
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Zusy.141331
AVArcabit (arcavir)Gen:Variant.Zusy.141331
AVClamAVno_virus
AVDr. WebTrojan.Bayrob.5
AVF-SecureGen:Variant.Zusy.141331
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeTrojan-FGIJ!040112A13A94
AVAvira (antivir)no_virus
AVTwisterno_virus
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Y
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.Win32.Bayrob

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\jqrziaw1kn2qcyqgunmh.exe
Creates FileC:\WINDOWS\system32\fkuowcj\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\jqrziaw1kn2qcyqgunmh.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\jqrziaw1kn2qcyqgunmh.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\File Connect Installer Class ➝
C:\WINDOWS\system32\tjucgeqmz.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\tjucgeqmz.exe
Creates FileC:\WINDOWS\system32\fkuowcj\etc
Creates FileC:\WINDOWS\system32\fkuowcj\lck
Creates FileC:\WINDOWS\system32\fkuowcj\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\tjucgeqmz.exe
Creates ServiceBackup Connect Isolation Socket - C:\WINDOWS\system32\tjucgeqmz.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1844

Process
↳ Pid 1112

Process
↳ C:\WINDOWS\system32\tjucgeqmz.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\fkuowcj\cfg
Creates FileC:\WINDOWS\system32\wduzkypg.exe
Creates FileC:\WINDOWS\system32\fkuowcj\lck
Creates FileC:\WINDOWS\system32\fkuowcj\tst
Creates FileC:\WINDOWS\TEMP\jqrziaw1rvwqc.exe
Creates FileC:\WINDOWS\system32\fkuowcj\rng
Creates Filepipe\net\NtControlPipe10
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\fkuowcj\run
Creates ProcessC:\WINDOWS\TEMP\jqrziaw1rvwqc.exe -r 22597 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\tjucgeqmz.exe"

Process
↳ C:\WINDOWS\system32\tjucgeqmz.exe

Creates FileC:\WINDOWS\system32\fkuowcj\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\tjucgeqmz.exe"

Creates FileC:\WINDOWS\system32\fkuowcj\tst

Process
↳ C:\WINDOWS\TEMP\jqrziaw1rvwqc.exe -r 22597 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSrecordsoldier.net
Type: A
208.91.197.241
DNSfliersurprise.net
Type: A
208.91.197.241
DNShistorybright.net
Type: A
208.91.197.241
DNSchiefsoldier.net
Type: A
208.91.197.241
DNSclasssurprise.net
Type: A
208.91.197.241
DNSthosecontinue.net
Type: A
208.91.197.241
DNSthroughcontain.net
Type: A
208.91.197.241
DNSbelongguard.net
Type: A
208.91.197.241
DNSmaybellinethaddeus.net
Type: A
208.91.197.241
DNSkimberleyshavonne.net
Type: A
208.91.197.241
DNSnaildeep.com
Type: A
74.220.215.218
DNSriddenstorm.net
Type: A
66.147.240.171
DNSdestroystorm.net
Type: A
216.239.138.86
DNSpickfive.net
Type: A
216.21.239.197
DNSsignvoice.net
Type: A
208.100.26.234
DNSroomfive.net
Type: A
217.160.193.90
DNSroomeight.net
Type: A
220.124.143.32
DNSjumpfive.net
Type: A
82.165.21.75
DNSthreefive.net
Type: A
184.168.221.54
DNShusbandfound.net
Type: A
DNSleadershort.net
Type: A
DNSeggbraker.com
Type: A
DNSithouneed.com
Type: A
DNSknowthey.net
Type: A
DNSablethey.net
Type: A
DNSpickvoice.net
Type: A
DNSsongvoice.net
Type: A
DNSsongfive.net
Type: A
DNSpickeight.net
Type: A
DNSsongeight.net
Type: A
DNSpickthey.net
Type: A
DNSsongthey.net
Type: A
DNSroomvoice.net
Type: A
DNSsignfive.net
Type: A
DNSsigneight.net
Type: A
DNSroomthey.net
Type: A
DNSsignthey.net
Type: A
DNSmovevoice.net
Type: A
DNSjumpvoice.net
Type: A
DNSmovefive.net
Type: A
DNSmoveeight.net
Type: A
DNSjumpeight.net
Type: A
DNSmovethey.net
Type: A
DNSjumpthey.net
Type: A
DNShillvoice.net
Type: A
DNSwhomvoice.net
Type: A
DNShillfive.net
Type: A
DNSwhomfive.net
Type: A
DNShilleight.net
Type: A
DNSwhomeight.net
Type: A
DNShillthey.net
Type: A
DNSwhomthey.net
Type: A
DNSfeltvoice.net
Type: A
DNSlookvoice.net
Type: A
DNSfeltfive.net
Type: A
DNSlookfive.net
Type: A
DNSfelteight.net
Type: A
DNSlookeight.net
Type: A
DNSfeltthey.net
Type: A
DNSlookthey.net
Type: A
DNSthreevoice.net
Type: A
DNSlordvoice.net
Type: A
DNSlordfive.net
Type: A
DNSthreeeight.net
Type: A
DNSlordeight.net
Type: A
DNSthreethey.net
Type: A
DNSlordthey.net
Type: A
DNSdrinkvoice.net
Type: A
DNSwifevoice.net
Type: A
DNSdrinkfive.net
Type: A
DNSwifefive.net
Type: A
DNSdrinkeight.net
Type: A
DNSwifeeight.net
Type: A
DNSdrinkthey.net
Type: A
DNSwifethey.net
Type: A
DNSknowaunt.net
Type: A
DNSableaunt.net
Type: A
DNSknowscene.net
Type: A
DNSablescene.net
Type: A
DNSknowgreat.net
Type: A
DNSablegreat.net
Type: A
DNSknowdont.net
Type: A
DNSabledont.net
Type: A
DNSpickaunt.net
Type: A
DNSsongaunt.net
Type: A
DNSpickscene.net
Type: A
DNSsongscene.net
Type: A
DNSpickgreat.net
Type: A
DNSsonggreat.net
Type: A
DNSpickdont.net
Type: A
DNSsongdont.net
Type: A
DNSroomaunt.net
Type: A
DNSsignaunt.net
Type: A
DNSroomscene.net
Type: A
DNSsignscene.net
Type: A
DNSroomgreat.net
Type: A
DNSsigngreat.net
Type: A
DNSroomdont.net
Type: A
DNSsigndont.net
Type: A
DNSmoveaunt.net
Type: A
DNSjumpaunt.net
Type: A
DNSmovescene.net
Type: A
HTTP GEThttp://recordsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://kimberleyshavonne.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://riddenstorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://destroystorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://pickfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://signvoice.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomeight.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://jumpfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://threefive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://recordsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://kimberleyshavonne.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://riddenstorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://destroystorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://pickfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://signvoice.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomeight.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://jumpfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://threefive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1037 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1045 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1046 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1047 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1048 ➝ 66.147.240.171:80
Flows TCP192.168.1.1:1049 ➝ 216.239.138.86:80
Flows TCP192.168.1.1:1050 ➝ 216.21.239.197:80
Flows TCP192.168.1.1:1051 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1052 ➝ 217.160.193.90:80
Flows TCP192.168.1.1:1053 ➝ 220.124.143.32:80
Flows TCP192.168.1.1:1054 ➝ 82.165.21.75:80
Flows TCP192.168.1.1:1055 ➝ 184.168.221.54:80
Flows TCP192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1058 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1059 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1060 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1061 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1062 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1063 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1064 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1065 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1066 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1067 ➝ 66.147.240.171:80
Flows TCP192.168.1.1:1069 ➝ 216.239.138.86:80
Flows TCP192.168.1.1:1070 ➝ 216.21.239.197:80
Flows TCP192.168.1.1:1071 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1072 ➝ 217.160.193.90:80
Flows TCP192.168.1.1:1073 ➝ 220.124.143.32:80
Flows TCP192.168.1.1:1074 ➝ 82.165.21.75:80
Flows TCP192.168.1.1:1075 ➝ 184.168.221.54:80

Raw Pcap

Strings