| Analysis Date | 2015-10-23 07:31:30 |
|---|---|
| MD5 | d036ea1e108ef2b45f39fef126be8743 |
| SHA1 | f8650198380f5df4ed4b121a0f42824d9bb7f820 |
Static Details:
| File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
|---|---|---|
| Section | .text md5: 99b89f858cdd3328461fdc9e4899f846 sha1: 68e46cf0a8bbb4d57ea5b50187834679bc32239c size: 9216 | |
| Section | .rdata md5: b794b1dd7a1bc40ba9f9c21aa6e9a4bc sha1: 22a499f5579f8810dd206be9a59d431dd291d5e9 size: 4096 | |
| Section | .data md5: 85910925e674356ccd4d1b3b08bdf1d1 sha1: 304dc203505a4470eb90208f883ee7895032ffa1 size: 1024 | |
| Section | .rsrc md5: 9413e3eee1201efc2e67098444bf1ec8 sha1: ade9c1a86dcaa9074ccabd4100d59d510c354038 size: 20480 | |
| Timestamp | 2014-10-05 05:35:18 | |
| Packer | Microsoft Visual C++ v6.0 | |
| PEhash | d65a7b47b61ec70e224ee68f01cf462a3cab03b4 | |
| IMPhash | 9f9e95f9db59de9e95416835d48a17dc | |
| AV | Rising | Trojan.Win32.Kryptik.af |
| AV | Mcafee | Downloader-FASG!D036EA1E108E |
| AV | Avira (antivir) | TR/Yarwi.djamna |
| AV | Twister | TrojanDldr.Upatre.jgz.nbza |
| AV | Ad-Aware | Trojan.Upatre.Gen.3 |
| AV | Alwil (avast) | Dyre-K [Trj] |
| AV | Eset (nod32) | Win32/Kryptik.DHFK |
| AV | Grisoft (avg) | Generic_s.EPQ |
| AV | Symantec | Downloader.Upatre!gen5 |
| AV | Fortinet | W32/Kryptik.DIRZ!tr |
| AV | BitDefender | Trojan.Upatre.Gen.3 |
| AV | K7 | Trojan-Downloader ( 004c16281 ) |
| AV | Microsoft Security Essentials | TrojanDownloader:Win32/Upatre!rfn |
| AV | MicroWorld (escan) | Trojan.Upatre.Gen.3 |
| AV | MalwareBytes | Trojan.Upatre |
| AV | Authentium | W32/Dalexis.H.gen!Eldorado |
| AV | Frisk (f-prot) | W32/Dalexis.H.gen!Eldorado |
| AV | Ikarus | Trojan.Win32.Crypt |
| AV | Emsisoft | Trojan.Upatre.Gen.3 |
| AV | Zillya! | Downloader.CTBLockerGen.Win32.5 |
| AV | Kaspersky | Trojan-Downloader.Win32.Upatre.jgz |
| AV | Trend Micro | TROJ_UPATRE.SM05 |
| AV | CAT (quickheal) | Trojan.Kadena.B4 |
| AV | VirusBlokAda (vba32) | TrojanDownloader.Upatre |
| AV | Padvish | no_virus |
| AV | BullGuard | Trojan.Upatre.Gen.3 |
| AV | Arcabit (arcavir) | Trojan.Upatre.Gen.3 |
| AV | ClamAV | no_virus |
| AV | Dr. Web | Trojan.DownLoader13.10297 |
| AV | F-Secure | Trojan.Upatre.Gen.3 |
| AV | CA (E-Trust Ino) | no_virus |
Runtime Details:
| Screenshot |  |
|---|
Process
↳ C:\malware.exe
| Creates File | C:\Documents and Settings\Administrator\Local Settings\Temp\xov1795.tmp |
|---|---|
| Creates File | C:\Documents and Settings\Administrator\Local Settings\Temp\xoveere.exe |
| Creates Process | C:\Documents and Settings\Administrator\Local Settings\Temp\xoveere.exe |
Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\xoveere.exe
| Registry | HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝ NULL |
|---|---|
| Registry | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝ 1 |
| Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\icanhazip[1].htm |
| Creates File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat |
| Creates File | C:\Documents and Settings\Administrator\Cookies\index.dat |
| Creates File | PIPE\lsarpc |
| Creates File | \Device\Afd\Endpoint |
| Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat |
| Deletes File | C:\malware.exe |
| Creates Mutex | c:!documents and settings!administrator!local settings!history!history.ie5! |
| Creates Mutex | WininetConnectionMutex |
| Creates Mutex | c:!documents and settings!administrator!cookies! |
| Creates Mutex | c:!documents and settings!administrator!local settings!temporary internet files!content.ie5! |
| Winsock DNS | 38.124.61.144 |
| Winsock DNS | 91.211.17.201 |
| Winsock DNS | 38.124.74.82 |
| Winsock DNS | 38.124.75.146 |
| Winsock DNS | 38.124.74.232 |
| Winsock DNS | 188.255.134.177 |
| Winsock DNS | 38.124.60.223 |
| Winsock DNS | 38.124.75.227 |
| Winsock DNS | icanhazip.com |
Network Details:
| DNS | icanhazip.com Type: A 104.238.141.75 |
|---|---|
| DNS | icanhazip.com Type: A 104.238.136.31 |
| DNS | icanhazip.com Type: A 104.238.145.30 |
| HTTP GET | http://icanhazip.com/ User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0 |
| HTTP GET | http://91.211.17.201:13467/MOUSE12/COMPUTER-XXXXXX/0/51-SP3/0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0 |
| Flows TCP | 192.168.1.1:1031 ➝ 104.238.141.75:80 |
| Flows TCP | 192.168.1.1:1032 ➝ 91.211.17.201:13467 |
| Flows TCP | 192.168.1.1:1033 ➝ 38.124.60.223:443 |
| Flows TCP | 192.168.1.1:1034 ➝ 38.124.60.223:443 |
| Flows TCP | 192.168.1.1:1035 ➝ 38.124.60.223:443 |
| Flows TCP | 192.168.1.1:1036 ➝ 38.124.60.223:443 |
| Flows TCP | 192.168.1.1:1037 ➝ 38.124.61.144:443 |
| Flows TCP | 192.168.1.1:1038 ➝ 38.124.61.144:443 |
| Flows TCP | 192.168.1.1:1039 ➝ 38.124.61.144:443 |
| Flows TCP | 192.168.1.1:1040 ➝ 38.124.61.144:443 |
| Flows TCP | 192.168.1.1:1041 ➝ 38.124.74.232:443 |
| Flows TCP | 192.168.1.1:1042 ➝ 38.124.74.232:443 |
| Flows TCP | 192.168.1.1:1043 ➝ 38.124.74.232:443 |
| Flows TCP | 192.168.1.1:1044 ➝ 38.124.74.232:443 |
| Flows TCP | 192.168.1.1:1045 ➝ 38.124.74.82:443 |
| Flows TCP | 192.168.1.1:1046 ➝ 38.124.74.82:443 |
| Flows TCP | 192.168.1.1:1047 ➝ 38.124.74.82:443 |
| Flows TCP | 192.168.1.1:1048 ➝ 38.124.74.82:443 |
| Flows TCP | 192.168.1.1:1049 ➝ 38.124.75.146:443 |
| Flows TCP | 192.168.1.1:1050 ➝ 38.124.75.146:443 |
| Flows TCP | 192.168.1.1:1051 ➝ 38.124.75.146:443 |
| Flows TCP | 192.168.1.1:1052 ➝ 38.124.75.146:443 |
| Flows TCP | 192.168.1.1:1053 ➝ 38.124.75.227:443 |
| Flows TCP | 192.168.1.1:1054 ➝ 38.124.75.227:443 |
| Flows TCP | 192.168.1.1:1055 ➝ 38.124.75.227:443 |
| Flows TCP | 192.168.1.1:1056 ➝ 38.124.75.227:443 |
| Flows TCP | 192.168.1.1:1057 ➝ 188.255.134.177:443 |
| Flows TCP | 192.168.1.1:1058 ➝ 188.255.134.177:443 |
Raw Pcap
Strings