• Stay aware

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • How to get the best

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Help us

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Forum

    Inquietari sueti praenturis et stationibus servabantur agrariis

Sun, 03/26/2017 - 03:02

Zum.Rastarby.3_439e8970a4

Trojan.MSIL.Disfa.kwqw (Kaspersky), Zum.Rastarby.3 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS) Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

Summary

MD5: 439e8970a49597f1297a16c2a8d8254f

SHA1: 900ccf130e6691dfe581da877a586917a269d07a

SHA256: 0d92d5db4950c977a97b5cfcdece0bc0073c549d236a9219fc8f6b7b34c16ac4

SSDeep: 6144:rc0h522p3l04ZMSmIp3Uy28uhy45Il3u1dAgC1VqV0ulKSoZVFqfJ3XmSdPVlfj:bhxp3lZnT9bDkCl3IdX30HcWSFVlL

Size: 434695 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2016-08-14 22:15:49

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Zum's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Zum creates the following process(es):

%original file name%.exe:2928
sever.exe:2980
porn.exe:1796

The Zum injects its code into the following process(es):

trojaner.exe:2528

Mutexes

The following mutexes were created/opened: No objects were found.

File activity

The process %original file name%.exe:2928 makes changes in the file system.


The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_424572 (0 bytes)

The process sever.exe:2980 makes changes in the file system.


The Zum creates and/or writes to the following file(s):

C:\Windows\trojaner\trojaner.exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DF992C79608D27EEF3.TMP (0 bytes)

The process porn.exe:1796 makes changes in the file system.


The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\__tmp_rar_sfx_access_check_424915 (0 bytes)

Registry activity

The process %original file name%.exe:2928 makes changes in the system registry.


The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\WinRAR SFX]
"C%%Program Files%%temp&" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process trojaner.exe:2528 makes changes in the system registry.


The Zum creates and/or sets the following values in system registry:


To automatically run itself each time Windows is booted, the Zum adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"trojaner" = "C:\Windows\trojaner\trojaner.exe"

The process porn.exe:1796 makes changes in the system registry.


The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5 File path
5bebf9911e659ff0e5fb49086615de79c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe
5bebf9911e659ff0e5fb49086615de79c:\Windows\trojaner\trojaner.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Zum's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:2928
    sever.exe:2980
    porn.exe:1796

  2. Delete the original Zum file.
  3. Delete or disinfect the following files created/modified by the Zum:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)
    C:\Windows\trojaner\trojaner.exe (96 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "trojaner" = "C:\Windows\trojaner\trojaner.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40961883921884164.651192ae181684b1677561119f5765623448e
.rdata19251239376394243.571690e0f6a60d8fa917a060c8ef7becc0888
.data23347212920830722.284244e4aa728d9cced1622c2be27733e3fc5
.gfids3645442405121.47202c923099e27bf0e45a5c402d935d0620b
.rsrc36864019363194563.224238a59705cbff75c61fb5c54602ab7afee
.reloc389120807681924.59547d13d3f8a8adfe6861c49a01d81cf73ed

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 7
7998a7f7e227c2e50ff5a7803cc68900
a31cf8a5c0878eb20b080e211edfa03b
fc5ec84bb3e7e2cb9fa8067ee38cfc2d
cd6886a90b9f806a9b54e9447d96c8cc
2bfa346a8352e82dcea968b994e2e4f9
6cf40788e674f459c9e414b8794ee3be
5c37d8d2322321dc9f2621b4e3f31b98

Network Activity

URLs

URL IP
xfunx.ddns.net77.20.141.107
dns.msftncsi.com131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Zum connects to the servers at the folowing location(s):

Strings from Dumps