ThreatExpert Report: Trojan.Win32.BHO.adec

Submission Summary:

Submission details:

Submission received: 19 February 2010, 14:37:12
Processing time: 7 min 36 sec
Submitted sample:

File MD5: 0x8973EC82975DC468F58CA25282A7D049
File SHA-1: 0xA49606E9C7FA81878706EB38D435E6754F94271A
Filesize: 753,559 bytes
Alias: Trojan.Win32.BHO.adec [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\DelUS.bat	124 bytes	MD5: 0x68ED47C0DCEB3CC6ACC2AB3BEDB4C74C SHA-1: 0x44CDDA23DD8EB2C78CF524056F1B5A08834E724A	(not available)
2	%ProgramFiles%\skylove\Microsoft.VC80.CRT.manifest	1,869 bytes	MD5: 0x541423A06EFDCD4E4554C719061F82CF SHA-1: 0x2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E	(not available)
3	%ProgramFiles%\skylove\msvcm80.dll	479,232 bytes	MD5: 0xCAE6861B19A2A7E5D42FEFC4DFDF5CCF SHA-1: 0x609B81FBD3ACDA8C56E2663EDA80BFAFC9480991	(not available)
4	%ProgramFiles%\skylove\msvcp80.dll	548,864 bytes	MD5: 0x4C8A880EABC0B4D462CC4B2472116EA1 SHA-1: 0xD0A27F553C0FE0E507C7DF079485B601D5B592E6	(not available)
5	%ProgramFiles%\skylove\msvcr80.dll	626,688 bytes	MD5: 0xE4FECE18310E23B1D8FEE993E35E7A6F SHA-1: 0x9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564	(not available)
6	%ProgramFiles%\skylove\skylove.dll	184,320 bytes	MD5: 0xD01C6236984E123E98D083F57131D888 SHA-1: 0xA9E4538E91EE04CCC302A6C563CACBC40EED7F9E	(not available)
7	%ProgramFiles%\skylove\skylove.dll.intermediate.manifest	382 bytes	MD5: 0x729D6E29E131AE62E7E9B2536990EDF6 SHA-1: 0x524DD51D47DF3BB204FCC7E176407A88EAE9693B	(not available)
8	%ProgramFiles%\skylove\skyloveup.exe	339,968 bytes	MD5: 0x91A842E636AD2AC7367BD43772747A2B SHA-1: 0x6E826D7D7FB403650D6CE0B3C1B8099BCBF30E24	Trojan.Win32.BHO.adec [Kaspersky Lab]
9	%ProgramFiles%\skylove\skyloveup.exe.intermediate.manifest	145 bytes	MD5: 0xF7AD1EAB748BC07570A57EC87787CF90 SHA-1: 0x0B1608DA9FEF218386E825DB575C65616826D9F4	(not available)
10	%ProgramFiles%\skylove\uninstall.exe	73,019 bytes	MD5: 0x66E2353B4E420C1491023F93A79FF256 SHA-1: 0x4EAD54D9603CED1611A3E36041CAEB5722F1A1D5	(not available)
11	[file and pathname of the sample #1]	753,559 bytes	MD5: 0x8973EC82975DC468F58CA25282A7D049 SHA-1: 0xA49606E9C7FA81878706EB38D435E6754F94271A	Trojan.Win32.BHO.adec [Kaspersky Lab]
12	%System%\wbem\Performance\WmiApRpl_new.ini	924 bytes	MD5: 0x2667367F9339639AF825E7122CE3B2A3 SHA-1: 0x56E33B464F9AD8D0A6AC3343A85D7618D590FEDC	(not available)

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%ProgramFiles%\skylove

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
skyloveup.exe	%ProgramFiles%\skylove\skyloveup.exe	356,352 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\skylove.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC9D84F4-B15C-49C5-84AF-F9A9399F4777}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\skylove uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\skylove
HKEY_CURRENT_USER\Software\skylove

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\skylove.DLL]

AppID = "{AC9D84F4-B15C-49C5-84AF-F9A9399F4777}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC9D84F4-B15C-49C5-84AF-F9A9399F4777}]

(Default) = "skylove"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\VersionIndependentProgID]

(Default) = "skylove.SkyloveObj"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\TypeLib]

(Default) = "{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\ProgID]

(Default) = "skylove.SkyloveObj.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}\InprocServer32]

(Default) = "%ProgramFiles%\skylove\skylove.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}]

(Default) = "SkyloveObj Class"
AppID = "{AC9D84F4-B15C-49C5-84AF-F9A9399F4777}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\TypeLib]

(Default) = "{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0004A7C-E64B-49ED-84D3-7A5B331894A8}]

(Default) = "ISkyloveObj"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\0\win32]

(Default) = "%ProgramFiles%\skylove\skylove.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\HELPDIR]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B44D6C29-51E5-4722-B9C1-160FBEEB41CD}\1.0]

(Default) = "skylove 1.0 ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½Ìºê·¯ï¿½ï¿½"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj\CurVer]

(Default) = "skylove.SkyloveObj.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj\CLSID]

(Default) = "{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj]

(Default) = "SkyloveObj Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj.1\CLSID]

(Default) = "{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\skylove.SkyloveObj.1]

(Default) = "SkyloveObj Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]

midup = "20080901"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B19ED0E1-BD68-4BE7-8B79-78DC3EBCAFAB}]

(Default) = "SkyloveObj"
NoExplorer = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

skylove = "%ProgramFiles%\skylove\skyloveup.exe"

so that skyloveup.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\skylove uninstall]

DisplayName = "linkage_web 2.0"
UninstallString = ""%ProgramFiles%\skylove\uninstall.exe""
DisplayIcon = ""%ProgramFiles%\skylove\uninstall.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\skylove]

default = "20080901"

[HKEY_CURRENT_USER\Software\Microsoft]

midup = "20080901"

[HKEY_CURRENT_USER\Software\skylove]

default = "20080901"

Other details

Analysis of the file resources indicate the following possible country of origin:

Republic of Korea

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.