ThreatExpert Report: Trojan.Win32.Chifrax

Submission Summary:

Submission details:

Submission received: 12 August 2012, 14:00:05
Processing time: 8 min 46 sec
Submitted sample:

File MD5: 0xA0F0A916A1E453968477EB279EF12628
File SHA-1: 0x774917BEB21C97B607317AD35ED79CA1E32BCD4D
Filesize: 272,063 bytes
Alias: Trojan.Win32.Chifrax [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\Storm\update\%SESSIONNAME%\usbxr.cc3	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
2	%Temp%\RarSFX0\1.4.exe	151,552 bytes	MD5: 0x4FCA8C088E88F0285E950985605BCFC1 SHA-1: 0x2F12B5E5D7F90E30EC994F073BC1C1FE75231ED8	(not available)
3	%System%\f5859b27.rdb	8,192 bytes	MD5: 0xE9BA4AD9128EB0EF5E7860990C5D1212 SHA-1: 0x37782FB63562F60DE9D093C2DC79F7CF4FCF00F8	(not available)
4	[file and pathname of the sample #1]	272,063 bytes	MD5: 0xA0F0A916A1E453968477EB279EF12628 SHA-1: 0x774917BEB21C97B607317AD35ED79CA1E32BCD4D	Trojan.Win32.Chifrax [Ikarus]

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%CommonAppData%\Storm
%CommonAppData%\Storm\update
%CommonAppData%\Storm\update\%SESSIONNAME%
%Temp%\RarSFX0

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	217,088 bytes
http.exe	%Temp%\RarSFX0\http.exe	202,752 bytes
bdkrhgtrek	%Temp%\bdkrhgtrek	202,752 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	258,048 bytes
1.4.exe	%Temp%\rarsfx0\1.4.exe	331,776 bytes
1.4.exe	%Temp%\rarsfx0\1.4.exe	331,776 bytes

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
HidServ	Human Interface Device Access	"Running"	%System%\svchost.exe -k netsvcs

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Comhidserv70
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Comhidserv70\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV\0000\Control

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Comhidserv70\Parameters]

seRVicemAIN = "BuildTrusteeWithSidA"
seRVicedlL = "%CommonAppData%\Storm\update\%SESSIONNAME%\usbxr.cc3"
module = "%Temp%\bdkrhgtrek"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Comhidserv70]

Description = "Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this se
DisplayName = "Human Interface Device Access"
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k netsvcs"
ObjectName = "LocalSystem"
Start = 0x00000002
Type = 0x00000020
FailureActions = 3C 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Group = ""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HidServ"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV\0000]

Service = "HidServ"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Human Interface Device Access"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HIDSERV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "HidServ"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV\0000]

Service = "HidServ"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Human Interface Device Access"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HIDSERV]

NextInstance = 0x00000001

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

_SHuassist.mtx

The following Host Names were requested from a host database:

125.39.100.74
221.194.142.98
124.238.243.51
220.181.126.7
conf.f.360.cn
qup.f.360.cn
okaa.3322.org
u.qurl.f.360.cn
qurl.f.360.cn
qurl.qh-lb.com
qup.qh-lb.com
sdup.360.cn
sdup.qh-lb.com
sdupm.360.cn
qd.code.360.cn
qd.code.qihoo.com
stat.360safe.com
stat-s.360safe.com
update.360safe.com
update-s.360safe.com
tr.p.360.cn
updateh.360safe.com
w.360.cn
stat.sd.360.cn
sdl.360safe.com
dl.360safe.com
dl.qh-lb.com
www.360.cn
www.360safe.com
softm.update.360safe.com
softm-s.update.360safe.com
antispy.db.kingsoft.com
bo.duba.net
f-sq.beike.cn
www.beike.cn
vc01.beike.cn
push.www.duba.net
www.duba.net
ifr.duba.net
vi.pc120.com
f-signs.duba.net
api.pc120.com
hd.duba.net
www.rising.com.cn
z.rising.com.cn
rsdownload.rising.com.cn
msginfo.rising.com.cn
reportq.rising.com.cn
rsdownauto.rising.com.cn
kaspersky.fastcdn.com
support.eset.com.cn
update.nai.com
guru.avg.com
gtm-tnt.avg.com
gtm-nyc.avg.com
gtm-self.avg.com
gtm-hkg.avg.com
mmi.explabs.net
liveupdate.symantecliveupdate.com
ll002.avast.com
iau.trendmicro.com.cn
dnl-01.geo.kaspersky.com
rsup1.rising.com.cn
cu001.www.duba.net
cs1.duba.net
downloads1.kaspersky-labs.com
update1.jiangmin.com
08update1.jiangmin.com
exp01.eset.com
u1.eset.com.cn
um01.eset.com
dnl-02.geo.kaspersky.com
rsup2.rising.com.cn
cu002.www.duba.net
cs2.duba.net
downloads2.kaspersky-labs.com
update2.jiangmin.com
08update2.jiangmin.com
exp02.eset.com
u2.eset.com.cn
um02.eset.com
dnl-03.geo.kaspersky.com
rsup3.rising.com.cn
cu003.www.duba.net
cs3.duba.net
downloads3.kaspersky-labs.com
update3.jiangmin.com
08update3.jiangmin.com
exp03.eset.com
u3.eset.com.cn
um03.eset.com
dnl-04.geo.kaspersky.com
rsup4.rising.com.cn
cu004.www.duba.net
cs4.duba.net
downloads4.kaspersky-labs.com
update4.jiangmin.com
08update4.jiangmin.com
exp04.eset.com
u4.eset.com.cn

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
okaa.3322.org	1861

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 1861:

00000000 | 6362 3173 742F 0200 001F 0500 0078 9C4B | cb1st/.......x.K
00000010 | 6360 6098 03C4 AC40 CC08 C41A 5C0C 0C4C | c``....@....\..L
00000020 | 403A 38B5 A82C 3339 5521 2031 395B C188 | @:8..,39U! 19[..
00000030 | 81EE 00E4 0606 4646 86ED DC0C 0CF5 4096 | ......FF......@.
00000040 | 737E 6E41 6949 6A91 5F62 6E2A 9146 AC02 | s~nAiIj._bn*.F..
00000050 | 1B01 C4FF 81D8 1B88 7FB3 3330 7400 050C | ..........30t...
00000060 | 0D0C CC8C 8C62 4DEC 7C3C 1C9D BD77 DDDA | .....bM.|<...w..
00000070 | 7F96 367E 1849 C000 1330 B85D BBB0 67DB | ..6~.I...0.]..g.
00000080 | 8667 A80A 39CE 8585 3CFA 7E8A 11DD 8082 | .g..9...<.~.....
00000090 | BFF5 37AC F818 DE44 E933 81D8 AC02 136A | ..7....D.3.....j
000000A0 | 2012 8C60 B90A 208B CF65 624D 01E7 C49A |  ..`.. ..ebM....
000000B0 | 034F A6D7 3402 D93F 4C3B 6A16 3A4F AC41 | .O..4..?L;j.:O.A
000000C0 | 3588 9301 640E 08AC B82F C010 11AD 0F4E | 5...d..../.....N
000000D0 | 4A27 5827 D62C 00F2 5562 F499 0281 EC1D | J'X'.,..Ub......
000000E0 | 3C9C 0CB9 AC10 BD1C 4B8E 96DB 01C5 3F74 | <.......K.....?t
000000F0 | 1E2D 3F04 E49F 01EA B93C 7B62 0D48 CC8E | .-?......<{b.H..
00000100 | 19A4 E260 B9C0 F4A3 E520 7520 9E0C 8305 | ...`..... u ....
00000110 | 387D EA00 E566 00D3 94A1 18C2 7646 0688 | 8}...f......vF..
00000120 | CFA6 724C ACB1 1085 A8B9 00CC 5C73 6681 | ..rL........\sf.
00000130 | EC3A 08B6 C722 469F C102 6436 10DB 03ED | .:..."F...d6....
00000140 | B971 607A CD6B A0BC 8D49 2AC3 9358 7DA6 | .q`z.k...I*..X}.
00000150 | FFA0 041B F0A3 5EA1 4192 4108 C834 019A | ......^.A.A..4..
00000160 | 33B5 717B 8C01 90FF 2206 E49F 83E5 FF81 | 3.q{....".......
00000170 | C006 C8B6 8981 F84F CD19 184C AA92 60BB | .......O...L..`.
00000180 | 272C 78CF 989A 9E99 5792 5194 3A01 EE32 | ',x.....W.Q.:..2
00000190 | 5306 9F28 885A 3000 9A7F 04A8 574B ADA1 | S..(.Z0.....WK..
000001A0 | A601 6406 9006 B91C E466 1010 8184 3C1C | ..d......f....<.
000001B0 | 08C0 E239 1612 3F20 FD30 B912 A07E 909D | ...9..? .0...~..
000001C0 | 2DFC 0C0C 9F67 36D7 7000 CD02 B90F 64A6 | -....g6.p.....d.
000001D0 | 936A 430D C8FD 93AE 4EA8 D93D 1BC2 06E5 | .jC.....N..=....
000001E0 | 673D E764 B0BF 40FE 2DB8 9E0C A619 8118 | g=.d..@.-.......
000001F0 | 24B6 6B6D 32C2 62A0 3D39 B110 776A C442 | $.km2.b.=9..wj.B
00000200 | DC09 1206 A9C7 E74E 589A 02E9 B701 AA65 | .......NX......e
00000210 | 022A 9201 D286 66E6 E66B FEEB 3361 7327 | .*....f..k..3as'
00000220 | C8FD 8878 6460 70EC 4C06 00CC 45C3 26   | ...xd`p.L...E.&

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.