ThreatExpert Report: TrojanDropper:Win32/Farfli.F, Trojan-Spy, Backdoor:Win32/Zegost.AF..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 5 September 2012, 20:20:47
Processing time: 7 min 49 sec
Submitted sample:

File MD5: 0xD4985DF5938267E3EDFB79FD3AD51915
File SHA-1: 0x2B0B97F6A7B07F0939D5E58490C0F5228CF06255
Filesize: 290,816 bytes
Alias:

TrojanDropper:Win32/Farfli.F [Microsoft]
Trojan-Spy [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Mbig\Bfndjgjad.dll	2,735,616 bytes	MD5: 0x1A8C0E73289FA7E03B0072AE35D42CA2 SHA-1: 0xA4FC489BB30EF1DA482AF9DE02F9B21394EC1FB3	Backdoor:Win32/Zegost.AF [Microsoft] Backdoor.Win32.Farfli [Ikarus]
2	[file and pathname of the sample #1]	290,816 bytes	MD5: 0xD4985DF5938267E3EDFB79FD3AD51915 SHA-1: 0x2B0B97F6A7B07F0939D5E58490C0F5228CF06255	TrojanDropper:Win32/Farfli.F [Microsoft] Trojan-Spy [Ikarus]

Note:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directory was created:

%ProgramFiles%\Mbig

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	294,912 bytes

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
Wlrjlu Kxjlcuqx Fyw	Aehxqf Jeqgegas Dvwhgriq Ffjt	"Running"	%System%\svchost.exe -k sougou

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\113509976
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\DComLaunch
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\HTTPFilter
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\netsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\PCHealth
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\termsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\255086338
HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Parameters
HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Enum
HKEY_USERS\.DEFAULT\NetSubKey

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

sougou = 57 6C 72 6A 6C 75 20 4B 78 6A 6C 63 75 71 78 20 46 79 77 00

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\termsvcs]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\PCHealth]

CoInitializeSecurityParam = 0x00000002
AuthenticationCapabilities = 0x00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\netsvcs]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\LocalService]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\HTTPFilter]

CoInitializeSecurityParam = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\DComLaunch]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976]

HTTPFilter = "HTTPFilter"
LocalService = "Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV"
NetworkService = "DnsCache"
netsvcs = "6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule
DcomLaunch = "DcomLaunch TermService"
rpcss = "RpcSs"
imgsvc = "StiSvc"
termsvcs = "TermService"
sougou = 57 6C 72 6A 6C 75 20 4B 78 6A 6C 63 75 71 78 20 46 79 77 00

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Parameters]

ServiceDll = "%ProgramFiles%\Mbig\Bfndjgjad.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k sougou"
DisplayName = "Aehxqf Jeqgegas Dvwhgriq Ffjt"
ObjectName = "LocalSystem"
Description = "Acihbktt Jnnnpiyvi Ivofwwm Ymnjskvy Ckw"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "RemoteAccess"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS\0000]

Service = "RemoteAccess"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Routing and Remote Access"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_REMOTEACCESS]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Wlrjlu Kxjlcuqx Fyw"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000]

Service = "Wlrjlu Kxjlcuqx Fyw"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Aehxqf Jeqgegas Dvwhgriq Ffjt"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Enum]

0 = "Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw\Parameters]

ServiceDll = "%ProgramFiles%\Mbig\Bfndjgjad.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlrjlu Kxjlcuqx Fyw]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k sougou"
DisplayName = "Aehxqf Jeqgegas Dvwhgriq Ffjt"
ObjectName = "LocalSystem"
Description = "Acihbktt Jnnnpiyvi Ivofwwm Ymnjskvy Ckw"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 E8 03 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "RemoteAccess"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS\0000]

Service = "RemoteAccess"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Routing and Remote Access"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_REMOTEACCESS]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Wlrjlu Kxjlcuqx Fyw"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000]

Service = "Wlrjlu Kxjlcuqx Fyw"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Aehxqf Jeqgegas Dvwhgriq Ffjt"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WLRJLU_KXJLCUQX_FYW]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Enum]

0 = "Root\LEGACY_WLRJLU_KXJLCUQX_FYW\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw\Parameters]

ServiceDll = "%ProgramFiles%\Mbig\Bfndjgjad.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlrjlu Kxjlcuqx Fyw]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k sougou"
DisplayName = "Aehxqf Jeqgegas Dvwhgriq Ffjt"
ObjectName = "LocalSystem"
Description = "Acihbktt Jnnnpiyvi Ivofwwm Ymnjskvy Ckw"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 E8 03 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The following Host Names were requested from a host database:

192.5.5.241
huyiai.3322.org

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
huyiai.3322.org	8000

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 8000:

00000000 | 586A 6A68 6AEC 0000 004C 0100 0078 9C4B | Xjjhj....L...x.K
00000010 | 13E5 6298 C3C0 C0C0 0AC4 8C40 ACC1 C5C0 | ..b........@....
00000020 | C004 A483 538B CA32 9353 1502 1293 B315 | ....S..2.S......
00000030 | 8C18 10E0 C1DF 7A93 9815 7076 05A3 2554 | ......z...pv..%T
00000040 | 8211 CC07 B1F8 5C26 D614 704E AC39 F064 | ......\&..pN.9.d
00000050 | 7A4D 2390 FDC3 B4A3 C6C0 05A2 EE99 E2CA | zM#.............
00000060 | C2F7 3726 D430 3070 422C 0482 8C26 4E06 | ..7&.00pB,...&N.
00000070 | 0EA8 2927 5827 D624 00F9 4C60 2319 814A | ..)'X'.$..L`#..J
00000080 | 2C19 B673 438C 071A CEE8 ECEF 1B10 1AE2 | ,..sC...........
00000090 | 1AE4 E7E8 EBCA 4024 8803 E290 D4A2 DCCC | ......@$........
000000A0 | BCC4 9254 203B 5E14 21C7 0873 0410 3800 | ...T ;^.!..s..8.
000000B0 | 9977 40DE 0206 465E EC0A 0690 DF32 8034 | .w@...F^.....2.4
000000C0 | 886D 3F7B 62CD 8D03 D36B 5ECF 9A58 6313 | .m?{b....k^..Xc.
000000D0 | B782 E1C4 214E 86FF FF19 1836 385B 32BC | ....!N.....68[2.
000000E0 | 3097 6410 04EA 0300 BE21 4128           | 0.d......!A(

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.