ThreatExpert Report: Trojan-Clicker.Delf!ct, Infostealer.Bzup, Trojan-Clicker.Win32.Delf.xx..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 25 April 2010, 17:05:22
Processing time: 7 min 2 sec
Submitted sample:

File MD5: 0xD8D5CBAEF4B21C31C97B110B4D63DC89
File SHA-1: 0xE9FA3EF5094106159818C831963E1F325135CD1C
Filesize: 140,800 bytes
Alias:

Trojan-Clicker.Delf!ct [PCTools]
Infostealer.Bzup [Symantec]
Trojan-Clicker.Win32.Delf.xx [Kaspersky Lab]
Generic.dx [McAfee]
Mal/EncPk-CL, Mal/Packer [Sophos]
VirTool:Win32/Obfuscator.Q [Microsoft]
Trojan-Clicker.Win32.Delf [Ikarus]
Win-Trojan/Xema.variant [AhnLab]

Summary of the findings:

What's been found	Severity Level
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Clicker.Delf!ct	Trojan-Clicker.Delf!ct is a threat that attempts to redirect compromised computer to some other advertisement websites

Attention! The following threat categories were identified:

Threat Category	Description
	A code with the rootkit-specific techniques designed to hide the software presence in the system
	A hacktool that could be used by attackers to break into a system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\gkbfmupi.sys	4,608 bytes	MD5: 0x91E73AC9AE573BF412A2FEF55DB22238 SHA-1: 0x1B9A4CF55657D85D3817A1D7F9C0464708213B5F	Rootkit.Podnuha.A [PCTools] Hacktool.Rootkit [Symantec] Rootkit.Win32.Podnuha.a [Kaspersky Lab] VirTool:WinNT/Boaxxe.A [Microsoft]
2	%System%\cfbacfb.dll	74,240 bytes	MD5: 0xDE1E68218F7627573AB7479F94222963 SHA-1: 0xB32815E4CE223276490ADC2497B3F587FB7C7805	Trojan.CL.Delf.ZVE [PCTools] Trojan Horse [Symantec] Trojan-Clicker.Win32.Delf.iq [Kaspersky Lab] Generic.dx [McAfee] Mal/EncPk-CL, Mal/Packer [Sophos] VirTool:Win32/Obfuscator.Q [Microsoft]
3	%System%\cfbacfb.exe	53,248 bytes	MD5: 0x203B43C17F4D3DAF6C5CA89CE62574DC SHA-1: 0x21C080C2A9BAB354ECE5E7DCFE2D85E669669578	Hacktool.Rootkit [PCTools] Hacktool.Rootkit [Symantec] Trojan-Spy.Win32.BZub.bwv [Kaspersky Lab] Generic.dx [McAfee] Mal/EncPk-CL, Mal/Packer [Sophos] VirTool:Win32/Obfuscator.Q [Microsoft] Win-Trojan/Bzub.53248.N [AhnLab]
4	%System%\drivers\suhwczfq.sys	12,416 bytes	MD5: 0xD14A1A2BCABFFE6170B54194944EA24C SHA-1: 0x744DB87920D0BEAB310B9487D80CBF533466C10A	Rootkit.Podnuha.C [PCTools] Hacktool.Rootkit [Symantec] Rootkit.Win32.Podnuha.a [Kaspersky Lab] Troj/Conhook-AG [Sophos] VirTool:WinNT/Boaxxe.E [Microsoft] Win-Trojan/Xema.variant [AhnLab]
5	%System%\Restore\MachineGuid.txt	78 bytes	MD5: 0x6331307B7FA1DC849B809B3E89C254CD SHA-1: 0x4B50B9471715B958941AB729908B1DD8EEA8DC50	(not available)
6	[file and pathname of the sample #1]	140,800 bytes	MD5: 0xD8D5CBAEF4B21C31C97B110B4D63DC89 SHA-1: 0xE9FA3EF5094106159818C831963E1F325135CD1C	Trojan-Clicker.Delf!ct [PCTools] Infostealer.Bzup [Symantec] Trojan-Clicker.Win32.Delf.xx [Kaspersky Lab] Generic.dx [McAfee] Mal/EncPk-CL, Mal/Packer [Sophos] VirTool:Win32/Obfuscator.Q [Microsoft] Trojan-Clicker.Win32.Delf [Ikarus] Win-Trojan/Xema.variant [AhnLab]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
[generic host process]	[generic host process filename]	69,632 bytes
[generic host process]	[generic host process filename]	2,060,288 bytes

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
cfbacfb.dll	%System%\cfbacfb.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1B20000 - 0x1B4B000
cfbacfb.dll	%System%\cfbacfb.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x19C0000 - 0x19EB000

Notes:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
srservice	System Restore Service	"Running"	%System%\svchost.exe -k netsvcs

There were new kernel-mode drivers installed in the system:

Driver Name	Driver Filename
gkbfmupi.sys	%Temp%\gkbfmupi.sys
suhwczfq.sys	%System%\drivers\suhwczfq.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Xcynkdaw
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Xcynkdaw\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\bnedmech
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tybsifgh
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tybsifgh\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tybsifgh
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tybsifgh\Parameters

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}\InprocServer32]

(Default) = "%System%\cfbacfb.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}]

Version = 0x00000022
Flags = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Xcynkdaw\CLSID]

(Default) = "{0495D52D-1C80-4E15-B0A6-3AB2C9E7DE6D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]

File = "%System%\Drivers\suhwczfq.sys"
Name = "\pnckjrtc"
7 = 0x80617292
8 = 0x80619F68
0 = 0x80618BD2
4 = 0x805B0714
5 = 0x8061A8CC
6 = 0x8056E26A

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\bnedmech]

DLLName = "cfbacfb.dll"
Logoff = "WLEventLogoff"
Logon = "WLEventLogon"
Asynchronous = 0x00000000
Impersonate = 0x00000000

so that cfbacfb.dll is installed as a Winlogon notification package

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC\0000]

Service = "pnckjrtc"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Microsoft RPC API Helper"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PNCKJRTC]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc\Enum]

0 = "Root\LEGACY_PNCKJRTC\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pnckjrtc]

Start = 0x00000000
Type = 0x00000001
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\suhwczfq.sys"
Group = "Boot Bus Extender"
DisplayName = "Microsoft RPC API Helper"
Name = "\pnckjrtc"
0 = 0x80618BD2
7 = 0x80617292
8 = 0x80619F68
4 = 0x805B0714
R4 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 5C 00 63 00 75 00 72 00 72 00 65 00 6E 00 74 00 63 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 73 00 65 00 74 0
R5 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 5C 00 63 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 73 00 65 00 74 00 30 00 30 00 31 00 5C 00 73 00 65 00 72 0
R1 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0
R2 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 63 00 6C 00 61 00 73 00 73 00 65 00 73 00 5C 00 78 00 63 00 79 00 6E 00 6B 00 64 00 61 0
R3 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 63 00 6C 00 61 00 73 00 73 00 65 00 73 00 5C 00 63 00 6C 00 73 00 69 00 64 00 5C 00 7B 0
R6 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0
F1 = 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 63 00 66 00 62 00 61 00 63 00 66 00 62 00 2E 00 64 00 6C 00 6C 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tybsifgh\Parameters]

ServiceDll = "%System%\cfbacfb.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tybsifgh]

ImagePath = "%System%\svchost.exe -k netsvcs"
Description = "Support for Keyboard Class"
DisplayName = "Keyboard Class Support"
ErrorControl = 0x00000001
ObjectName = "LocalSystem"
Start = 0x00000002
Type = 0x00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "pnckjrtc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC\0000]

Service = "pnckjrtc"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Microsoft RPC API Helper"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PNCKJRTC]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc\Enum]

0 = "Root\LEGACY_PNCKJRTC\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pnckjrtc]

Start = 0x00000000
Type = 0x00000001
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\suhwczfq.sys"
Group = "Boot Bus Extender"
DisplayName = "Microsoft RPC API Helper"
Name = "\pnckjrtc"
0 = 0x80618BD2
7 = 0x80617292
8 = 0x80619F68
4 = 0x805B0714
R4 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 5C 00 63 00 75 00 72 00 72 00 65 00 6E 00 74 00 63 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 73 00 65 00 74 0
R5 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 5C 00 63 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 73 00 65 00 74 00 30 00 30 00 31 00 5C 00 73 00 65 00 72 0
R1 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0
R2 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 63 00 6C 00 61 00 73 00 73 00 65 00 73 00 5C 00 78 00 63 00 79 00 6E 00 6B 00 64 00 61 0
R3 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 63 00 6C 00 61 00 73 00 73 00 65 00 73 00 5C 00 63 00 6C 00 73 00 69 00 64 00 5C 00 7B 0
R6 = 5C 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5C 00 6D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 73 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 6D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 77 00 69 00 6E 00 64 00 6F 0
F1 = 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 63 00 66 00 62 00 61 00 63 00 66 00 62 00 2E 00 64 00 6C 00 6C 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tybsifgh\Parameters]

ServiceDll = "%System%\cfbacfb.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tybsifgh]

ImagePath = "%System%\svchost.exe -k netsvcs"
Description = "Support for Keyboard Class"
DisplayName = "Keyboard Class Support"
ErrorControl = 0x00000001
ObjectName = "LocalSystem"
Start = 0x00000002
Type = 0x00000020

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

ProxyEnable = 0x00000000

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

netsvcs =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

DisableSR =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

AppData =
Cookies =
Cache =
History =

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.