Systweak Spyware Library
Systweak Spyware Library text
More than 21875 spyware signatures and growing
Microsoft Gold Certified Partner
Search in:
Trojan-Dropper.amokjoiner Analysis Report
Threat Submitted On: 1/29/2008 8:31:44 AM
Threat Analysed On: 1/29/2008 1:31:44 PM
Threat Updated On: 1/28/2011 4:26:36 PM
Type : Trojan-Dropper
Symptoms of amokjoiner
  • Drops malicious items on to the user’s system.
  • Upon execution, the files are extracted in a temporary folder and executed.
  • May include harmless files also to pose as a non-malicious program.
Information
Alias : trojan-dropper.win32.amokjoiner
Md5 Hash : [229d1e03aa9b6f493e96abbd95fb679c]
File Size : (2858101 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System
Note:
Delete the following Files to remove Infection
File: wpk1.12.exe
Path : %systemdrive%\%desk%

Md5Hash :48be13f9f7b5ab891838d65b2ac12265 ( 298924 bytes)
File: wpk1.12.exe
Path : %systemdrive%

Md5Hash :48be13f9f7b5ab891838d65b2ac12265 ( 298924 bytes)
File: fl1.exe
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
091ec60e8ac9179845b6bf37f61b3993 ( 672847 bytes)
1f505a4efdaab30cdd27df16837c348e ( 22554 bytes)
2a24122073fdd3c1b622d209c23d8062 ( 865708 bytes)
a97356df1a865641ab13c12bb536c644 ( 2232320 bytes)
c26b68e9db4c7109bbd35b756abcff6c ( 1767458 bytes)
c925445e97a8b343bf1dec1a17d5d418 ( 150520 bytes)
fecb1b206d20fd119ab01baa4ab0325d ( 1487052 bytes)
File: fl2.exe
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
02774680cf6752eec0b129165899194d ( 27648 bytes)
038a5903570ee8280e15e4c241f6a6d2 ( 38093 bytes)
1869741ca4f1393114d695acecf0828c ( bytes)
5ef1e27510bb657372605e3c16828335 ( 147456 bytes)
5f0a19df39e1a22a6ecee45772452788 ( bytes)
9af16b8b0a535bde71cc79e481c703b0 ( 580289 bytes)
a5e4f89e62dd6f155f342bf5ea067501 ( 3458079 bytes)
d666a5eeecf2e4e501c1fbd0fcb3cf83 ( 570468 bytes)
File: 32613778127859135.exe
Path : %temp%\se_196021161

Md5Hash :80995ae48a0d2b399058661092ac533d ( 155783 bytes)
File: web.dat
Path : %userprofile%\application data\bpk

Md5Hash :4ad7e5a6b0bbd47c324462c424b192f5 ( 96 bytes)
File: 2loops_niw.dat
Path : %windir%\system32

Md5Hash :697631e3759b2ae2086be021df533dc5 ( 315 bytes)
File: inst.dat
Path : %windir%\system32

Md5Hash :fd31b37a7e45536b44b1a33068c9cf6f ( bytes)
File: pk.bin
Path : %windir%\system32

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
103f9768caf507af968703d295791685 ( 4208 bytes)
46fb3682f7338935bf07448e1a2d7baf ( bytes)
969e3dc094f59b9056213a41d24d5785 ( bytes)
File: svchost.exe
Path : %windir%\system32\wbem

Md5Hash :a9d8a0c4f83d3bedb82d084bd4763c46 ( 226816 bytes)
File: web.dat
Path : %windir%\system32

Md5Hash :44a7ab105ef86d96102729c43d689a79 ( 48 bytes)
File: win_spool2.exe
Path : %windir%\system32

Md5Hash :792085ac3b1396edde12c6d875050630 ( 87175 bytes)
File: wmiinit.dll
Path : %windir%\system32

Md5Hash :f8fa5aa7a4f1af9c0130e319cbc615f6 ( 281600 bytes)
File: wmiinit.dat
Path : %windir%

Md5Hash :c38d1750549db6200615765d14c1b608 ( 256 bytes)
File: [randomname].exe
Path : %workingdir%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
0ea8c93b25055cfd9ff896711d36de72 ( 1546521 bytes)
126b766cb3cb24a9d96ee747bbc00d93 ( bytes)
147a328cac72d974434374f089f60e4f ( 3347460 bytes)
1af4b09e28f69a79a140c2a2d53b8f60 ( 446778 bytes)
1be8d3695fd2a531424b84adcd61f985 ( 700433 bytes)
218ec0fb7ab67f046ac6f6bf6365879a ( 469633 bytes)
229d1e03aa9b6f493e96abbd95fb679c ( 2858101 bytes)
2c8b8559f3c07a0fdeb67ac487d3f532 ( 3844241 bytes)
327d8000ab9878e2511b0e18feabb0e6 ( 858441 bytes)
3ee99d7b3d9bb07e81770a37b48555e3 ( bytes)
416e613d7195d149c7304c3881121689 ( 742231 bytes)
4f1bd4e8c9f802c43f8e30f3f93bd259 ( 332313 bytes)
51031db76a941fa8bb1fa802a7b5331a ( 285696 bytes)
5ca6b090a8a0b2309d7d7d8e135548e7 ( 5000444 bytes)
6c550cffad051174844c192a576ef9fd ( 707532 bytes)
6cab425a7c6e6ac714cf0d67078e8ae0 ( 843966 bytes)
76e49f4a6450ae4b7dd5e6942c73eb68 ( 920509 bytes)
8127db99609ec8be493edaa45dce5749 ( 1322906 bytes)
881d8d0995df89937f9f56037def567e ( 1323418 bytes)
91c6f411b95a03130fbe8889fdb70daf ( 347165 bytes)
a20e72f824fac81d9a75abb5e80172f4 ( 994318 bytes)
b070f01b4cb5b646826c0bec2e14effb ( 55298 bytes)
b14e70c38d3449f32ea922011ba13b01 ( 243926 bytes)
b196f485814271b1faf29caff296f659 ( 35328 bytes)
c3357981c521f094b0b0ecfb043f3b9c ( 875616 bytes)
c39f8a4a39257bb31b19a1c8b6351d2d ( 113483 bytes)
d310cd0278ae8fd44ac7c2860de20e72 ( 32768 bytes)
daa95c6e8eeab2e1e9250f8bae9d489c ( 212523 bytes)
fda49b575477b599b03fa291a876ab15 ( 843932 bytes)
fe087ef92443733b3819029201d8d659 ( 1592365 bytes)
fe72d0a16b224b5c942f2c8b7d792414 ( 658156 bytes)
ff0b35ce2942af7976798d036d501b63 ( 1346958 bytes)
Also creates the following files on user's System which are also created by Genuine Software :-
Note:
These file(s) can be kept as they are also created by genuine Software.
File : libeay32.dll
Path : %windir%\system32

Md5Hash :b60a4ad78aecf8d0ef07c579b93f3af2 ( 290816 bytes)
File : [randomname].exe
Path : %workingdir%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
51031db76a941fa8bb1fa802a7b5331a ( 285696 bytes)
57fb4ef7b3b09eea9556be544696959d ( 55296 bytes)
The following Registry Values are added to the provided Registry Keys :-
Note:
Delete the added Values from the Key to remove Infection
|__ Value Added :
windows update = "%windir%\system32\scvhost.exe"
|__ Value Added :
asynchronous = "[reg_dword, value: 00000000]"
|__ Value Added :
impersonate = "[reg_dword, value: 00000000]"
|__ Value Added :
startscreensaver = "wlestartscreensaver"
|__ Value Added :
stopscreensaver = "wlestopscreensaver"
|__ Value Added :
bpk = "%windir%\system32\bpk.exe"
|__ Value Added :
ciota = "%windir%\system32\ciota.exe"
|__ Value Added :
win_spool2 = "%windir%\system32\win_spool2.exe"
|__ Value Added :
wwfy agent = "%windir%\system32\28463\wwfy.exe"
Creates the following child process(s) on execution:

%systemdrive%\docume~1\antisp~1\locals~1\temp\fl1.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\fl2.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\rarsfx0\rinst.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\rarsfx0\cwk.exe

%windir%\system32\ciota.exe

services.exe

Creates the Following MUTEX(s) on user's System:-
oleacc-msaa-loaded
raspbfile
Moves the Following Files to Given Location :-
Moves :%windir%\system32\rinst.exe
To : %windir%\system32\ciotar.exe

NOTE:

1. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
2. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
3. %userprofile% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'
4. %windir% Refers to the windows root folder. By default it is 'C:\Windows'
5. %workingdir% Refers to the current directory in which user is working.

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.


Microsoft Gold Certified Partner

© Systweak Inc., 1999-2011 All rights reserved.