Systweak Spyware Library
Systweak Spyware Library text
More than 1309737 spyware signatures and growing
Microsoft Gold Certified Partner
Search in:
Trojan.buzus.hts Analysis Report
Threat Submitted On: 6/9/2008 4:24:38 PM
Threat Analysed On: 6/9/2008 9:24:38 PM
Threat Updated On: 11/8/2009 10:54:08 PM
Type : Trojan
Symptoms of buzus.hts
  • Performs illicit activities under the disguise of a useful program.
  • Download malicious code and programs such as keyloggers.
  • It is capable of fetching user’s personal and confidential information.
Information
Alias : trojan.win32.buzus.hts
Md5 Hash : [6cae9c6f56f2cd408dd5d9c1e1e16aaa]
File Size : (384605 bytes)

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System
Note:
Delete the following Files to remove Infection
File: dns.jpg
Path : %workingdir%
Md5Hash :33f5e7b2505fd409b8910cf811358b03 ( 10970 bytes)
File: hacker.jpg
Path : %workingdir%
Md5Hash :7ce0c7d613f6ed5f79d00904029f544b ( 143329 bytes)
File: nadia.jpg
Path : %workingdir%
Md5Hash :0d4e61bb2a5c838765e858c43a208992 ( 23460 bytes)
File: tmp.htm
Path : %workingdir%
Md5Hash :( bytes)
File: saso.exe
Path : %systemdrive%
Md5Hash :93ddccc3637232bf02a89f447787aaff ( 6144 bytes)
File: windows:msnserver.exe
Path : %systemdrive%
Md5Hash :( bytes)
File: windows:server.exe
Path : %systemdrive%
Md5Hash :( bytes)
File: windows:sysinfo.exe
Path : %systemdrive%
Md5Hash :( bytes)
File: x0ne.exe
Path : %systemdrive%
Md5Hash :ce831caddf9ed63acd221b46339cc53a ( 71222 bytes)
File: 12.exe
Path : %temp%
Md5Hash :257c06038e80dc09d8a8d308cf324da9 ( 38912 bytes)
File: 8bc0_appcompat.txt
Path : %temp%
Md5Hash :413d21babd527252bae3a9648d463c7f ( 2582 bytes)
File: anasera.exe
Path : %temp%
Md5Hash :1a67ed60d5ad53d766dd6d0cbc54f929 ( 29053 bytes)
File: d4c4_appcompat.txt
Path : %temp%
Md5Hash :19b2db76d91254bcbbf3455df6bb405f ( 2582 bytes)
File: d9af_appcompat.txt
Path : %temp%
Md5Hash :6194125ee1ad3b3c807a6aee46cc4972 ( 2582 bytes)
File: ilouve.w.exe
Path : %temp%
Md5Hash :91e3c26dafa7ae3249817e7ab485d2e1 ( 95232 bytes)
File: ilvyo.exe
Path : %temp%
Md5Hash :03c34bd0113873bbc34e43138794bf7a ( 72259 bytes)
File: saso.exe
Path : %temp%
Md5Hash :93ddccc3637232bf02a89f447787aaff ( 6144 bytes)
File: sestem.exe
Path : %temp%
Md5Hash :60a4fb4574238e6978f90b90249e4585 ( 29053 bytes)
File: setop.exe
Path : %temp%
Md5Hash :44f4f607b701bddbcbc876982905b61b ( 8192 bytes)
File: shl.exe
Path : %temp%
Md5Hash :48ed7dcfaed797915bc305815b1b2fa2 ( 33384 bytes)
File: x0ne.exe
Path : %temp%
Md5Hash :ce831caddf9ed63acd221b46339cc53a ( 71222 bytes)
File: conf.bat
Path : %userprofile%\sendto
Md5Hash :25f2360db2868491a9c7c3699a944c1a ( 5 bytes)
File: conf.exe
Path : %userprofile%\sendto
Md5Hash :a938fbf0fd67d24c116435e929d73140 ( 38912 bytes)
File: system32:music.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:run.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:rundll32.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:server.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:shost.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:system32.exe
Path : %windir%
Md5Hash :( bytes)
File: system32:winlost.exe
Path : %windir%
Md5Hash :( bytes)
File: audiocapture2.dll
Path : %windir%\system32\ads
Md5Hash :945248ef878a64be7c5400cd3a9c1068 ( 14848 bytes)
File: cpumonitor.dll
Path : %windir%\system32\ads
Md5Hash :e08949ed439b18fd646faec3a063259d ( 24064 bytes)
File: dialuppass.dll
Path : %windir%\system32\ads
Md5Hash :b5025e532f6079cc093bff1bd1518db5 ( 47104 bytes)
File: filemanager6.dll
Path : %windir%\system32\ads
Md5Hash :72615c8d31886f6164745dd812d34162 ( 14848 bytes)
File: filesearch.dll
Path : %windir%\system32\ads
Md5Hash :dad26ed7fc02209dfac49fedb018f6b8 ( 10240 bytes)
File: iepv.dll
Path : %windir%\system32\ads
Md5Hash :e16855bde0b0ce4ec16ba8ce8292d1a1 ( 44544 bytes)
File: installedapplications.dll
Path : %windir%\system32\ads
Md5Hash :191d6e6a36a29e475bc1091805320e66 ( 11776 bytes)
File: keylogger3.dll
Path : %windir%\system32\ads
Md5Hash :6c11f69c106a6646e735384083e9129d ( 12800 bytes)
File: mailpv.dll
Path : %windir%\system32\ads
Md5Hash :8ee0609a559957685da4fa8112c1bba2 ( 57344 bytes)
File: messagebox.dll
Path : %windir%\system32\ads
Md5Hash :1e02ac162654a3ca13c1c8cd1fbb3026 ( 9728 bytes)
File: msncontroller.dll
Path : %windir%\system32\ads
Md5Hash :48c20c381626cb8e5b90ec1fa9599a36 ( 19456 bytes)
File: mspass.dll
Path : %windir%\system32\ads
Md5Hash :2b22088be4eafa95121505dffc92a870 ( 55808 bytes)
File: netpass.dll
Path : %windir%\system32\ads
Md5Hash :0a3f3994a79d4734aad8adbcc35dc5a2 ( 40960 bytes)
File: offlinelogger.dll
Path : %windir%\system32\ads
Md5Hash :f47174fef7e76a49cd8dd8a72611a909 ( 26624 bytes)
File: onlinelogger.dll
Path : %windir%\system32\ads
Md5Hash :c93555a4e4c0edb31beea95bb3450c83 ( 26112 bytes)
File: processmanager3.dll
Path : %windir%\system32\ads
Md5Hash :7b12ec2353686eab4fb6f90a17179c26 ( 28672 bytes)
File: protectedstorage.dll
Path : %windir%\system32\ads
Md5Hash :31224c6a34b35d8687b811bd7e6cc5c9 ( 31744 bytes)
File: regedit2.dll
Path : %windir%\system32\ads
Md5Hash :ce97686bd65dcbd0f927a265e5da8ca8 ( 9216 bytes)
File: remoteshell2.dll
Path : %windir%\system32\ads
Md5Hash :b9cd40ddbf03a088eba0953fe840e658 ( 11776 bytes)
File: screencapture6.dll
Path : %windir%\system32\ads
Md5Hash :4b98c6c542ee230146f3fd0d87bff34b ( 26624 bytes)
File: servicemanager.dll
Path : %windir%\system32\ads
Md5Hash :52f75c0e2760374b7ce6af62f360bd9d ( 12800 bytes)
File: systeminformation2.dll
Path : %windir%\system32\ads
Md5Hash :b4b8cf07330f6ad3e4910fc17204e2f2 ( 13824 bytes)
File: thumbgen.dll
Path : %windir%\system32\ads
Md5Hash :11efe054630aac7d15c61f565763c234 ( 101888 bytes)
File: urldownload.dll
Path : %windir%\system32\ads
Md5Hash :df73247fa8f33dc3bba619c2b0a41470 ( 7168 bytes)
File: windowmanager.dll
Path : %windir%\system32\ads
Md5Hash :1f5661824402f6e42315f76656ca0735 ( 9728 bytes)
File: wirelesspv.dll
Path : %windir%\system32\ads
Md5Hash :210ec8582f097c8166df1aa1a1036e41 ( 41472 bytes)
File: evenr.exe
Path : %windir%\system32
Md5Hash :48ed7dcfaed797915bc305815b1b2fa2 ( 33384 bytes)
File: server.exe
Path : %windir%\system32
Md5Hash :9ab0cfa495cf2ec84b0c596c69b2e6f1 ( 38912 bytes)
File: [randomname].exe
Path : %workingdir%
Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
( bytes)
094879a0e6b9d41d5a5deb00eb563cef ( 38912 bytes)
1676038777a4ee57e9a43a0ff74eb4b3 ( 241262 bytes)
172d244cb0ad7c6c6ecf8f9e1d4be9dd ( 38912 bytes)
23c6c3a52ffdeccf66449e29e952e21e ( 38912 bytes)
30f6179c41d22bcd79f998fbce4dd673 ( 206336 bytes)
352172215da9c183e5b06acaaea37c15 ( 38912 bytes)
36a874bbe648a7b6babcb9bf76d8f45c ( 38912 bytes)
37c9191f3ac697822a25b70000b8858b ( 38912 bytes)
39c3f952b3c51146914bcedfe0fe5043 ( 38997 bytes)
3e119da2562ab055ae88b0f71f635d66 ( 38912 bytes)
465115feeaaa7e699bf20a082d76f53c ( 19456 bytes)
49b4081fa8751cd30ca54e526c240ed9 ( 752128 bytes)
4ebfc4adc629cb2e42a61fb9b1d35f91 ( 38912 bytes)
519f8ac2c3e4a55361d77ff41e0f8bf9 ( 18944 bytes)
5226e1a08954d021335b2d28b3d0085a ( 38912 bytes)
56c5dc3dc764fa71d3c77873fa8f7a1c ( 241262 bytes)
59df2c74583f55611b10b615acb6a113 ( 38912 bytes)
694d298221b4636aa0c377b29a5c36d8 ( 38912 bytes)
6a8abe918d0c92ff51deb740c98eb163 ( 38912 bytes)
6cae9c6f56f2cd408dd5d9c1e1e16aaa ( 384605 bytes)
6d93110435e4e3beb7613b767cbfc5a1 ( 38912 bytes)
7b86cf9859989c0831733e4653678f0f ( 38912 bytes)
7c9988611fc6e9435275c02af6de3f22 ( 43913 bytes)
7d0288b95690fdd9af02b42a40720c19 ( 38912 bytes)
8f9209fe94600c9aa2ed19a077ba8b2e ( 38912 bytes)
93052ed71bdc14af522e5c3403787cae ( 38912 bytes)
94a81d3c3aa2bbef024174ff544fc08f ( 38912 bytes)
960e176d1b4258c4cf748abd3d1e5ed0 ( 38912 bytes)
986815bb7507c86e81c43777e9728ec7 ( 38912 bytes)
99f23ca8457c9c728a4be95e029df3ab ( 31232 bytes)
9ab0cfa495cf2ec84b0c596c69b2e6f1 ( 38912 bytes)
9e38e4f30d3f8f167a9a0c7b70157690 ( 38912 bytes)
9e7d466a8f206508d834ddee5cca01ec ( 38912 bytes)
9f996f9333acc956a290a56263f9934f ( 18677 bytes)
9fe6f6cb474884bba1f60f17c4832404 ( 38912 bytes)
a430d545c4599542dbec8e329be336b2 ( 41472 bytes)
af613c7a522279f27313c74fb15c5012 ( 119030 bytes)
b8034ebb81af5c39c9a9321fc5d7e0dd ( 38912 bytes)
b8bf03ce18b351d9d97c5ed956617ea8 ( 38912 bytes)
be460fef53176a6386f635e82fd14c0a ( 38912 bytes)
c8eaeeacd7335d830162b8f4a9df2004 ( 176181 bytes)
d2dd068598ec56cd0dfa19ba6460590a ( 38912 bytes)
d7c82ebd4de9645c38a2ac909f715bbb ( 39936 bytes)
db6d12c345eee179db0a8e1b2413072b ( 86528 bytes)
de95a5bf18fdd23bce62a33b8181e400 ( 38912 bytes)
e873f287755cb82ee394d1df194017a4 ( 50176 bytes)
ef9f32479ca48814760b9a777700b7cb ( 38912 bytes)
fd4e448e574bca85a67ced514d314b4f ( 38912 bytes)
File: [randomname].exe /silent /s /s /qn /sp- /passive -s -s
Path : %workingdir%
Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
210fc4598fec384ecdd16f437acd8536 ( bytes)
43876213db00c244aac52707feef1866 ( bytes)
abad6a9b34c8a598ee63ddda34abe5e9 ( bytes)
Also creates the following files on user's System which are also created by Genuine Software :-
Note:
These file(s) can be kept as they are also created by genuine Software.
File : desktop.ini
Path : %homepath%\my documents
Md5Hash :869cba0364c55b0c6524419a8b86df88 ( 83 bytes)
File : tmp.htm
Path : %workingdir%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : 199ca.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : 1d0a9.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : 2161e.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : 37168.dmp
Path : %temp%
Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : 78cb_appcompat.txt
Path : %temp%
Md5Hash :1192ac16b19e066d86d65adc0780b25d ( 16216 bytes)
Creates the following infected Registry Keys on user's System
Note:
Delete these Registries to remove Infection
The following Registry Values are added to the provided Registry Keys :-
Note:
Delete the added Values from the Key to remove Infection
|__ Value Added :
h4.5 = "%windir%\system32:server.exe"
|__ Value Added :
slh4.5 = "c::server.exe"
|__ Value Added :
starttt = "%windir%\system32:server.exe"
|__ Value Added :
system32 = "%windir%\system32:system32.exe"
|__ Value Added :
win dirs = "%windir%\system32:winlost.exe"
Also creates the following legitmate Registries on user's Systems which are also created by Genuine Software :-
Note:
These Keys can be kept as they are also created by genuine Software
Creates the following child process(s) on execution:

%systemdrive%\docume~1\antisp~1\locals~1\temp\12.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\anasera.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\ilouve.w.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\ilvyo.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\saso.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\sestem.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\setop.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\shl.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\x0ne.exe

%windir%\explorer.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\12.exe -s

%systemdrive%\saso.exe

%systemdrive%\x0ne.exe

%systemdrive%\docume~1\antisp~1\locals~1\temp\setop.exe stubpath

%programfiles%\internet explorer\iexplore.exe %windir%\system32\evenr.exe

%programfiles%\internet explorer\iexplore.exe %systemdrive%\docume~1\antisp~1\locals~1\temp\12.exe

%windir%\system32\dwwin.exe -x -s 1280

%programfiles%\internet explorer\iexplore.exe

services.exe

Creates the Following MUTEX(s) on user's System:-
)!voqa.i4
bif123
slhslh final
slh4.0.4 update 2
raspbfile
Copies the Following Files to Given Location :-

Copies :%systemdrive%\docume~1\antisp~1\locals~1\temp\shl.exe

To : %windir%\system32\evenr.exe

Copies :%systemdrive%\docume~1\antisp~1\locals~1\temp\12.exe

To : %windir%\system32:server.exe

NOTE:

1. %workingdir% Refers to the current directory in which user is working.
2. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
3. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
4. %userprofile% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'
5. %windir% Refers to the windows root folder. By default it is 'C:\Windows'
6. %homepath% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.

Microsoft Gold Certified Partner

© Systweak Inc., 1999-2009 All rights reserved.