For Home

Virus Profile: Generic PWS.ahf

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 12/5/2012
Date Added: 12/5/2012
Origin: Unknown
Length: Varies
Type: Trojan
Subtype: Win32
DAT Required: 6798
Removal Instructions
   
 
 
   

Description

This is a Trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

  • Microsoft    -    PWS:Win32/Fareit
  • Symantec    -    Trojan Horse
  • Nod32        -    Win32/PSW.Fareit.A trojan
  • Ikarus        -    Trojan-PWS.Multi
  • Avira        -    TR/PSW.Tepfer.EB.4

Indication of Infection

Presence of above mentioned activities

Methods of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.
   

Virus Characteristics

“Generic PWS.ahf” is a generic detection for a Trojan that steals sensitive information from the compromised machine and sends it to the remote attacker.

 “Generic PWS.ahf” steals information from stored passwords, cache and cookies from the following applications:

  • E-mail client
  • Browser
  • FTP client
The Trojan also downloads other payloads like PWS variants and Fake AV to the compromised machine.
Upon Execution, the Trojan drops file into the following location:
  • %AppData%\Microsoft\Address Book\Administrator.wab
  • %AppData%\Ularul\vatioc.exe
  • %Temp%\2666234.exe
  • %Temp%\abcd.bat
The following are the folders created by the Trojan
  • %AppData%\Microsoft\Address Book
  • %AppData%\Ularul
Upon execution the Trojan injects code into explorer.exe and tries to connect to the following URL through the port http.
  • hxxp://74.52.[Removed].71/Pt6B.exe
  • hxxp://89.166. [Removed].40:8080/forum/viewtopic.php
  • hxxp://6.dryadd[Removed]ns.com/forum/viewtopic.php
  • hxxp://6.loveisi[Removed]earth.com/forum/viewtopic.php
  • hxxp://6.m3des[Removed]landscape.com/forum/viewtopic.php
  • hxxp://eminen[Removed]ltors.com/Jz7kFv.exe
  • hxxp://prim[Removed]per.com.my/D1Z.exe
  • hxxp://app. [Removed].com.tr/fPFa.exe
  • hxxp://minii[Removed]on.com/VTo.exe
  • hxxp://ftp.chikl[Removed]titute.org/oiezCiH.exe
  • hxxp://www.rhem[Removed]edios.com/Pt6B.exe
  • hxxp://74.220. [Removed].108/suspended.page/disabled.cgi/chiklyinstitute.org
  • hxxp://184.106. [Removed].8/661.exe
  • hxxp://67.222. [Removed].37/oiezCiH.exe
  • hxxp://216.128. [Removed].50/VTo.exe
  • hxxp://212.252. [Removed].43/fPFa.exe
  • hxxp://202.71. [Removed].176/D1Z.exe
  • hxxp://174.132. [Removed].60/Jz7kFv.exe
  • hxxp://89.166. [Removed].40/forum/viewtopic.php
  • eminentre[Removed]ors.com
  • 174.132. [Removed].60
  • primn[Removed]oper.com.my
  • 17413[Removed]260.hostgator.com
  • 202.71. [Removed].176
  • app. [Removed].com.tr
  • 212.252. [Removed].43
  • 43.36. [Removed].212
  • mail. [Removed].com.tr
  • miniin[Removed]sion.com
  • 216.128. [Removed].50
  • 50.18. [Removed].216
  • ftp.chi[Removed]stitute.org
  • host50.18. [Removed].216.static.maximumasp.com
  • 67.222. [Removed].37
  • 37.57. [Removed].67
  • 67-222-57-37.un[Removed]edlayer.com
  • host108.host[Removed]nster.com
  •  74.220. [Removed].108
  • www.rhem[Removed]edios.com
  • 47.f.344a.static.th[Removed]anet.com
  • 71.15. [Removed].74
  • BC065B7B.dsl.p[Removed]ol.telekom.hu
  • 72-24-69-88.cpe.ca[Removed]eone.net
  • 213.6. [Removed].74
  • h-74-0-6-213.m[Removed]tflad.static.covad.net
  • ool-457cf2ed.dyn.o[Removed]line.net
  • 99-191-25-20.ligh[Removed]eed.rcsntx.sbcglobal.net
  • c-69-181-245-46.hs[Removed]1.ca.comcast.net
  • 89.40.119.200.sta[Removed]ic.netlog.ro
  • node-4r.118-174.s[Removed]c.totisp.net
  • athedsl-86690.h[Removed]e.otenet.gr
  • host10-183-static.241-95-b.bu[Removed]ness.telecomitalia.it
  • 209.234.203.91.cyber[Removed]dband.com
  • bom03s01-in-f19.1e[Removed]0.net
  • condi[Removed]nds.com
  • 184.106. [Removed].8
  • host-46-50-226-74.bbcu[Removed]er.zsttk.net
  • colo.host[Removed]ian.com
  • 83-103-76-161.ip.f[Removed]ebnet.it
  • host-15-8-107-208. [Removed]idco.net
  • 189-111-255-46.dsl.te[Removed]sp.net.br
  • korpimedia2.v[Removed]rver.fi:8080
  • 17413216260.hos[Removed]r.com:http
  • mail. [Removed].com.tr:http
  • host50.18.128.216.static.maxi[Removed]asp.com:http
  • 67-222-57-37.u[Removed]edlayer.com:http
  • host108.hos[Removed]nster.com:http
  • 47.f.344a.static.th[Removed]lanet.com:http
The following registry key values have been deleted from the system.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass

The above mentioned registry keys ensure that the Trojan disables the proxy settings.

The following registry key values have been added to the system.
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications: 0x00000000
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications: 0x0000000
The above registry entries confirms that the Trojan disables the disable Firewall notification messages
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%WINDIR%\explorer.exe: "%WINDIR%\explorer.exe:*:Enabled:Windows Explorer"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\29356:UDP: "29356:UDP:*:Enabled:UDP 29356"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\21973:TCP: "21973:TCP:*:Enabled:TCP 21973"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%WINDIR%\explorer.exe: "%WINDIR%\explorer.exe:*:Enabled:Windows Explorer"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\29356:UDP: "29356:UDP:*:Enabled:UDP 29356"
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\21973:TCP: "21973:TCP:*:Enabled:TCP 21973"
The above registry ensures that the Trojan creates a firewall rule for the UDP and TCP port to bypass the normal authentication and it may allow the remote attacker to issue commands to control the compromised machines without user knowledge.
  • HKEY_USERS\S-1-5-21-[Varies]\Identities\{GUID}\Identity Ordinal: 0x00000001
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Windows\CurrentVersion\Run\{13ED797D-B030-AD41-1258-A4BF31F887AD}: ""%AppData%\Ularul\vatioc.exe""
The below mentioned registry key value ensures that, the Trojan registers with the compromised system and execute itself upon every boot.

  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Ciyta\
                     o    f8679a7: [Binary Data]
                     o    ac4f4i9: [Binary Data]
                     o    20j3e791: [Binary Data]
                     o    h749iic: [Binary Data]
                     o    cjf128j: [Binary Data]
                     o    20f6b848: [Binary Data]
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\Accounts\WhoWhere\

                     o    LDAP Server ID: 0x00000003
                     o    Account Name: "WhoWhere Internet Directory Service"
                     o    LDAP Server: "ldap.whowhere.com"
                     o    LDAP URL: "http://www.whowhere.com"
                     o    LDAP Search Return: 0x00000064
                     o    LDAP Timeout: 0x0000003C
                     o    LDAP Authentication: 0x00000000
                     o    LDAP Simple Search: 0x00000001
                     o    LDAP Logo: "%ProgramFiles%\Common Files\Services\whowhere.bmp"

  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\Accounts\VeriSign\

                     o    LDAP Server ID: 0x00000002
                     o    Account Name: "VeriSign Internet Directory Service"
                     o    LDAP Server: "directory.verisign.com"
                     o    LDAP URL: "http://www.verisign.com"
                     o    LDAP Search Return: 0x00000064
                     o    LDAP Timeout: 0x0000003C
                     o    LDAP Authentication: 0x00000000
                     o    LDAP Search Base: "NULL"
                     o    LDAP Simple Search: 0x00000001
                     o    LDAP Logo: "%ProgramFiles%\Common Files\Services\verisign.bmp"

  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\Accounts\Bigfoot\
                     o    LDAP Server ID: 0x00000001
                     o    Account Name: "Bigfoot Internet Directory Service"
                     o    LDAP Server: "ldap.bigfoot.com"
                     o    LDAP URL: "http://www.bigfoot.com"
                     o    LDAP Search Return: 0x00000064
                     o    LDAP Timeout: 0x0000003C
                     o    LDAP Authentication: 0x00000000
                     o    LDAP Simple Search: 0x00000001
                     o    LDAP Logo: "%ProgramFiles%\Common Files\Services\bigfoot.bmp"
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\Accounts\Active Directory GC\
                     o    LDAP Server ID: 0x00000000
                     o    Account Name: "Active Directory"
                     o    LDAP Server: "NULL"
                     o    LDAP Search Return: 0x00000064
                     o    LDAP Timeout: 0x0000003C
                     o    LDAP Authentication: 0x00000002
                     o    LDAP Simple Search: 0x00000000
                     o    LDAP Bind DN: 0x00000000
                     o    LDAP Port: 0x00000CC4
                     o    LDAP Resolve Flag: 0x00000001
                     o    LDAP Secure Connection: 0x00000000
                     o    LDAP User Name: "NULL"
                     o    LDAP Search Base: "NULL"
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\Accounts\
                     o    PreConfigVer: 0x00000004
                     o    PreConfigVerNTDS: 0x00000001
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\Internet Account Manager\
                      o    Server ID: 0x00000004
                      o    Default LDAP Account: "Active Directory GC"
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\WAB\WAB4\Wab File Name\: "%AppData%\Microsoft\Address Book\Administrator.wab"
  • HKEY_USERS\S-1-5-21-[Varies]\Software\Microsoft\WAB\WAB4\
                     o    OlkContactRefresh: 0x00000000
                     o    OlkFolderRefresh: 0x00000000

  • HKEY_USERS\S-1-5-21-[Varies]\Software\WinRAR\
                    o    HWID: [Binary Data]
                    o    Client Hash: [Binary Data]
                    o    255F08093030919ABF02EE27DF16F90B: 74 72 75 65
                    o    B7598A39C28857B30DE93BB1D3E74F5D: 74 72 75 65

The above registry keys value confirms that the Trojan configures the LDAP server in order to steal confidential information.
The following is the information collected from the infected machine and sends to the remote attacker through remote port 8080:
  • GetLocaleInfoA
  • GetUserNameA
  • gethostbyname
  • GetNativeSystemInfo
  • GetSystemInfo
The Trojan steals stored passwords, cache and cookies from the following applications.
  • Opera
  • Firefox
  • Internet Explorer
  • Google Chrome
  • Windows Live Mail
  • Thunderbird
  • Bromium
  • Nichrome
  • Comodo
  • RockMelt
  • Visicom Media
  • Chromium
  • Global Downloader
  • NetSarang
  • Cyberduck
  • Pocomail
  • BatMail
  • NCH Software
The Trojan steals stored server names, port numbers, login IDs and passwords from the below mentioned FTP clients application.
  • FileZilla
  • BulletProof FTP
  • SmartFTP
  • CuteFTP 6,7,8
  • CuteFTP Lite
  • CuteFTP Pro
  • COREFTP
  • TurboFTP
  • Robo-FTP 3.7
  • LinasFTP
  • FFFTP
  • FTP Explorer
  • ClassicFTP
  • Frigate3
  • VanDyke
  •  FTPRush
  • LeapFTP
  • FTPHost
  • Ghisler
  • WinFTP
  • PuTTY
   

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).