Report - CrySyS Lab

22d9278c43700b82260a7ad212192ab6
MD5 hash: 22D9278C43700B82260A7AD212192AB6
SHA1 hash: 1CCE8B615A118E49898E6DCD0F43C001728EDE0A
compile time: 2011-05-16
This sample uses standard WinAPI functions (e.g., GetDesktopWindows() and
CreateCompatibleBitmap() ) in order to create screenshots of the entire screen on the infected
machine and saves these bitmaps into file PrintScreen.bmp. After that this bitmap file is converted
into a corresponding jpg file (PrintScreen.jpg) by using Gdi API functions. Then, the file
PrintScreen.jpg is moved into “SystemDrive\ProgramData\Adobe\AdobeArm\sysdll5.txt” after
waiting 6 seconds. Note that SystemDrive represents the drive where the OS was installed (most of
the time it is C:\). Finally the original and large PrintScreen.bmp file is deleted after waiting 3
seconds.
The file contains debugging symbols as it is linked with the PDB information that makes analysis
easier, and also reveals some details about the attacker. One such detail is the internal path
information about the project: C:\PrintScreen\PrintScreen-DED version\Release\PrintScreen.pdb
539B0094E07E43BFCED8A415BA5C84E3
MD5 hash: 539B0094E07E43BFCED8A415BA5C84E3
SHA1 hash: 2B677DC5E1E14818DBE31F5913453EEAA8CF7230
compile time: 2008-09-02
The malware first creates a registry key as “HKEY_LOCAL_MACHINE\Software\Microsoft\ MS QAG”
and sets various the values ID, Interval, Ul1 and Ul2 as follows:
ID = 1245641
Interval = 120s
Ul1 = http://www.politnews.org/dd_4.php
Ul2 = http://www.r2bnetwork.org/dd_4.php
The most important data here is Ul1 and Ul2 that are representing C&C servers, however, the latter
one is not active any more. The result of each registry value write operation (RegSetValueExA) is
saved and the result is stored in c:\sysdll9.txt
The module uses a well-known anti-debugging technique by calling the IsDebuggerPresent() WinAPI
function, and terminates if this function returns true.
44