Report - CrySyS Lab

The ~24kb size module from index3.hta contains 4 distinct MZ headers. We name them atl_1 to atl_4
in the hash list. The 24k long file is compiled on 2005-04-04.
Submodule atl_1
refers to \atlsrv.exe \altnet32.exe \atlsrv.exe sdmnet32.dll srvshell.dll sdmnet.dll srvshell32.dll
It contains debug information that gives hint on the code goal:
i:\119prj\Bv\REPLACE Kasp\3 otdel\1.2m UnderKasper\installer\Release\installer.pdb
The module communicates with other modules through the registry, under the key
Software\Microsoft\Internet Explorer\MainFileSRC
This module saves an interesting email address “” into the registry.
The module also uses a mutex named “{118-32-FOOTBOLL-15}” and it is also able to set
SOFTWARE\Microsoft\Windows\CurrentVersion\Run for its goals.
It modifies “\AUTOEXE.BAT” (no typo) in some cases to:
:LOOP
DEL "%s"'
IF EXIST "%s" GOTO LOOP
DEL "%s"
Module atl_2
Figure 48 – .bat file created by submodule atl_1
This module uses mutexes “{132-79-FOOTBOLL-18}” , “{118-32-FOOTBOLL-15}” and {167-53-
BADFOOD-14}, as well as DLLs sdmnet32.dll sdmnet.dll srvshell.dll or srvshell32.dll
It has some relation to explorer.exe, and it calls the _NetBiosDisconnectNt export of another module.
Basically this module is a middle layer between atl_1 and atl_3.
Module atl_3
Compile time: 2005-04-04
This module is UPX compressed (ver 1.92 – released in 2004). When uncompressed, this module is
28kb long, therefore, it is the biggest “main” module among the four submodules.
It provides functionality to other modules, the defined export functions are as follows, where the
most important export function is probably NetBiosDisconnectNt:
_NetBiosConnectNt@8
_NetBiosDisconnectNt@8
_NtDR@0
46