Virus.Win32.Duel_55fe1fe780

by malwarelabrobot on June 27th, 2013 in Malware Descriptions.

Susp_Dropper (Kaspersky), LooksLike.Win32.Malware!B (v) (VIPRE), Email-Worm.Win32.Brontok!IK (Emsisoft), Virus.Win32.Duel.FD, GenericEmailWorm.YR, GenericIRCBot.YR (Lavasoft MAS)
Behaviour: Worm, Email-Worm, Virus, IRCBot


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: 55fe1fe780596af60fb3a5ceed0bfe1e
SHA1: 7e5c0aae0390f6b7b3915a489318ff20e3f9bea3
SHA256: ccf3750c09f7bb6ff43b934cab35123081e978fd9167b09c5e7912ea640442a6
SSDeep: 768:OckMreEtyxakaCZPa45HYc763tyS8pLPmY4abIHm14R2:OckMFyxakaCN/lYcut2NeY4a0m6
Size: 49152 bytes
File type: PE32
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2001-09-10 23:19:50


Summary:

Email-Worm. Worm that spreads its copies in attachments included in emails.
Virus. A program that recursively replicates a possibly evolved copy of itself.
IRCBot. A bot communicates with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

rqqjyzbzb.yqq:164
rqqjyzbzb.yqq:1796
55fe1fe780596af60fb3a5ceed0bfe1e.exe:1256

The Virus injects its code into the following process(es):

File activity

The process rqqjyzbzb.yqq:164 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\baqazr.iiib.aia (49 bytes)

The process rqqjyzbzb.yqq:1796 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yzyrja.iirb.aia (49 bytes)

The process 55fe1fe780596af60fb3a5ceed0bfe1e.exe:1256 makes changes in a file system.
The Virus creates and/or writes to the following file(s):

%Program Files%\Outlook Express\iyaibyqya.jqi.zar (49 bytes)
%Program Files%\Common Files\Adobe\Updater6\ibyqabijr.azy (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqabijr.azy (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\byqbjr.ajjb.aia (49 bytes)
%Program Files%\MSN Gaming Zone\Windows\arabriazz.zary (49 bytes)
C:\Perl\bin\ibyqabijr.azy (49 bytes)
%Program Files%\NetMeeting\arizarrrz.iiiaqjjrrzqy.jaa (49 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\jbyjzbyja.yay (49 bytes)
%WinDir%\ime\imjp8_1\jbyjzbyja.yay (49 bytes)
%WinDir%\pchealth\helpctr\binaries\rrqyrabrr.ara (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arabriazz.zar (49 bytes)
%WinDir%\pchealth\helpctr\binaries\iyaibyqya.jqi (49 bytes)
%Program Files%\Wireshark\arabriazz.zar (49 bytes)
%Program Files%\Wireshark\rqqjyzbzb.yqq (49 bytes)
%Program Files%\Windows NT\iyaibyqya.jqi (49 bytes)
%Program Files%\Common Files\Microsoft Shared\MSInfo\arizarrrz.iii (49 bytes)
%Program Files%\Outlook Express\ibyqabijr.azy.zar (49 bytes)
%WinDir%\ime\imkr6_1\rqqjyzbzb.yqq (49 bytes)
%Program Files%\MSN Gaming Zone\Windows\aqjjrrzqy.jaa (49 bytes)
%Program Files%\NetMeeting\rrqyrabrr.araaqjjrrzqy.jaa (49 bytes)
C:\totalcmd\ibyqabijr.azy (49 bytes)
%Program Files%\Windows NT\Accessories\ibyqabijr.azy (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\aqjjrrzqy.jaa (49 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\aqjjrrzqy.jaa (49 bytes)
%Program Files%\Opera\updatechecker\arabriazz.zar (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arizarrrz.iii (49 bytes)
%Program Files%\Windows Media Player\jbyjzbyja.yay (49 bytes)
%Program Files%\WinPcap\arizarrrz.iiijjrrzqy.jaa.azy (49 bytes)
%Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\aqjjrrzqy.jaarz.iiirzqy.jaa (49 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rqqjyzbzb.yqq (49 bytes)
%Program Files%\Wireshark\iyaibyqya.jqi (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\aqjjrrzqy.jaa (49 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\arizarrrz.iii (49 bytes)
%Program Files%\Outlook Express\arizarrrz.iii.zar (49 bytes)
%Program Files%\MSN Gaming Zone\Windows\ibyqabijr.azyy (49 bytes)
%WinDir%\ime\imjp8_1\ibyqabijr.azy (49 bytes)
%Program Files%\Common Files\Microsoft Shared\DW\iyaibyqya.jqi (49 bytes)
%WinDir%\ime\imjp8_1\iyaibyqya.jqi (49 bytes)
C:\totalcmd\arabriazz.zar (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rqqjyzbzb.yqq (49 bytes)
%Program Files%\MSN Gaming Zone\Windows\iyaibyqya.jqiy (49 bytes)
%WinDir%\ime\imjp8_1\arizarrrz.iii (49 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\rrqyrabrr.ara (49 bytes)
%Program Files%\Wireshark\aqjjrrzqy.jaa (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\arizarrrz.iiirzqy.jaa (49 bytes)
%WinDir%\inf\arabriazz.zar (49 bytes)
D:\ibyqabijr.azy (49 bytes)
%WinDir%\Network Diagnostic\arabriazz.zar (49 bytes)
%Program Files%\Wireshark\jbyjzbyja.yay (49 bytes)
%WinDir%\xwrm.exe (49 bytes)
%Program Files%\Wireshark\ibyqabijr.azy (49 bytes)
%Program Files%\Opera\jbyjzbyja.yayb.yqqaqjjrrzqy.jaa (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\rrqyrabrr.ara (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\iyaibyqya.jqi (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\arabriazz.zar (49 bytes)
C:\Perl\bin\jbyjzbyja.yay (49 bytes)
C:\totalcmd\arizarrrz.iii (49 bytes)
%WinDir%\Microsoft.NET\Framework\rrqyrabrr.ara (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\aqjjrrzqy.jaa (49 bytes)
%WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jbyjzbyja.yay (49 bytes)
%WinDir%\ime\imjp8_1\arabriazz.zar (49 bytes)
%WinDir%\ime\imjp8_1\rrqyrabrr.ara (49 bytes)
%Program Files%\Windows NT\Pinball\aqjjrrzqy.jaa.azy (49 bytes)
%Program Files%\Windows Media Player\rqqjyzbzb.yqq (49 bytes)
%Program Files%\Windows Media Player\arabriazz.zar (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\ibyqabijr.azy (49 bytes)
C:\Perl\bin\arabriazz.zar (49 bytes)
%Program Files%\Outlook Express\rrqyrabrr.ara.zar (49 bytes)
%Program Files%\NetMeeting\rqqjyzbzb.yqqaqjjrrzqy.jaa (49 bytes)
%WinDir%\iyaibyqya.jqi (49 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\jbyjzbyja.yay (49 bytes)
%WinDir%\ime\imjp8_1\aqjjrrzqy.jaa (49 bytes)

Registry activity

The process rqqjyzbzb.yqq:164 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 DB 76 A0 4C E8 67 05 FA 39 6D C2 C0 10 9A 3E"

The process rqqjyzbzb.yqq:1796 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 7E 97 82 0D 7B 32 77 64 FB 59 69 1A 86 0B BA"

The process 55fe1fe780596af60fb3a5ceed0bfe1e.exe:1256 makes changes in a system registry.
The Virus creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"x32x" = "%WinDir%\xwrm.exe"

Network activity (URLs)

A bot communicates with command and control servers via IRC channel.

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Worm that spreads its copies in attachments included in emails.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    rqqjyzbzb.yqq:164
    rqqjyzbzb.yqq:1796
    55fe1fe780596af60fb3a5ceed0bfe1e.exe:1256

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Local Settings\Temp\baqazr.iiib.aia (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\yzyrja.iirb.aia (49 bytes)
    %Program Files%\Outlook Express\iyaibyqya.jqi.zar (49 bytes)
    %Program Files%\Common Files\Adobe\Updater6\ibyqabijr.azy (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ibyqabijr.azy (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\byqbjr.ajjb.aia (49 bytes)
    %Program Files%\MSN Gaming Zone\Windows\arabriazz.zary (49 bytes)
    C:\Perl\bin\ibyqabijr.azy (49 bytes)
    %Program Files%\NetMeeting\arizarrrz.iiiaqjjrrzqy.jaa (49 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\jbyjzbyja.yay (49 bytes)
    %WinDir%\ime\imjp8_1\jbyjzbyja.yay (49 bytes)
    %WinDir%\pchealth\helpctr\binaries\rrqyrabrr.ara (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arabriazz.zar (49 bytes)
    %WinDir%\pchealth\helpctr\binaries\iyaibyqya.jqi (49 bytes)
    %Program Files%\Wireshark\arabriazz.zar (49 bytes)
    %Program Files%\Wireshark\rqqjyzbzb.yqq (49 bytes)
    %Program Files%\Windows NT\iyaibyqya.jqi (49 bytes)
    %Program Files%\Common Files\Microsoft Shared\MSInfo\arizarrrz.iii (49 bytes)
    %Program Files%\Outlook Express\ibyqabijr.azy.zar (49 bytes)
    %WinDir%\ime\imkr6_1\rqqjyzbzb.yqq (49 bytes)
    %Program Files%\MSN Gaming Zone\Windows\aqjjrrzqy.jaa (49 bytes)
    %Program Files%\NetMeeting\rrqyrabrr.araaqjjrrzqy.jaa (49 bytes)
    C:\totalcmd\ibyqabijr.azy (49 bytes)
    %Program Files%\Windows NT\Accessories\ibyqabijr.azy (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\aqjjrrzqy.jaa (49 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\aqjjrrzqy.jaa (49 bytes)
    %Program Files%\Opera\updatechecker\arabriazz.zar (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\arizarrrz.iii (49 bytes)
    %Program Files%\Windows Media Player\jbyjzbyja.yay (49 bytes)
    %Program Files%\WinPcap\arizarrrz.iiijjrrzqy.jaa.azy (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A93000000001}\aqjjrrzqy.jaarz.iiirzqy.jaa (49 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rqqjyzbzb.yqq (49 bytes)
    %Program Files%\Wireshark\iyaibyqya.jqi (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\aqjjrrzqy.jaa (49 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\arizarrrz.iii (49 bytes)
    %Program Files%\Outlook Express\arizarrrz.iii.zar (49 bytes)
    %Program Files%\MSN Gaming Zone\Windows\ibyqabijr.azyy (49 bytes)
    %WinDir%\ime\imjp8_1\ibyqabijr.azy (49 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW\iyaibyqya.jqi (49 bytes)
    %WinDir%\ime\imjp8_1\iyaibyqya.jqi (49 bytes)
    C:\totalcmd\arabriazz.zar (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rqqjyzbzb.yqq (49 bytes)
    %Program Files%\MSN Gaming Zone\Windows\iyaibyqya.jqiy (49 bytes)
    %WinDir%\ime\imjp8_1\arizarrrz.iii (49 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\rrqyrabrr.ara (49 bytes)
    %Program Files%\Wireshark\aqjjrrzqy.jaa (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\arizarrrz.iiirzqy.jaa (49 bytes)
    %WinDir%\inf\arabriazz.zar (49 bytes)
    D:\ibyqabijr.azy (49 bytes)
    %WinDir%\Network Diagnostic\arabriazz.zar (49 bytes)
    %Program Files%\Wireshark\jbyjzbyja.yay (49 bytes)
    %WinDir%\xwrm.exe (49 bytes)
    %Program Files%\Wireshark\ibyqabijr.azy (49 bytes)
    %Program Files%\Opera\jbyjzbyja.yayb.yqqaqjjrrzqy.jaa (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\rrqyrabrr.ara (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\iyaibyqya.jqi (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\arabriazz.zar (49 bytes)
    C:\Perl\bin\jbyjzbyja.yay (49 bytes)
    C:\totalcmd\arizarrrz.iii (49 bytes)
    %WinDir%\Microsoft.NET\Framework\rrqyrabrr.ara (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\aqjjrrzqy.jaa (49 bytes)
    %WinDir%\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\jbyjzbyja.yay (49 bytes)
    %WinDir%\ime\imjp8_1\arabriazz.zar (49 bytes)
    %WinDir%\ime\imjp8_1\rrqyrabrr.ara (49 bytes)
    %Program Files%\Windows NT\Pinball\aqjjrrzqy.jaa.azy (49 bytes)
    %Program Files%\Windows Media Player\rqqjyzbzb.yqq (49 bytes)
    %Program Files%\Windows Media Player\arabriazz.zar (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\ibyqabijr.azy (49 bytes)
    C:\Perl\bin\arabriazz.zar (49 bytes)
    %Program Files%\Outlook Express\rrqyrabrr.ara.zar (49 bytes)
    %Program Files%\NetMeeting\rqqjyzbzb.yqqaqjjrrzqy.jaa (49 bytes)
    %WinDir%\iyaibyqya.jqi (49 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\jbyjzbyja.yay (49 bytes)
    %WinDir%\ime\imjp8_1\aqjjrrzqy.jaa (49 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "x32x" = "%WinDir%\xwrm.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.