TR/Hupigon.MY - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Hupigon.MY
Date discovered:	19/10/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	396.230 Bytes
MD5 checksum:	9761700bdb80002583ea2ce27d131959
VDF version:	6.36.00.61 - Tue, 26 Sep 2006 14:30 (GMT+1)
IVDF version:	6.36.00.75 - Tue, 03 Oct 2006 11:51 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: BackDoor-AWQ.b
   • Kaspersky: Backdoor.Win32.Hupigon.clv
   • F-Secure: Backdoor.Win32.Hupigon.clv
   • Eset: Win32/Hupigon.MN

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Registry modification
   • Steals information
   • Third party control

Files It copies itself to the following location:
• %WINDIR%\Server

It deletes the initially executed copy of itself.

The following file is created:

– %WINDIR%\Delete.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

It tries to executes the following file:

– Filename:
• %PROGRAM FILES%\Internet Explorer\iexplore.exe

Registry The following registry keys are added in order to load the services after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Services\system32]
   • "Type"=dword:00000110
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%WINDIR%\Server"
   • "DisplayName"="system"
   • "ObjectName"="LocalSystem"
   • "Description"="windows%random character string%"

– [HKLM\SYSTEM\CurrentControlSet\Services\system32\Security]
   • "Security"=%hex values%

– [HKLM\SYSTEM\CurrentControlSet\Services\system32\Enum]
   • "0"="Root\\LEGACY_SYSTEM32\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

The following registry keys are added:

– [HKCR\CLSID\{%generated CLSID%}]
   • @="%random character string%"

– [HKCR\CLSID\{%generated CLSID%}\InprocServer32]
   • @=%system-dependent%

– [HKCR\CLSID\{%generated CLSID%}\ProgID]
   • @=%system-dependent%

– [HKCR\CLSID\{%generated CLSID%}\Programmable]
   • @=""

– [HKCR\CLSID\{%generated CLSID%}\TypeLib]
   • @="{%generated CLSID%}"

– [HKCR\CLSID\{%generated CLSID%}\Version]
   • @=%system-dependent%

– [HKCR\CLSID\{%generated CLSID%}\VersionIndependentProgID]
   • @=%system-dependent%

– [HKCR\TypeLib\{%generated CLSID%}]
   • @=""

– [HKCR\TypeLib\{%generated CLSID%}\1.0]
   • @=%system-dependent%

– [HKCR\TypeLib\{%generated CLSID%}\1.0\0]
   • @=""

– [HKCR\TypeLib\{%generated CLSID%}\1.0\0\win32]
   • @=%system-dependent%

– [HKCR\TypeLib\{%generated CLSID%}\1.0\FLAGS]
   • @="0"

– [HKCR\TypeLib\{%generated CLSID%}\1.0\HELPDIR]
   • @=%system-dependent%

– [HKCU\Software\ASProtect\SpecData]
   • @="73C2167373C21673"
   • "73C2167373C21673"=%hex values%

– [HKCR\.key]
   • @="regfile"

Backdoor Contact server:
The following:
   • 33733.ipread.**********:8000

As a result it may send some information.

Sends information about:
    • Computer name
    • IP address
    • System time
    • Information about the Windows operating system

Miscellaneous Mutex:
It creates the following Mutex:
• HUIGEZI1.2320060923

File details Programming language:
The malware program was written in Delphi.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Monica Ghitun on Thu, 19 Oct 2006 16:21 (GMT+1)
Description updated by Adriana Popa on Thu, 16 Nov 2006 11:51 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back