W32.Malware.Gen

Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved! 5 Stars (5 / 5)

W32.Malware.Gen also known as Trojan.ZusyCRTD.Win32.5117.

Malware Analysis of W32.Malware.Gen – HAOTUKANKAN.EXE

Created files:

%LOCAL APPDATA%\HAOTUKANKAN\DOODLES\FC49F01C68F1626392DC15A1C592CFB663AEE1FB209EE-FOGFYU_FW658.PNG
%LOCAL APPDATA%\HAOTUKANKAN\FREEIMAGE.DLL
%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE
%LOCAL APPDATA%\HAOTUKANKAN\HAOTUMODIFY.EXE
%LOCAL APPDATA%\HAOTUKANKAN\ICONS\BMP.ICO

Autostart registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{1A7B0538-FD28-48A0-BB8B-DE3E04DF94C2}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\CLSID\{79BEF29B-2700-4D41-BE42-6EBA8A889D29}\INPROCSERVER32\: “%LOCAL APPDATA%\HAOTUKANKAN\CONTEXTMENU32.DLL”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.3FR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.BMP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.CUT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.DDS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.EXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.G3\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.GIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.HDR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.ICO\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.IFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.J2K\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JP2\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPEG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JPG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.JXR\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.KOA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.MNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCT\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PCX\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PFM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PGM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PNG\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.PSD\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.RAS\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.SGI\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TGA\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.TIFF\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WAP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.WEBP\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XBM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\SOFTWARE\CLASSES\HAOTUKANKAN.XPM\SHELL\OPEN\COMMAND\: “”%LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE” /FILENAME:”%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\DisplayName: “????”
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{01EB3F15-6569-4FCD-A1AA-913E906E2194}\UNINSTALLSTRING: “%LOCAL APPDATA%\HAOTUKANKAN\UNINSTALL.EXE”

Detected by UnHackMe:

HAOTUKANKAN.EXE
DEFAULT LOCATION: %LOCAL APPDATA%\HAOTUKANKAN\HAOTUKANKAN.EXE

Dropper hash(md5): ab2529e0a8a399f7b8af6dd2fe638948

Share This:

Written by 

Malware Hunter.

UnHackMe removes malware invisible for your antivirus!

Free Download

1
UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.

WordPress SEO fine-tune by Meta SEO Pack from Poradnik Webmastera