Examples of Troj/Agent-AAOO include:
Example 1
File Information
- Size
- 855K
- SHA-1
- 1593123fbc678fbdb4c348a2d8921dd577dbcb3b
- MD5
- bbc826b94d4384bd43ebdc2dfe1f783e
- CRC-32
- 9dd9f7ab
- File type
- Windows executable
- First seen
- 2013-03-09
Example 2
File Information
- Size
- 701K
- SHA-1
- 5e469b1face1c296d49943cf54161ce285477cf5
- MD5
- ddf8b7945d828a93174e2aa1bdaf217a
- CRC-32
- 7a815135
- File type
- Windows executable
- First seen
- 2013-03-08
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Application Data\Temp\q5nva9z.exe
- Size
- 855K
- SHA-1
- 1593123fbc678fbdb4c348a2d8921dd577dbcb3b
- MD5
- bbc826b94d4384bd43ebdc2dfe1f783e
- CRC-32
- 9dd9f7ab
- File type
- Windows executable
- First seen
- 2013-03-09
- c:\Documents and Settings\test user\Local Settings\Application Data\Temp\sample.pdf
- Size
- 20
- SHA-1
- 7d9a577acfaa533a9c479f88d466929180576447
- MD5
- da3427767b8164b069b7f1cead5afd02
- CRC-32
- 1e8b48db
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-10-28
- c:\Documents and Settings\test user\Local Settings\Application Data\{BS40FU1U-9OD4-VGUG-6E2X-Q1SDSU0RZUJU}\t3quqhj4ut.exe
- Size
- 2.3M
- SHA-1
- b744b62517d86dfca3e8329c17d89391f9e5572d
- MD5
- 39f06ee0cf5b1fc6dc0df7cec512cb39
- CRC-32
- 7cbc7bc4
- File type
- Windows executable
- First seen
- 2013-03-09
- C:\bin\sample.pdf
- Size
- 20
- SHA-1
- 7d9a577acfaa533a9c479f88d466929180576447
- MD5
- da3427767b8164b069b7f1cead5afd02
- CRC-32
- 1e8b48db
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-10-28
Registry Keys Created
- HKCU\Software\Microsoft\Windows\Windows SpInforme
- CmSpx
- 0.1
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- MSN Skype
- C:\DOCUME~1\support\LOCALS~1\APPLIC~1\{BS40F~1\t3quqhj4ut.exe
Processes Created
- c:\docume~1\support\locals~1\applic~1\temp\q5nva9z.exe
- c:\docume~1\support\locals~1\applic~1\{bs40f~1\t3quqhj4ut.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://23.22.217.68/past/Action.bmp
- http://23.22.217.68/past/Tplock.bmp
IP Connections
- 23.22.217.68:80
- 54.235.77.179:80
Example 3
File Information
- Size
- 2.3M
- SHA-1
- b744b62517d86dfca3e8329c17d89391f9e5572d
- MD5
- 39f06ee0cf5b1fc6dc0df7cec512cb39
- CRC-32
- 7cbc7bc4
- File type
- Windows executable
- First seen
- 2013-03-09