Troj/Agent-XZI exhibits the following characteristics:
File Information
- Size
- 100K
- SHA-1
- 14e541f046e20f5c7ef3d25744af9c8735f69dce
- MD5
- aef0c4e5cf8ae5d327dc1431101dafb6
- CRC-32
- 37f686a6
- File type
- Windows executable
- First seen
- 2012-10-06
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Application Data\Connection Manager\Connection Manager.com
Registry Keys Created
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
- 3093:TCP
- 3093:TCP:*:Enabled:Remote Assistance Remote
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- Connection Manager
- c:\Documents and Settings\test user\Local Settings\Application Data\Connection Manager\Connection Manager.com
- HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts
- Logon
- c:\Documents and Settings\test user\Local Settings\Application Data\Connection Manager\Connection Manager.com
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Connection Manager
- c:\Documents and Settings\test user\Local Settings\Application Data\Connection Manager\Connection Manager.com
Processes Created
- c:\windows\explorer.exe
- c:\windows\system32\cmd.exe
- c:\windows\system32\netsh.exe
- c:\windows\system32\svchost.exe
DNS Requests