Examples of Troj/Agent-YCV include:
Example 1
File Information
- Size
- 300K
- SHA-1
- d658048ba52bb59fc0ee293ce1e401b02ddf15a9
- MD5
- dbc3bd226fed1ae55e98064309dd8aff
- CRC-32
- c420a93e
- File type
- Windows executable
- First seen
- 2012-10-06
Example 2
File Information
- Size
- 300K
- SHA-1
- e6f5943088370a32f4129cfc3b0f2edb80b1665c
- MD5
- 7096e6c3822d30a458ff121a92543c41
- CRC-32
- bd9d3181
- File type
- Windows executable
- First seen
- 2012-10-06
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Pyzuu\acsat.exe
- Size
- 300K
- SHA-1
- d658048ba52bb59fc0ee293ce1e401b02ddf15a9
- MD5
- dbc3bd226fed1ae55e98064309dd8aff
- CRC-32
- c420a93e
- File type
- Windows executable
- First seen
- 2012-10-06
- c:\Documents and Settings\test user\Application Data\Zaohit\luuxu.dec
- Size
- 477
- SHA-1
- 31108186aeb1e70c3783fb0e8f4b97c0aee6dd05
- MD5
- 855c51c9b5b3c01d467bd845bd6fe1fd
- CRC-32
- 20e123f8
- File type
- Unspecified binary - probably data
- First seen
- 2012-10-06
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Idac
- Kevozo
- □*□□□□p□□□□□□-□0□□P<□□□□0□□□<□□□□□□□□□□P□□□□□□□□□E□P)□□□□□□□□□□P□□□□□`□□@□□`□□□□□□□□□□□□h□□s□□N□□□□□□□□j□□□□□□□ <□□□□□□□□□□□a□□□□@□□□□□pe□□□□ @□□□□□□□ e□□}□@□□P□□P□□□□□□□□`□□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {DF50A94F-25C0-1708-1984-20E774579B2D}
- "c:\Documents and Settings\test user\Application Data\Pyzuu\acsat.exe"
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 26 5e 47 0d 18 a4 cd 01
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000007
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\pyzuu\acsat.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://unqueaccess-shop.com/samuel/config.bin
- http://www.google.bg/webhp
- http://www.google.com/webhp
DNS Requests
- unqueaccess-shop.com
- www.google.bg
- www.google.com