Examples of Troj/Agent-ZLT include:
Example 1
File Information
- Size
- 679K
- SHA-1
- 32a20f0c45e5cfe56b1d304132865d1866ba026f
- MD5
- b95a0cac571bf4a247498e060e5fd85e
- CRC-32
- 5c77bfc1
- File type
- application/x-ms-dos-executable
- First seen
- 2012-12-29
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\panmap.exe
- c:\Documents and Settings\test user\Templates\explorer.exe
Dropped Files
- c:\Documents and Settings\test user\Application Data\dclogs\2012-12-29-7.dc
- Size
- 143
- SHA-1
- bb06a9dde93b65f63420ca5fbce333acfc71df25
- MD5
- 4f5402a3ea3e712e1a1a1418b5025ba1
- CRC-32
- 8fcb5692
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-12-29
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
- Size
- 4.5K
- SHA-1
- 8d82a6e78370a7c7920babb0ae55d8db8855c31a
- MD5
- e3b13ca37164560c995d5bbc95d57383
- CRC-32
- a8f5729a
- File type
- Windows executable
- First seen
- 2012-12-19
- c:\Documents and Settings\test user\Local Settings\Temp\Software\Products and Quotation.pdf
- Size
- 42K
- SHA-1
- 72a9ba69c73cb9430a5e8e5661f5f4b842197b78
- MD5
- a139d5bf9dd51341253c43326d40535f
- CRC-32
- 5fb7b179
- File type
- Adobe Portable Document Format (PDF)
- First seen
- 2012-09-26
Registry Keys Created
- HKCU\Software\DC3_FEXEC
- 29/12/2012 at 07:27:50
- {8683e91a-044e-11df-871e-806d6172696f-1612674719}
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Certificate Policy Engine
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\panmap.exe
- c:\Documents and Settings\test user\templates\certpoleng.exe
- c:\Documents and Settings\test user\templates\explorer.exe
- c:\program files\adobe\reader 8.0\reader\acrord32.exe
- c:\windows\microsoft.net\framework\v2.0.50727\applaunch.exe
DNS Requests
Example 2
File Information
- Size
- 4.5K
- SHA-1
- 8d82a6e78370a7c7920babb0ae55d8db8855c31a
- MD5
- e3b13ca37164560c995d5bbc95d57383
- CRC-32
- a8f5729a
- File type
- Windows executable
- First seen
- 2012-12-19