Troj/Agent-ZWQ exhibits the following characteristics:
File Information
- Size
- 120K
- SHA-1
- 26e8000b9b5cb9781bea348349bf98535834a742
- MD5
- 5cdf60a41e5283ebd8841b32f5cf88c7
- CRC-32
- 9c5c3c74
- File type
- Windows executable
- First seen
- 2013-01-26
Runtime Analysis
Dropped Files
- C:\bin\out.bin
- Size
- 444
- SHA-1
- d4aada680f1f37901711e8342ffc2adc70c4bb93
- MD5
- 6fd86537a34e565997a37c8347c78b83
- CRC-32
- 5a6c927b
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-26
Registry Keys Created
- HKCU\Software\WinRAR
- 46A1FC0C1C2997A50EDEDA5824AD92DD
- tr□Pe□
- HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
- HKCU_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
- DeleteFlag
- 0x00000001
Registry Keys Modified
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum
- NextInstance
- 0x00000000
- HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-18\$8b2e7cc03175028b9a2b805595885191\n.
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
- ErrorControl
- 0x00000000
Processes Created
- c:\docume~1\support\locals~1\temp\143140.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://j.maxmind.com/app/geoip.js
- http://new-cdn-node.com/1.exe
- http://new-cdn-node.com/6.exe
IP Connections
- 1.169.106.6:16464
- 103.10.225.39:16464
- 109.72.59.17:16464
- 115.254.253.254:16464
- 117.214.208.139:16464
- 117.254.253.254:16464
- 119.254.253.254:16464
- 122.17.217.238:16464
- 134.254.253.254:16464
- 135.254.253.254:16464
- 14.98.200.169:16464
- 14.99.34.16:16464
- 166.159.225.236:16464
- 176.18.115.13:16464
- 180.254.253.254:16464
- 182.254.253.254:16464
- 190.188.196.230:16464
- 190.254.253.254:16464
- 194.165.17.3:53
- 2.181.100.54:16464
- 202.215.174.8:16464
- 206.254.253.254:16464
- 218.252.2.112:16464
- 24.150.34.194:16464
- 24.181.104.13:16464
- 27.120.42.216:16464
- 46.227.234.61:16464
- 49.124.194.233:16464
- 5.15.173.41:16464
- 61.86.31.206:16464
- 65.28.111.4:16464
- 65.61.72.208:16464
- 65.75.137.237:80
- 66.85.130.234:53
- 68.9.79.113:16464
- 71.230.127.3:16464
- 71.254.253.254:16464
- 72.192.7.5:16464
- 72.200.186.218:16464
- 72.23.78.47:16464
- 74.210.227.231:16464
- 74.75.78.27:16464
- 75.130.233.174:16464
- 75.178.25.15:16464
- 75.216.41.185:16464
- 76.84.63.239:16464
- 79.53.154.29:16464
- 8.8.8.8:53
- 83.160.9.72:16464
- 83.254.19.56:16464
- 83.87.124.215:16464
- 84.237.248.252:16464
- 87.14.53.183:16464
- 87.254.253.254:16464
- 88.176.122.4:16464
- 88.185.244.185:16464
- 88.254.253.254:16464
- 91.191.16.2:16464
- 92.231.99.7:16464
- 92.254.253.254:16464
- 92.55.87.180:16464
- 94.214.161.162:16464
- 95.58.213.250:16464
- 97.89.4.235:16464
- 98.26.152.12:16464
- 99.247.229.9:16464
DNS Requests
- j.maxmind.com
- new-cdn-node.com