Examples of Troj/Mdrop-ETJ include:
Example 1
File Information
- Size
- 173K
- SHA-1
- 25d17c5a948903b333dff5a26126093e3a76b365
- MD5
- b59790f247c858a41e191973d347ebc1
- CRC-32
- be6f4414
- File type
- Windows executable
- First seen
- 2012-12-01
Example 2
File Information
- Size
- 164K
- SHA-1
- 2945a652652a56050e9f411cd5770a32bd15e85b
- MD5
- 9a66a1cf8cbf733a28a83db4727e70d0
- CRC-32
- 7604a13c
- File type
- Windows executable
- First seen
- 2012-12-05
Example 3
File Information
- Size
- 173K
- SHA-1
- 2e6aef9d214922730641eeb90dc9591eb47b837a
- MD5
- 822d74dcd50fc0dad486cfb6eae5ddc3
- CRC-32
- 27fc4d42
- File type
- Windows executable
- First seen
- 2012-11-27
Runtime Analysis
Dropped Files
- C:\Program Files\_arh1\_arh1\no111111111ri.vbs
- Size
- 1.7K
- SHA-1
- 21f924fbcb59ad57284bae1e72919ba8ac5783d8
- MD5
- d822a34e2bf34de05e78aba67511edb4
- CRC-32
- 65162140
- File type
- Visual Basic Script
- First seen
- 2012-11-27
- c:\Documents and Settings\test user\Recent\no111111111ri.vbs.lnk
- Size
- 774
- SHA-1
- 010456d73272c5f70517449c6db6a38eb846cf80
- MD5
- c02f1bf4701cf99c57b749c415d11ab8
- CRC-32
- 0303af86
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2013-01-12
- c:\Documents and Settings\test user\Recent\_arh1.lnk
- C:\Program Files\_arh1\_arh1\na1111111111111ki.bat
- Size
- 6.6K
- SHA-1
- 16edbc870f13ca00034e4a832d2a75cdb23a12c7
- MD5
- fc29fbfea70565f4eb1d777e4db0789e
- CRC-32
- f6d48114
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-11-29
- C:\WINDOWS\system32\drivers\etc\hosts
- Size
- 1.1K
- SHA-1
- 85b4fe5284f1a3c0c313f89ae2535dd0a3accd5b
- MD5
- 1bd676f9c06097aa1a81f4c19407dc98
- CRC-32
- 18436563
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2013-01-12
- C:\Program Files\_arh1\_arh1\kust.txt
- C:\Program Files\_arh1\_arh1\kokolok.txt
- Size
- 1
- SHA-1
- 77ac341feebeb7c0a7ff8f9c6540531500693bac
- MD5
- fc1262746424402278e88f6c1f02f581
- CRC-32
- 95b020f2
- File type
- application/octet-stream
- First seen
- 2011-07-24
Modified Files
- %SYSTEM%\drivers\etc\hosts
- Changed the file contents
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
- 7
- _□□□□□ □□□□□□□□□□□ □□ □□□□□□□□□□□□□□□□□□a□ h□□.□□n□□□□□□□0□□@□□□□□□□□□□□□□□□□□@□□□□□□□□□□□ □□□□□□□□□□□□□□□□□□□□□□□□□□□□□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.vbs
- MRUListEx
- □□□□□□□□□□□□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithList
- MRUList
- a
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013011220130113
- CacheRepair
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder
- 3
- _□□□□□ □□□□□□□□□□□ □□ □□□□□□□□□□□□□□□□□□a□ h□□.□□n□□□□□□□0□□@□□□□□□□□□□□□□□□□□@□□□□□□□□□□□ □□□□□□□□□□□□□□□□□□□□□□□□□□□□□
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
- MRUListEx
- 07 00 00 00 06 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder
- MRUListEx
- 03 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff
Processes Created
- c:\windows\system32\cmd.exe
- c:\windows\system32\wscript.exe
IP Connections