Examples of Troj/Reveton-CD include:
Example 1
File Information
- Size
- 740
- SHA-1
- 744d3782bf4bbae46ec08a0e7d9bfd90c971d8aa
- MD5
- ff0e99787aa4b229b1234b6cce81e0a4
- CRC-32
- ab018789
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2013-03-04
Example 2
File Information
- Size
- 96K
- SHA-1
- 7e36c3ba17c5f0f85548d81e6b4b6e5789191d0f
- MD5
- d3d0ad64748e5263ddbfeea9c5a972d0
- CRC-32
- 87dcc96e
- File type
- Windows executable
- First seen
- 2013-03-04
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Start Menu\Programs\Startup\runctf.lnk
- Size
- 740
- SHA-1
- 744d3782bf4bbae46ec08a0e7d9bfd90c971d8aa
- MD5
- ff0e99787aa4b229b1234b6cce81e0a4
- CRC-32
- ab018789
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2013-03-04
- C:\Documents and Settings\All Users\Application Data\elpmas.js
- Size
- 2.4K
- SHA-1
- 793977c2d5ea4834c4741af9aa58369406504ae7
- MD5
- 4f4ccbf6cdcd37d863d21553635089dc
- CRC-32
- 250f23fb
- File type
- JavaScript
- First seen
- 2013-01-24
- C:\Documents and Settings\All Users\Application Data\elpmas.pad
- Size
- 91M
- SHA-1
- ff1f49bdb798ad020a13844e15fb092695ce2201
- MD5
- 2f3bf9cfcd89b6dbfd5f82c9736c8801
- CRC-32
- fe2d3fd0
- File type
- Unspecified binary - probably data
- First seen
- 2013-03-04
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Internet Explorer\Main
- NoProtectedModeBanner
- 0x00000001
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 2500
- 0x00000003
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
IP Connections