Troj/ZAccess-FU exhibits the following characteristics:
File Information
- Size
- 156K
- SHA-1
- 7b43254974705933fc89a49529c250e121dae710
- MD5
- a8b5fef460e962334c239db4a8faa620
- CRC-32
- d45e5caa
- File type
- Windows executable
- First seen
- 2012-12-07
Runtime Analysis
Registry Keys Created
- HKCU_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
- HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
Registry Keys Modified
- HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-18\$8b2e7cc03175028b9a2b805595885191\n.
Processes Created
- c:\windows\system32\cmd.exe
HTTP Requests
- http://j.maxmind.com/app/geoip.js
IP Connections
- 101.63.37.204:16464
- 106.77.5.203:16464
- 109.192.175.40:16464
- 110.134.196.193:16464
- 114.47.21.49:16464
- 115.241.243.37:16464
- 115.242.129.96:16464
- 115.254.253.254:16464
- 116.73.198.137:16464
- 117.194.206.187:16464
- 124.176.75.228:16464
- 130.204.97.2:16464
- 135.19.39.200:16464
- 135.254.253.254:16464
- 14.96.101.246:16464
- 14.98.166.216:16464
- 150.214.64.187:16464
- 173.171.116.19:16464
- 175.38.47.4:16464
- 176.56.7.190:16464
- 178.150.105.31:16464
- 180.254.253.254:16464
- 180.73.40.202:16464
- 184.161.203.219:16464
- 190.253.253.254:16464
- 190.254.253.254:16464
- 194.165.17.3:53
- 198.82.172.122:16464
- 2.196.75.121:16464
- 201.213.36.184:16464
- 208.103.232.215:16464
- 212.253.253.254:16464
- 212.96.231.52:16464
- 213.100.96.214:16464
- 213.112.34.198:16464
- 213.253.253.254:16464
- 24.132.203.182:16464
- 24.144.207.200:16464
- 24.16.239.44:16464
- 24.77.249.247:16464
- 27.4.117.221:16464
- 46.37.85.16:16464
- 50.83.158.5:16464
- 66.85.130.234:53
- 67.161.55.113:16464
- 67.175.209.194:16464
- 67.218.58.205:16464
- 68.34.66.240:16464
- 69.135.206.24:16464
- 70.81.52.7:16464
- 71.238.200.181:16464
- 71.254.253.254:16464
- 71.86.75.197:16464
- 71.92.45.174:16464
- 74.194.68.205:16464
- 75.74.147.252:16464
- 75.76.141.25:16464
- 76.117.24.135:16464
- 76.170.47.220:16464
- 78.23.150.182:16464
- 79.119.191.190:16464
- 79.119.55.58:16464
- 79.46.112.217:16464
- 8.8.8.8:53
- 82.72.38.210:16464
- 82.78.231.141:16464
- 83.252.10.197:16464
- 84.228.200.206:16464
- 87.18.48.81:16464
- 87.254.253.254:16464
- 88.254.253.254:16464
- 92.231.108.117:16464
- 98.184.74.90:16464
- 98.209.74.102:16464
- 98.228.31.115:16464
- 98.239.151.25:16464
DNS Requests