Troj/Zaccess-HS exhibits the following characteristics:
File Information
- Size
- 177K
- SHA-1
- c6e3bc966859d63697f36aad1f6454d1dcd1c028
- MD5
- 4157499241515793d62c5c750138a13f
- CRC-32
- 4d62f012
- File type
- Windows executable
- First seen
- 2013-01-26
Runtime Analysis
Registry Keys Created
- HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
- HKCU_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-21-1202660629-1454471165-1275210071-1003\$8b2e7cc03175028b9a2b805595885191\n.
Registry Keys Modified
- HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32
- (Default)
- C:\RECYCLER\S-1-5-18\$8b2e7cc03175028b9a2b805595885191\n.
Processes Created
- c:\windows\system32\cmd.exe
HTTP Requests
- http://j.maxmind.com/app/geoip.js
IP Connections
- 1.173.112.37:16464
- 1.22.216.215:16464
- 101.63.132.28:16464
- 101.96.44.207:16464
- 109.108.170.84:16464
- 109.197.85.24:16464
- 109.83.98.52:16464
- 111.252.182.235:16464
- 112.146.39.193:16464
- 115.254.253.254:16464
- 117.194.83.254:16464
- 117.254.253.254:16464
- 119.254.253.254:16464
- 123.238.114.61:16464
- 134.254.253.254:16464
- 135.254.253.254:16464
- 156.17.240.41:16464
- 166.161.28.33:16464
- 172.218.244.201:16464
- 173.209.129.190:16464
- 177.106.54.243:16464
- 180.254.253.254:16464
- 180.45.94.45:16464
- 182.254.253.254:16464
- 183.82.152.222:16464
- 188.195.176.231:16464
- 190.209.246.60:16464
- 190.254.253.254:16464
- 194.165.17.3:53
- 201.86.5.209:16464
- 206.254.253.254:16464
- 206.53.13.10:16464
- 223.18.93.55:16464
- 24.235.141.31:16464
- 24.99.93.212:16464
- 27.106.111.81:16464
- 5.15.240.63:16464
- 66.117.244.198:16464
- 66.85.130.234:53
- 68.109.118.44:16464
- 68.113.185.8:16464
- 68.191.133.195:16464
- 68.35.247.33:16464
- 68.35.72.228:16464
- 68.39.93.81:16464
- 69.23.45.65:16464
- 70.177.79.55:16464
- 70.190.154.247:16464
- 70.82.80.52:16464
- 71.254.253.254:16464
- 71.80.160.27:16464
- 72.208.29.250:16464
- 75.109.86.25:16464
- 75.128.183.55:16464
- 76.16.207.24:16464
- 76.27.211.55:16464
- 78.90.120.40:16464
- 79.187.162.54:16464
- 79.188.157.42:16464
- 8.8.8.8:53
- 82.137.41.13:16464
- 84.229.150.15:16464
- 85.74.104.25:16464
- 86.38.157.67:16464
- 87.1.107.62:16464
- 87.254.253.254:16464
- 88.254.253.254:16464
- 89.132.229.81:16464
- 92.254.253.254:16464
- 93.105.38.34:16464
- 93.124.37.73:16464
- 93.14.128.38:16464
- 94.21.241.4:16464
- 94.41.31.41:16464
- 95.48.187.242:16464
- 98.217.85.55:16464
- 98.28.106.196:16464
DNS Requests