Troj/Zbot-CSI exhibits the following characteristics:
File Information
- Size
- 373K
- SHA-1
- 101619c945a9de50cfe2f9adebb981b69c74d4ca
- MD5
- 36ad9f8c2c3de263b934b8251ec24799
- CRC-32
- 91712ec3
- File type
- Windows executable
- First seen
- 2012-10-07
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Nyhyuq\habuw.exe
- Size
- 373K
- SHA-1
- a4ab2de40619c4f0ec730005a69907d6a9ddac35
- MD5
- b6f9cfb525e45c0e4992031c048c6b3e
- CRC-32
- 7b0597cc
- File type
- Windows executable
- First seen
- 2012-10-07
Registry Keys Created
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {45EB64EB-848A-69EF-4C5B-7F78EFDEA869}
- "c:\Documents and Settings\test user\Application Data\Nyhyuq\habuw.exe"
- HKCU\Software\Microsoft\Inyh
- Ecnyet
- 5b 2b 84 bd ec aa 80 a2 21 09 63 18 fd d0 a1 19 7c 93 99 39 5a 94 5e 5c 5b 7d 99 35 39 65 2c c6 42 75 58 06 5c ee 52 2e b8 ad e9 35 1c e9 69 b6 ae 8d 0a 36 f6 3d ff 16 8a d5 5c 9e 58 50 d2 22 3b 19 9c 32 53 b2 f0 8c 0a 38 fa f0 f1 70 67 1d 31 47 b7 df 46 ff ea 05 48 3e b5 a6 55 1f 88 25 0c 19 3b 00 23 04 eb 6b 76 be d8 62 ea 45 29 0a de 55 cb a6 f8 72 6f 5c 90 62 70 a9 5c b5 61 47 64 8e 39 05 f0 c2 2b 3e b9 9e bf 0c 45 1d df 9c 70 b8 bb eb 49 ab 2a 51 95 75 fd a7 7e 0c 6e 2f f1 1c 94 bb 57 23 55 1c 6a 64 ac 09 bf ab 93 85 38 5b a6 84 81 1b 12 5b 27 65 9c 12 db 6f 46 97 f9 42 40 10 ca c1 64 a6 47 4f 80 da 04 18 46 74 43 41 43 66 da 6b 73 62 45 49 ca 6d 72 2f c9 5f 7c cc 4e 02 2f 20 7d d6 b0 05 e0 22 32 2a 2f f8 e0 52 93 ee 6b 9e 42 3c 06 52 b3 6d eb 58 17 f1 [... 151188 intervening characters ...] a7 24 85 7e 95 2a b7 d9 8b 40 87 ab 42 7f a1 45 9e d7 9e 8c 53 26 ce b0 f5 0d 09 d5 e1 9c 62 3b 78 68 c9 41 f0 a0 55 60 9b bb 35 d9 74 19 d2 5f 3c d0 9a 6e f9 df 86 ea 6d 2b ba 47 0b 99 78 32
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\nyhyuq\habuw.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://dedeniscompany.cu.cc/ventures/server/config.bin
- http://www.google.bg/webhp
- http://www.google.com/webhp
DNS Requests
- dedeniscompany.cu.cc
- www.google.bg
- www.google.com