Troj/Zbot-DEC exhibits the following characteristics:
File Information
- Size
- 304K
- SHA-1
- f070b1774c1d35b19561ff524af8df504ba6c996
- MD5
- b8171054bbe2905b2efaf685a2d0d291
- CRC-32
- 4f9759f1
- File type
- Windows executable
- First seen
- 2012-12-05
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Avocfo\uqur.exe
- Size
- 304K
- SHA-1
- 894b3cdbc07425a88de99b340465d7057118a75c
- MD5
- 8a859b9ac255a14458ad4db8bbcfdf56
- CRC-32
- dfc68602
- File type
- Windows executable
- First seen
- 2012-12-05
- c:\Documents and Settings\test user\Application Data\Ifep\puax.uco
- Size
- 477
- SHA-1
- 7cc5475fed670e10657c1f289bea4e9f06e508e6
- MD5
- a8b1134c9b2722ca82079b9ade173a75
- CRC-32
- 9372e375
- File type
- Unspecified binary - probably data
- First seen
- 2012-12-05
- C:\debug.txt
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {6DF6B4F3-38D7-464B-0174-FD56F27E0A0B}
- "c:\Documents and Settings\test user\Application Data\Avocfo\uqur.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Yqezq
- Ettoqu
- □□□□□□□A□□□□□L□□`□□?□□□□□□□□□□□6□0□□□□□□□□□□□@□□□□□□□□□□□0□□□□□□;□0□□`□□□□□□□□□□□P□□0□□@□□0.□0W□@H□0^□□}□@E□□□□□□□□b□□□□ □□`F□□□□`□□P□□□□□□□□``□□□□□□□□p□@□□□□□p□□□`□□O□p□□PL□
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 3a a5 5d a8 8c d2 cd 01
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000007
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\avocfo\uqur.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://www.google.bg/webhp
- http://www.google.com/webhp
- http://www.schaakverenigingalmelo.nl/familie09/scha.bin
DNS Requests
- www.google.bg
- www.google.com
- www.schaakverenigingalmelo.nl