Troj/Zbot-DEV exhibits the following characteristics:
File Information
- Size
- 137K
- SHA-1
- 5e1aefca997862441f43eea6f7fb73ebb2e9bea4
- MD5
- 83ce749ff49e72fd980d610d98c2f1b0
- CRC-32
- 33ce7af3
- File type
- Windows executable
- First seen
- 2012-12-06
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Uvac\efehroo.exe
- Size
- 137K
- SHA-1
- dd4ae00a78ddf5318988bef2bf7cbb33670f300c
- MD5
- fafb8846e42525efc09f2ec431157efa
- CRC-32
- 720139be
- File type
- Windows executable
- First seen
- 2012-12-06
- c:\Documents and Settings\test user\Application Data\Siicawc\uwvyyn.yxo
- Size
- 477
- SHA-1
- 53e6e3e56a9a25a621ed4d9c5bd78205a1f83c11
- MD5
- 240f2c25be49e6d1be8b76ffccbabcc3
- CRC-32
- d9ecfd6b
- File type
- Unspecified binary - probably data
- First seen
- 2012-12-06
- c:\Documents and Settings\test user\Application Data\Siicawc\uwvyyn.tmp
- Size
- 315
- SHA-1
- d2ed6a22b71f0d2f836324536ae13c409f4a84c6
- MD5
- 1d1ae9b7266d6cadadf8fa60855aebf3
- CRC-32
- cbc8dcba
- File type
- Unspecified binary - probably data
- First seen
- 2012-12-06
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
Registry Keys Created
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Software\Microsoft\Baxeuc
- Vafeyrtiu
- □-□□w□□t□0□□p□□p□□0□□□□□0[□□□□□-□□□□□□□□□□@□□□□□@m□□9□□□□□.□□s□@□□ □□□}□□□□p□□□□□□3□P□□□□□P2□□□□□7□0□□@□□□□□PO□□a□pr□□□□0□□`□□@□□□/□□□□`@□ □□P,□□□□ □□□□□□W□□□□□□□ (□ □□□□□ =□
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {02EDDFB5-5B21-2F70-6738-90E65E5665A1}
- "c:\Documents and Settings\test user\Application Data\Uvac\efehroo.exe"
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
Registry Keys Modified
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000007
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- fa 87 04 1e 03 d4 cd 01
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\uvac\efehroo.exe
DNS Requests