Troj/Zbot-DNM exhibits the following characteristics:
File Information
- Size
- 158K
- SHA-1
- 1301b81654e9ecf4872437e6085ab2d6d23f142f
- MD5
- bbba4ed2760a781f9cfeb733ec1808c8
- CRC-32
- cd34510d
- File type
- Windows executable
- First seen
- 2013-01-11
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Wopo\dice.exe
- Size
- 158K
- SHA-1
- ce70c9f34b8f9e4fac8b197a59bbbddcbc005f2e
- MD5
- 53ea4009f5265b6eef786a57e1d73181
- CRC-32
- 3a9a8728
- File type
- Windows executable
- First seen
- 2013-01-11
- c:\Documents and Settings\test user\Application Data\Roocpo\okuc.lyu
- Size
- 563
- SHA-1
- e93cb28682eac03b8a429a5e0007dbaca7a7e75b
- MD5
- ee66f1a052e7e0f1c9a794bda0ba5ee2
- CRC-32
- ff524c40
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-11
Registry Keys Created
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {B0D7199F-4B4C-B415-068B-387409BEB3BF}
- "c:\Documents and Settings\test user\Application Data\Wopo\dice.exe"
- HKCU\Software\Microsoft\Luri
- Ciezpinu
- 8e a3 10 cb 90 ba f9 99 f6 46 a8 13 7b 8c cf 71 da 89 cd f2 1f f0 ec 8e eb be ca 60 51 81 90 ae cb d2 32 97 47 0f 92 71 d5 34 c9 e6 67 7e e0 6c 6b 95 a3 17 7f 63 44 79 d0 38 92 d6 72 f0 2c 74 97 d0 96 4b d5 3b 49 57 aa 49 1c 0a f1 fb 44 ce 73 56 16 08 9c cc 4e 54 4a aa 34 3b c9 0d 00 56 0f ca 4a b6 ca 65 5d ad 9e 98 8a 3b 30 a7 7d f0 2d 91 28 99 43 44 90 84 ae ad fc ce e9 1b 70 b2 41 66 b2 31 ab bf c3 1e 07 ff f9 83 c0 da c7 59 d3 95 6f 88 ae 3a 85 b6 a8 e3 01 83 cb eb 66 35 90 33 60 fd 16 04 7b 4c b4 66 e3 09 58 14 82 b5 23 6a a4 61 36 fa b8 85 dc 01 23 ad 2f 8e 22 cc 73 a1 9a c3 6b 49 50 82 2a 12 b1 0d 4e 71 c4 ad 74 d6 52 1b 4d e6 45 10 24 28 a5 33 47 99 f5 f7 b0 5d 8b e5 d0 cf f8 90 4d 0f e4 7c e0 8d 04 44 f3 21 71 5c 71 f4 3e 8f 4b cb d6 3b 26 5c dc a4 [... 151134 intervening characters ...] 90 86 d0 c7 0d 2d c7 23 a1 d8 6e 69 88 14 7a 77 2c b8 a5 e7 7c d0 b3 c1 29 bd 54 26 3f a2 c2 8a 78 e0 5b 62 0d 13 29 91 f5 8d 76 5c 91 43 11 e3 5a 35 f2 70 d4 6d 33 20 b6 16 92 6f bb 9b fa fa
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\wopo\dice.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://bullion-profits.com/cgi_bin/config.bin
- http://www.google.bg/webhp
- http://www.google.com/webhp
DNS Requests
- bullion-profits.com
- www.google.bg
- www.google.com