Troj/Zbot-DQX exhibits the following characteristics:
File Information
- Size
- 409K
- SHA-1
- 77b4b863373579733ee9fa2f2d03dcd62ffe379f
- MD5
- aba1bdd6b2b0a45dc344e39977240219
- CRC-32
- 4fec846d
- File type
- Windows executable
- First seen
- 2013-01-22
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Azle\ivoxosr.exe
- Size
- 409K
- SHA-1
- 32c6033e5499c01a4692d2079eba57adff905fc4
- MD5
- 904a33a8015ce6bd336ca34c12f392a5
- CRC-32
- 9e961551
- File type
- Windows executable
- First seen
- 2013-01-22
- c:\Documents and Settings\test user\Application Data\Cexaw\tekieku.mio
- Size
- 477
- SHA-1
- ee61912a6b4c291448c3ace8f1d054b871bb408b
- MD5
- fd7bd2cb9707d1a598778da0b926d2a4
- CRC-32
- fdde4a0e
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-22
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Yloc
- Arob
- 6\□ □□`,□`□□□□□□□□□□□p□□□x□□.□0□□`□□□-□□□□p□□p□□□□□`□□□T□□!□□□□0□□h□□x□□%□0□□□□□ Y□□□□□□□□□□□□□□□□P□□ !□□Z□□h□□□□PA□□□□`□□□□□□T□□□□□5□p□□`Y□□P□□□□□□□@T□□L□□□□@3□□□□□^□□□□□□□
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
- HKCU\Identities
- Identity Login
- 0x00098053
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {FD61411B-E17C-225B-0E8B-B323D864978E}
- "c:\Documents and Settings\test user\Application Data\Azle\ivoxosr.exe"
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000008
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 44 db 78 96 68 f8 cd 01
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\azle\ivoxosr.exe
- c:\windows\system32\cmd.exe
DNS Requests