Examples of Troj/Zbot-DSQ include:
Example 1
File Information
- Size
- 317K
- SHA-1
- 8e19c5903b9937e0558418b9f95b97836e1ef9c3
- MD5
- b18c63d2dccce93d8ab2ef1bea57e0c7
- CRC-32
- 3482d5ee
- File type
- Windows executable
- First seen
- 2013-01-28
Example 2
File Information
- Size
- 111K
- SHA-1
- d37a0709bcf2b361b9b65ab1acf09b07d8ec918c
- MD5
- adc79ddd078e7b9d6743c6d004d2648f
- CRC-32
- dbced988
- File type
- Windows executable
- First seen
- 2013-01-28
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Application Data\ogoge.ifu
- Size
- 477
- SHA-1
- e9b2492ee8424a4f0b1999e30526d20f223481e0
- MD5
- 07630002bbeb610765d64b056737019f
- CRC-32
- 991e1d47
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-28
- c:\Documents and Settings\test user\Application Data\Arovik\waimdy.exe
- Size
- 317K
- SHA-1
- 8e19c5903b9937e0558418b9f95b97836e1ef9c3
- MD5
- b18c63d2dccce93d8ab2ef1bea57e0c7
- CRC-32
- 3482d5ee
- File type
- Windows executable
- First seen
- 2013-01-28
Registry Keys Created
- HKCU\Software\Microsoft\Pyhao
- 2ijad677
- OR□@l□0n□□+□ s□□a□ o□□S□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {5DA41964-5123-AD7F-97EB-E4E1BB5DC7F3}
- "c:\Documents and Settings\test user\Application Data\Arovik\waimdy.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\WinRAR
- C8022EA25DE3573A96078BB6ADC273A9
- tr□Pe□
Processes Created
- c:\Documents and Settings\test user\application data\arovik\waimdy.exe
- c:\docume~1\support\locals~1\temp\121890.exe
- c:\docume~1\support\locals~1\temp\123468.exe
- c:\docume~1\support\locals~1\temp\127406.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://indonesiascuba.com/utosi1bw.exe
- http://www.dimag-giantpale.it/wbA.exe
- http://www.ilonexs-koblenz.de/ba6FtC3L.exe
IP Connections
- 108.83.233.190:15683
- 206.45.59.85:15757
- 64.219.114.114:13503
- 71.43.217.3:11403
- 72.218.14.223:26631
- 76.219.198.177:13541
- 82.60.1.42:10552
- 83.111.92.83:24543
- 87.203.87.232:10271
DNS Requests
- 13.tokoaksesoriskomputer.com
- indonesiascuba.com
- www.dimag-giantpale.it
- www.ilonexs-koblenz.de