Examples of Troj/Zbot-DVV include:
Example 1
File Information
- Size
- 555K
- SHA-1
- 15783b6ea84f87546ff4bc1e81116dff8bf4bd08
- MD5
- d0145a94b7b7a76560a74fec4ff954ea
- CRC-32
- f7daf556
- File type
- Windows executable
- First seen
- 2013-02-19
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Guvyuk\educh.dex
- Size
- 477
- SHA-1
- a1306c71b175209b02ede070e34156a0e2061d9e
- MD5
- c12b20e7bdb40782a2a3550e0696c5d2
- CRC-32
- 285f66f9
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-19
- c:\Documents and Settings\test user\Application Data\Qeece\ecze.exe
- Size
- 171K
- SHA-1
- 97bbe724276f5e0f336e8e4093b5a3f59ded6287
- MD5
- 55c67ce5cfa1d8f01e30526a06563800
- CRC-32
- 538a6b70
- File type
- Windows executable
- First seen
- 2013-02-19
- c:\Documents and Settings\test user\Application Data\Guvyuk\educh.tmp
- Size
- 563
- SHA-1
- 94a5d3924ef34060f320a8bd3abf0266f5eaea63
- MD5
- 9bd4b2d7543f88cd65ebb7592e40b4c2
- CRC-32
- 447e870a
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-19
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {B5900658-B683-C128-79C7-9C7C8F41D583}
- "c:\Documents and Settings\test user\Application Data\Qeece\ecze.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Software\Microsoft\Goop
- Veaby
- <f□@□□ (□□E□□'□□□□P□□□□□□□□p□□ □□□J□``□P□□□□□□□□0y□□□□□□□p□□□□□0-□□□□□i□ □□ □□□□□@?□□□□p□□□□□□g□□:□□/□□□□`+□`[□□H□□□□□T□ □□□3□□□□□F□□□□Pv□p□□□□□□□□□□□`□□ □□□V□0X□□□□□□□P□□P=□
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000008
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 4e d7 b3 99 f9 0e ce 01
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\qeece\ecze.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://dbbr.com.br/~dbbrcom/vices/cfg.bin
DNS Requests
Example 2
File Information
- Size
- 171K
- SHA-1
- 97bbe724276f5e0f336e8e4093b5a3f59ded6287
- MD5
- 55c67ce5cfa1d8f01e30526a06563800
- CRC-32
- 538a6b70
- File type
- Windows executable
- First seen
- 2013-02-19