Troj/Zbot-DXM exhibits the following characteristics:
File Information
- Size
- 603K
- SHA-1
- 27d443ce977d3e60230b05b91fddacbfc19ded66
- MD5
- af223c2fc65199612505f378a2d6ccd4
- CRC-32
- 5da583e7
- File type
- Windows executable
- First seen
- 2013-01-05
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Ozab\qafes.exe
- Size
- 229K
- SHA-1
- 6d4f8a33880290b740c76553d248bc6adc3a58f1
- MD5
- 35389fb4274e2cbdfea399a552182bbc
- CRC-32
- 7338dbc9
- File type
- Windows executable
- First seen
- 2013-02-15
- c:\Documents and Settings\test user\Application Data\Urxy\ovawf.tmp
- Size
- 563
- SHA-1
- 79f51d6459e4d9021c034017b6591b5679f34cf8
- MD5
- e47b531095b43e41c4114bee9660f5d6
- CRC-32
- cc418ab5
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-15
- c:\Documents and Settings\test user\Application Data\Urxy\ovawf.ote
- Size
- 477
- SHA-1
- 0484af49fc5993ad1275c5b154705ae02b2a8733
- MD5
- d8b59d2b83668891c04a4b5cabaadcf5
- CRC-32
- 5d3972f6
- File type
- Unspecified binary - probably data
- First seen
- 2013-02-15
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Zygo
- Wisayxyz
- □□□pJ□□□□□}□□□□□Z□ □□ □□□□□p□□P□□□□□□□□0A□□□□P□□□g□p?□0i□□Y□□L□P□□p□□`<□□□□□□□0a□□□□□□□□□□□□□p□□□□□□Q□□\□□□□0□□□$□P□□□□□□□□P□□□□□□u□`□□□□□□□□□j□□&□□□□□`□□?□□@□□r□□□□□□□p(□0□□
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {9CAD8250-8B3E-0DFB-1D58-336E6DA87918}
- "c:\Documents and Settings\test user\Application Data\Ozab\qafes.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 08 63 b1 24 b1 0b ce 01
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000008
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\ozab\qafes.exe
- c:\docume~1\support\locals~1\temp\dipo.exe
- c:\windows\system32\cmd.exe
HTTP Requests
- http://my-click.org/dipo/cfg.bin
DNS Requests