Examples of Troj/Zbot-EBN include:
Example 1
File Information
- Size
- 532K
- SHA-1
- 510f78a210725efd3a01aaa61cc6e8568e27d4a3
- MD5
- aee92617a5f0202f14b9eb9d717725e4
- CRC-32
- b0274e8d
- File type
- Windows executable
- First seen
- 2013-03-09
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Ysunz\zykaag.asr
- Size
- 477
- SHA-1
- 3cd610eddd158662fb8639f6afa5785ee1eb2263
- MD5
- bcb31d2d1f33657596cc8b9af3429a83
- CRC-32
- d48326ed
- File type
- Unspecified binary - probably data
- First seen
- 2013-03-09
- c:\Documents and Settings\test user\Application Data\Azecdi\ugvyzua.exe
- Size
- 455K
- SHA-1
- 9ddbb1106a6bcbc47a08ae8a2b64f38d71fc1c61
- MD5
- 0a0d18ba4524d530f819fd5fc3b5dd38
- CRC-32
- 7a7ea0c9
- File type
- Windows executable
- First seen
- 2013-03-09
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
Registry Keys Created
- HKCU\Software\WinRAR SFX
- C%%DOCUME~1%support%LOCALS~1%Temp
- C:\DOCUME~1\support\LOCALS~1\Temp
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
- HKCU\Software\Microsoft\Owogka
- Udigzuyv
- □□□`□□□v□p□□□5□0R□□□□□□□ □□□□□□&□□g□□□□ D□ □□P□□ □□P□□□□□□□□ □□ □□□*□□□□□x□@c□□□□0□□□□□P□□0□□□ □0P□□Q□`i□□%□ph□□S□p□□□□pH□□m□P□□□□□`p□□,□□8□□□□P□□P3□□□□□□□□□□□9□@□□□□□□|□@#□
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
- %windir%\explorer.exe
- %windir%\explorer.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {FD61411B-E17C-225B-0E8B-B323D864978E}
- "c:\Documents and Settings\test user\Application Data\Azecdi\ugvyzua.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 9e c8 5b cb 6c 1c ce 01
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000008
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\application data\azecdi\ugvyzua.exe
- c:\docume~1\support\locals~1\temp\theg.exe
- c:\windows\system32\cmd.exe
DNS Requests
Example 2
File Information
- Size
- 455K
- SHA-1
- 9ddbb1106a6bcbc47a08ae8a2b64f38d71fc1c61
- MD5
- 0a0d18ba4524d530f819fd5fc3b5dd38
- CRC-32
- 7a7ea0c9
- File type
- Windows executable
- First seen
- 2013-03-09