Examples of W32/Dorkbot-DC include:
Example 1
File Information
- Size
- 604K
- SHA-1
- 6724505baa09e26d77db031936ed6bd62baf5648
- MD5
- 06934ed732b0834b75be9c22c6864f92
- CRC-32
- 329155a5
- File type
- Windows executable
- First seen
- 2012-10-11
Runtime Analysis
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
Registry Keys Created
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {D589C9C7-DDDC-6D6A-5B45-9AC8F8BCC2A8}
- "c:\Documents and Settings\test user\Application Data\Qyzyo\aduld.exe"
- HKCU\Software\Microsoft\Evvoa
- Uprowa
- C□□□H□p□□0H□□\□□□□□□□p□□`D□□;□□□□0□□ □□□□□@□□□□□□□□ □□□□□□{□PW□P□□□□□@F□P□□`□□ □□□\□□□□□□□P□□□□□0□□0□□□□□@□□P□□□x□@$□□□□□□□□□□0~□□□□□q□@□□@□□0G□ □□□□□□□□□□□□□□□□□0□□□□□□□□□□□
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000007
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 06 55 a8 0b 06 a8 cd 01
Processes Created
- c:\Documents and Settings\test user\local settings\application data\xenocode\sandbox\1.0.0.0\2012.10.11t17.20\native\stubexe\@appdatalocal@\xenocode\sandbox\1.0.0.0\2012.10.11t17.19\native\stubexe\@appdata@\qyzyo\aduld.exe
HTTP Requests
- http://programming-rfc.ir/frank/config.bin
- http://www.google.bg/webhp
- http://www.google.com/webhp
DNS Requests
- programming-rfc.ir
- www.google.bg
- www.google.com
Example 2
File Information
- Size
- 989K
- SHA-1
- b6dfc6b47861d3f51f6d5c59db049267c78b55c3
- MD5
- 5d7d335ad23e3258049a96cb87c69ce0
- CRC-32
- e43bf2f0
- File type
- Windows executable
- First seen
- 2012-10-11
Other vendor detection
- Kaspersky
- Trojan-Spy.Win32.Zbot.bopd
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Virtual\SXS\Xenocode.VMX@1.0.0.0\Xenocode.VMX@1.0.0.0.manifest
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Virtual\SXS\Xenocode.VMX@1.0.0.0\Xenocode.VMX.manifest
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Virtual\SXS\Manifests\VmX.dll_0x8C9DF666D50A4D841E2DCEE9556484BF.2.manifest
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Virtual\XRegistry.tmp
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Virtual\SXS\Xenocode.VMX@1.0.0.0\Xenocode.VMX@1.0.0.0.manifest
- c:\Documents and Settings\test user\Application Data\Pixu\ilhau.xyr
- Size
- 477
- SHA-1
- 2fe1ce353948afe1971782b8606c34581207ca58
- MD5
- 36de75dec33dbbb62b7ec9f14188cdc7
- CRC-32
- a4c406c7
- File type
- Unspecified binary - probably data
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Virtual\XRegistry.tmp
- c:\Documents and Settings\test user\Application Data\Byuv\yzeci.exe
- Size
- 138K
- SHA-1
- 6006cd5d6822267a4ff6de1120b17f565af6dbd8
- MD5
- 78e7f4a52099c0064ee06e991b22e319
- CRC-32
- c7cfe77a
- File type
- Windows executable
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Virtual\SXS\Manifests\VmX.dll_0x8C9DF666D50A4D841E2DCEE9556484BF.2.manifest
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Native\STUBEXE\@APPDATA@\Byuv\yzeci.exe
- Size
- 17K
- SHA-1
- a7f20018e4a73e8e52fc58661001ac28067c1c9c
- MD5
- bf7bfe0fa6a394d4735c610936765b0a
- CRC-32
- a5d2db18
- File type
- Windows executable
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Native\STUBEXE\@APPDATALOCAL@\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Native\STUBEXE\@SYSTEM@\cmd.exe
- Size
- 17K
- SHA-1
- afabe3919dd96fcdfd2a28ce5ff2daa3e69eaf24
- MD5
- ed9686fda98ca8f26ed84c22552b7fd5
- CRC-32
- 484270dd
- File type
- Windows executable
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Native\STUBEXE\@APPDATALOCAL@\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Native\STUBEXE\@APPDATA@\Byuv\yzeci.exe
- Size
- 17K
- SHA-1
- 315e0706ad15f4f1c744d3b95f8599b88f41e5c0
- MD5
- 5d905af0ca63a7b572b4d7492ee07005
- CRC-32
- d59e4a65
- File type
- Windows executable
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.20\Virtual\SXS\Xenocode.VMX@1.0.0.0\Xenocode.VMX.manifest
- c:\Documents and Settings\test user\Local Settings\Temp\sampleorder1.exe
- Size
- 604K
- SHA-1
- 6724505baa09e26d77db031936ed6bd62baf5648
- MD5
- 06934ed732b0834b75be9c22c6864f92
- CRC-32
- 329155a5
- File type
- Windows executable
- First seen
- 2012-10-11
- c:\Documents and Settings\test user\Local Settings\Application Data\Xenocode\Sandbox\1.0.0.0\2012.10.11T17.19\Native\STUBEXE\@SYSTEM@\cmd.exe
- Size
- 17K
- SHA-1
- 400ee277205b90f8ccdd2eaf8418af7de9892c07
- MD5
- 7a856cd4df85a1ef4e20424f759f1784
- CRC-32
- 380ee1a0
- File type
- Windows executable
- First seen
- 2012-10-11
Modified Files
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Offline.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Folders.dbx
- %PROFILE%\Local Settings\Application Data\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Microsoft\Outlook Express\Inbox.dbx
Registry Keys Created
- HKCU\Software\Microsoft\Iwydza
- Imexysxu
- c□□□□□□□□@□@□□p□□□>□ b□`□□ :□□ □0□□□□□□□□@1□□□□p□□□□□□e□□□□P□□0□□□A□`□□□□□ □□□C□□□□□□□ □□□□□`I□□□□0□□ □□□□□□=□0□□□H□ □□`□□`□□□□□□=□□□□□+□□;□`$□□□□□>□□C□□□□□□□□U□□i□`□□□□□@t□□□□ "□P4□□3□`e□□□□□y□□v□□|□□u□□□□□L□□□□□□□`□□p1□P□□□□□□;□pc□ □□p□□□□□□□□0□□P□□□p□□G□@□□□□□□□□0□□ □□□}□□□□`□□p^□□□□□□□□,□□□□□□□`:□□<□□□□□\□p~□PU□`□□□w□□z□□(□P□□□[□□□□@□□□□□□□□p□□□□□□□□`Q□□Q□□□□@q□0□□□G□□□□□□□□□□□□□□J□p□□□#□□□□□□□□□□□□□ □□□□□□□□□□□□□□□:□p□□P]□□□□p3□□z□□□□□□□p□□□□□□□□□□□□5□□□□PB□□□□□□□□4□□□□ps□`~□P□□P[□p□□□□□□□□@□□□□□□□□ ,□□□□□□□□□□□□□0□□□□□□L□p□□□□□□{□□□□□□□□□□□□□`'□□□□□y□ *□@□pb□□□□□W□□□□□)□@□□□□□@□□ u□□l□`□□□~□□s□0□□@□□0M□□□□□□□@ □ V□□□□□□□□_□□Y□p□□□□□ □□@□□@□□□@□□□□@T□□f□P□□□T□□7□□□□□r□`P□□□□p□□□□□□=□□3□ □□□□□□□□pJ□`□□□!□□e□□□□□□□□□□p2□@□□`-□ □□□□□□□□ k□□#□@□□□□□□2□□□□ [... 6640 intervening characters ...] U□□E□ □□□Y□□□□p□□□□□□□□□)□□H□□□□`P□p□□□□□□:□□□□□□□□K□□□□ T□□□□@&□p□□Py□□p□□□□□A□□□□□=□ S□□c□□`□@-□0□□□□□□]□□□□ □□□□□@□□□□□`□□□□□0□□P□□□□□□□□□0□p□□□d□□e□@B□□9□□□□□□□□7□□□□□□□□[□□□□0□□pc□□□□□□□□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- {D589C9C7-DDDC-6D6A-5B45-9AC8F8BCC2A8}
- "c:\Documents and Settings\test user\Application Data\Byuv\yzeci.exe"
- HKCU\Identities
- Identity Login
- 0x00098053
- HKCU\Software\Microsoft\Internet Explorer\Privacy
- CleanCookies
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Identities\{E2564744-A8ED-497D-924B-A548B20CA034}\Software\Microsoft\Outlook Express\5.0
- Compact Check Count
- 0x00000007
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\user@example.com
- TimeStamp
- 6e fb 3a 72 03 a8 cd 01
Processes Created
- c:\Documents and Settings\test user\local settings\application data\xenocode\sandbox\1.0.0.0\2012.10.11t17.20\native\stubexe\@appdatalocal@\xenocode\sandbox\1.0.0.0\2012.10.11t17.19\native\stubexe\@appdata@\byuv\yzeci.exe
- c:\Documents and Settings\test user\local settings\application data\xenocode\sandbox\1.0.0.0\2012.10.11t17.20\native\stubexe\@appdatalocal@\xenocode\sandbox\1.0.0.0\2012.10.11t17.19\native\stubexe\@system@\cmd.exe
- c:\docume~1\support\locals~1\temp\sampleorder1.exe
HTTP Requests
- http://programming-rfc.ir/frank/config.bin
- http://www.google.bg/webhp
- http://www.google.com/webhp
DNS Requests
- programming-rfc.ir
- www.google.bg
- www.google.com