Troj/Zbot-BNW

Categoría: Virus y programas espía Protección disponible desde:05 mar 2012 13:07:15 (GMT)
Tipo: Trojan Última actualización:05 mar 2012 13:07:15 (GMT)
Predominio:

Download Descargue nuestra herramienta gratuita para la eliminación de virus - Encuentre las amenazas no detectadas por su antivirus

Examples of Troj/Zbot-BNW include:

Example 1

File Information

Size
99K
SHA-1
603d47170b367987aa1422f547e56ecdd5f9ddeb
MD5
d70f1a5046febefef25395f8894012d1
CRC-32
8e7d7e0b
File type
application/x-ms-dos-executable
First seen
2012-03-05

Runtime Analysis

Dropped Files
  • c:\Documents and Settings\test user\Application Data\Microsoft\Windows\pMkA1KidS.cfg
    Size
    1.5K
    SHA-1
    ffd2c40276d128177e825615a0a9be379a59537a
    MD5
    68a945d1823162a7a2c67ef4c9cb03b9
    CRC-32
    3b4a7f72
    File type
    application/octet-stream
    First seen
    2012-03-05
  • c:\Documents and Settings\test user\Local Settings\Temp\.bin
    Size
    73K
    SHA-1
    b774e9fba3ae78fd22e25bc3d7ede0cd164c7d61
    MD5
    32fe680156e934dd5f3cc969d2be0fcf
    CRC-32
    50bb069b
    File type
    application/octet-stream
    First seen
    2012-03-05
  • c:\Documents and Settings\test user\Application Data\Microsoft\Windows\pMkA1KidS.dat
    Size
    2
    SHA-1
    4700b42849fb35be323774820bf1bc8019d26c80
    MD5
    84cad01fdb44ae58dbe6c3973dcd87f5
    CRC-32
    4f349987
    File type
    application/octet-stream
    First seen
    2011-09-26
  • c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
    Size
    53K
    SHA-1
    d7b372104eba08a1677254761d4fa4153d9f796c
    MD5
    c4480c72fc5cfd6b6b79253d67b06424
    CRC-32
    db46a2c5
    File type
    application/x-ms-dos-executable
    First seen
    2012-03-05
Registry Keys Created
  • HKCU\Software\pMkA1KidS
    InstalledServer
    c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Antivir
    c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\EXPLORER.EXE:*:Enabled:Explorateur Windows
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    Antivir
    c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
Processes Created
  • c:\Documents and Settings\test user\local settings\temp\bin.exe
  • c:\windows\explorer.exe
  • c:\windows\system32\svchost.exe
DNS Requests
  • djamel.hopto.org

Example 2

File Information

Size
53K
SHA-1
d7b372104eba08a1677254761d4fa4153d9f796c
MD5
c4480c72fc5cfd6b6b79253d67b06424
CRC-32
db46a2c5
File type
application/x-ms-dos-executable
First seen
2012-03-05

descargar Pruebe los productos de Sophos totalmente gratis
Descargue una evaluación gratuita