Examples of Troj/Zbot-BNW include:
Example 1
File Information
- Size
- 99K
- SHA-1
- 603d47170b367987aa1422f547e56ecdd5f9ddeb
- MD5
- d70f1a5046febefef25395f8894012d1
- CRC-32
- 8e7d7e0b
- File type
- application/x-ms-dos-executable
- First seen
- 2012-03-05
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Application Data\Microsoft\Windows\pMkA1KidS.cfg
- Size
- 1.5K
- SHA-1
- ffd2c40276d128177e825615a0a9be379a59537a
- MD5
- 68a945d1823162a7a2c67ef4c9cb03b9
- CRC-32
- 3b4a7f72
- File type
- application/octet-stream
- First seen
- 2012-03-05
- c:\Documents and Settings\test user\Local Settings\Temp\.bin
- Size
- 73K
- SHA-1
- b774e9fba3ae78fd22e25bc3d7ede0cd164c7d61
- MD5
- 32fe680156e934dd5f3cc969d2be0fcf
- CRC-32
- 50bb069b
- File type
- application/octet-stream
- First seen
- 2012-03-05
- c:\Documents and Settings\test user\Application Data\Microsoft\Windows\pMkA1KidS.dat
- Size
- 2
- SHA-1
- 4700b42849fb35be323774820bf1bc8019d26c80
- MD5
- 84cad01fdb44ae58dbe6c3973dcd87f5
- CRC-32
- 4f349987
- File type
- application/octet-stream
- First seen
- 2011-09-26
- c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
- Size
- 53K
- SHA-1
- d7b372104eba08a1677254761d4fa4153d9f796c
- MD5
- c4480c72fc5cfd6b6b79253d67b06424
- CRC-32
- db46a2c5
- File type
- application/x-ms-dos-executable
- First seen
- 2012-03-05
Registry Keys Created
- HKCU\Software\pMkA1KidS
- InstalledServer
- c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Antivir
- c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- C:\WINDOWS\EXPLORER.EXE
- C:\WINDOWS\EXPLORER.EXE:*:Enabled:Explorateur Windows
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Antivir
- c:\Documents and Settings\test user\Application Data\Wscript\Winini.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\bin.exe
- c:\windows\explorer.exe
- c:\windows\system32\svchost.exe
DNS Requests
Example 2
File Information
- Size
- 53K
- SHA-1
- d7b372104eba08a1677254761d4fa4153d9f796c
- MD5
- c4480c72fc5cfd6b6b79253d67b06424
- CRC-32
- db46a2c5
- File type
- application/x-ms-dos-executable
- First seen
- 2012-03-05