Test Sample(2)

qigang

下载地址：http://vivotorpedosms.net/sms/wab.exe

banker？

电影结束了

• Submission details:
  • Submission received: 19 June 2008, 00:09:33
  • Processing time: 4 min 9 sec
  • Submitted sample:
    • File MD5: 0x5197863DA11D6DF819F21CE5207CF469
    • Filesize: 424,960 bytes
    • Alias: Trojan-Dropper.Win32.Agent.rnd [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	[file and pathname of the sample #1]	424,960 bytes	0x5197863DA11D6DF819F21CE5207CF469	Trojan-Dropper.Win32.Agent.rnd [Kaspersky Lab]
2	c:\winx.log	138 bytes	0x55CE55C10C0CB60721763D56D952FC3A	(not available)

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	487,424 bytes

• The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs

• Note:
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Other details

• The following port was open in the system:

Port	Protocol	Process
1035	TCP	[file and pathname of the sample #1]

• The following Host Name was requested from a host database:
  • ftp.xpg.com.br

• There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
ftp.xpg.com.br [td]21[/td][tr][/tr]

Kitman

25051030         wab.exe         415 KB         UNDER ANALYSIS

solcroft

今天终于让我想通了
Banbra是banker from brazil的意思
而不是禁令乳罩...........

qigang

Banbra=禁令乳罩

真能想得到。

风野胤

原帖由 qigang 于 2008-6-18 22:31 发表
Banbra=禁令乳罩

真能想得到。

banbra=ban  bra=禁令乳罩
。。。。。。。。。。。。。。