- Submission details:
- Submission received: 11 July 2008, 03:45:05
- Processing time: 4 min 48 sec
- Submitted sample:
| What's been found | Severity Level | | Capability to send out email message(s) with the built-in SMTP client engine. |  | | Downloads/requests other files from Internet. | | | Packed with a packer that is known to be used by malware (e.g. to complicate threat analysis or detection). |  | | Contains characteristics of an identified security risk. |  |
Technical Details:
 | Possible Security Risk |
- Attention! Characteristics of the following security risks were identified in the system:
| Security Risk | Description | Trojan-Downloader.Zlob.GEN | Trojan.Downloader.Zlob.GEN is a generic trojan horse that downloads other trojans and attempts to hijack Internet Explorers home page. | | Trojan-Dropper.Agent | Trojan-Dropper.Agent attempts to drop a malicious file and run it on the compromised computer. |
- Attention! The following threat categories were identified:
| Threat Category | Description |  | A program that can be used to hijack certain aspects of users' web browser functionality (such as homepage, search page, and security settings) |  | A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment |
 | File System Modifications |
- The following files were created in the system:
| # | Filename(s) | File Size | File MD5 | Alias | | 1 | c:\mahtesf3.bat | 128 bytes | 0xD31C0557638F79C6BEC32A6918688900 | (not available) | | 2 | %System%\explorer.exe | 1,032,192 bytes | 0xA0732187050030AE399B241436565E64 | (not available) | | 3 | [file and pathname of the sample #1] | 17,296 bytes | 0x4852872A1D42518562438D0C85FBCEB4 | Trojan-Downloader.Zlob.GEN [PCTools]
Trojan.Drondog [Symantec]
New Malware.aj [McAfee] |
- Note:
- %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
 | Memory Modifications |
- There were new processes created in the system:
| Process Name | Process Filename | Main Module Size | | explorer.exe | %System%\explorer.exe | 1,044,480 bytes | | [filename of the sample #1] | [file and pathname of the sample #1] | 208,896 bytes | | czfv.exe | %Windir%\czfv.exe | 73,728 bytes |
 | Other details |
- To mark the presence in the system, the following Mutex object was created:
- The following Host Names were requested from a host database:
- www.google.cn
- www.baidu.com
- The following Internet Connections were established:
| Server Name | Server Port | Connect as User | Connection Password | | www.google.cn | 80 | (null) | (null) | | www.baidu.com | 80 | (null) | (null) |
http://down.nihao29.cn/ko.txt- [oo]
- c0=http://121.14.154.193/1.exe
- c1=http://121.14.154.193/2.exe
- c2=http://121.14.154.193/3.exe
- c3=http://121.14.154.193/4.exe
- c4=http://121.14.154.193/5.exe
- c5=http://121.14.154.193/6.exe
- c6=http://121.14.154.193/7.exe
- c7=http://121.14.154.193/8.exe
- c8=http://121.14.154.193/9.exe
- c9=http://121.14.154.193/10.exe
- c10=http://121.14.154.193/11.exe
- c11=http://121.14.154.193/12.exe
- c12=http://121.14.154.193/13.exe
- c13=http://121.14.154.193/14.exe
- c14=http://121.14.154.193/15.exe
- c15=http://121.14.154.193/16.exe
- c16=http://121.14.154.193/17.exe
- c17=http://121.14.154.193/18.exe
- c18=http://121.14.154.193/19.exe
- c19=http://121.14.154.193/20.exe
- c20=http://121.14.154.194/21.exe
- c21=http://121.14.154.194/22.exe
- c22=http://121.14.154.194/23.exe
- c23=http://121.14.154.194/24.exe
- c24=http://121.14.154.194/25.exe
- c25=http://121.14.154.194/26.exe
- c26=http://121.14.154.194/27.exe
- c27=http://121.14.154.194/28.exe
- c28=http://121.14.154.194/29.exe
- c29=http://121.14.154.194/30.exe
- c30=http://121.14.154.194/31.exe
- c31=http://121.14.154.194/32.exe
- c32=http://121.14.154.194/33.exe
- c33=http://121.14.154.194/34.exe
- c34=http://121.14.154.194/35.exe
- c35=http://121.14.154.194/36.exe
- c36=http://121.14.154.194/37.exe
- c37=http://121.14.154.194/38.exe
- c38=http://121.14.154.194/39.exe
http://2hdahlk3md.cn/9/jx.txt
- [oo]
- c0=http://ssskuki88.cn/inte/dlld1.exe
- c1=http://ssskuki88.cn/inte/dlld2.exe
- c2=http://ssskuki88.cn/inte/dlld3.exe
- c3=http://ssskuki88.cn/inte/dlld4.exe
- c4=http://ssskuki88.cn/inte/dlld5.exe
- c5=http://ssskuki88.cn/inte/dlld6.exe
- c6=http://ssskuki88.cn/inte/dlld7.exe
- c7=http://ssskuki88.cn/inte/dlld8.exe
- c8=http://ssskuki88.cn/inte/dlld9.exe
- c9=http://ssskuki88.cn/inte/dlld10.exe
- c10=http://ssskuki88.cn/inte/dlld11.exe
- c11=http://ssskuki88.cn/inte/dlld12.exe
- c12=http://ssskuki88.cn/inte/dlld13.exe
- c13=http://ssskuki88.cn/inte/dlld14.exe
- c14=http://ssskuki88.cn/inte/dlld15.exe
- c15=http://adwim8812.cn/inte/dlld16.exe
- c16=http://adwim8812.cn/inte/dlld17.exe
- c17=http://adwim8812.cn/inte/dlld18.exe
- c18=http://adwim8812.cn/inte/dlld19.exe
- c19=http://adwim8812.cn/inte/dlld20.exe
- c20=http://adwim8812.cn/inte/dlld21.exe
- c21=http://adwim8812.cn/inte/dlld22.exe
- c22=http://adwim8812.cn/inte/dlld23.exe
- c23=http://adwim8812.cn/inte/dlld24.exe
- c24=http://adwim8812.cn/inte/dlld25.exe
- c25=http://adwim8812.cn/inte/dlld26.exe
- c26=http://adwim8812.cn/inte/dlld27.exe
- c27=http://adwim8812.cn/inte/dlld28.exe
- c28=http://adwim8812.cn/inte/dlld29.exe
- c29=http://adwim8812.cn/inte/dlld30.exe
[ 本帖最后由 tanlimo 于 2008-7-11 21:12 编辑 ] |
[复制链接]
发表于 2008-7-11 01:37:41
楼主
