ThreatExpert Report: Mal/EncPk-AFP, Backdoor:Win32/Simbot.gen

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 2 August 2012, 19:32:59
Processing time: 9 min 47 sec
Submitted sample:

File MD5: 0x14C2029B8B537245B136B3F9305A9EC3
File SHA-1: 0xC04DA9505EEA558F983C5C2A7EC4159C603ED6C7
Filesize: 36,864 bytes
Alias:

Mal/EncPk-AFP [Sophos]
Backdoor:Win32/Simbot.gen [Microsoft]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	36,864 bytes	MD5: 0x14C2029B8B537245B136B3F9305A9EC3 SHA-1: 0xC04DA9505EEA558F983C5C2A7EC4159C603ED6C7	Mal/EncPk-AFP [Sophos] Backdoor:Win32/Simbot.gen [Microsoft]

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	36,864 bytes

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The data identified by the following URLs was then requested from the remote web server:

http://200.67.116.4:80/xoyqz.php?id=029198121212121212
http://200.67.116.4:443/xoyqz.php?id=022640121212121212
http://200.67.116.4:443/xoyqz.php?id=026218121212121212
http://200.85.152.193:443/xoyqz.php?id=014486121212121212
http://200.85.152.193:443/xoyqz.php?id=018425121212121212
http://200.85.152.193:443/xoyqz.php?id=022928121212121212
http://200.67.116.4:80/jaiav.php?id=000409121212121212
http://200.67.116.4:443/jaiav.php?id=001404121212121212
http://200.67.116.4:443/jaiav.php?id=030683121212121212
http://200.85.152.193:443/jaiav.php?id=028762121212121212
http://200.85.152.193:443/jaiav.php?id=031480121212121212
http://200.85.152.193:443/jaiav.php?id=005626121212121212
http://200.67.116.4:80/gpynw.php?id=010757121212121212
http://200.67.116.4:443/gpynw.php?id=007103121212121212
http://200.67.116.4:443/gpynw.php?id=027857121212121212
http://200.85.152.193:443/gpynw.php?id=030536121212121212
http://200.85.152.193:443/gpynw.php?id=019856121212121212
http://200.85.152.193:443/gpynw.php?id=023970121212121212
http://200.67.116.4:80/jqgav.php?id=026776121212121212
http://200.67.116.4:443/jqgav.php?id=007552121212121212
http://200.67.116.4:443/jqgav.php?id=011950121212121212
http://200.85.152.193:443/jqgav.php?id=007584121212121212
http://200.85.152.193:443/jqgav.php?id=004807121212121212
http://200.85.152.193:443/jqgav.php?id=012555121212121212
http://200.67.116.4:80/ihtgp.php?id=000796121212121212
http://200.67.116.4:443/ihtgp.php?id=012472121212121212
http://200.67.116.4:443/ihtgp.php?id=019079121212121212
http://200.85.152.193:443/ihtgp.php?id=004134121212121212
http://200.85.152.193:443/ihtgp.php?id=021850121212121212
http://200.85.152.193:443/ihtgp.php?id=005624121212121212
http://200.67.116.4:80/xaiwo.php?id=030760121212121212
http://200.67.116.4:443/xaiwo.php?id=011343121212121212
http://200.67.116.4:443/xaiwo.php?id=015524121212121212
http://200.85.152.193:443/xaiwo.php?id=027639121212121212
http://200.85.152.193:443/xaiwo.php?id=018680121212121212
http://200.85.152.193:443/xaiwo.php?id=003386121212121212
http://200.67.116.4:80/wshlv.php?id=007407121212121212
http://200.67.116.4:443/wshlv.php?id=009211121212121212
http://200.67.116.4:443/wshlv.php?id=027882121212121212
http://200.85.152.193:443/wshlv.php?id=031066121212121212
http://200.85.152.193:443/wshlv.php?id=023048121212121212
http://200.85.152.193:443/wshlv.php?id=013042121212121212
http://200.67.116.4:80/eqlvx.php?id=027859121212121212
http://200.67.116.4:443/eqlvx.php?id=021563121212121212
http://200.67.116.4:443/eqlvx.php?id=027387121212121212
http://200.85.152.193:443/eqlvx.php?id=018178121212121212
http://200.85.152.193:443/eqlvx.php?id=031878121212121212
http://200.85.152.193:443/eqlvx.php?id=016353121212121212
http://200.67.116.4:80/dmytk.php?id=031616121212121212
http://200.67.116.4:443/dmytk.php?id=028969121212121212
http://200.67.116.4:443/dmytk.php?id=025125121212121212
http://200.85.152.193:443/dmytk.php?id=015671121212121212
http://200.85.152.193:443/dmytk.php?id=030235121212121212
http://200.85.152.193:443/dmytk.php?id=012434121212121212
http://200.67.116.4:80/qyezt.php?id=025925121212121212
http://200.67.116.4:443/qyezt.php?id=028540121212121212
http://200.67.116.4:443/qyezt.php?id=000080121212121212
http://200.85.152.193:443/qyezt.php?id=029466121212121212
http://200.85.152.193:443/qyezt.php?id=020444121212121212
http://200.85.152.193:443/qyezt.php?id=027487121212121212
http://200.67.116.4:80/hiokz.php?id=019807121212121212
http://200.67.116.4:443/hiokz.php?id=027584121212121212
http://200.67.116.4:443/hiokz.php?id=027163121212121212
http://200.85.152.193:443/hiokz.php?id=025858121212121212
http://200.85.152.193:443/hiokz.php?id=019225121212121212
http://200.85.152.193:443/hiokz.php?id=010847121212121212
http://200.67.116.4:80/lvvwy.php?id=005214121212121212
http://200.67.116.4:443/lvvwy.php?id=020867121212121212
http://200.67.116.4:443/lvvwy.php?id=030250121212121212
http://200.85.152.193:443/lvvwy.php?id=000035121212121212
http://200.85.152.193:443/lvvwy.php?id=005592121212121212
http://200.85.152.193:443/lvvwy.php?id=010124121212121212
http://200.67.116.4:80/idgiw.php?id=025345121212121212
http://200.67.116.4:443/idgiw.php?id=003761121212121212
http://200.67.116.4:443/idgiw.php?id=026411121212121212
http://200.85.152.193:443/idgiw.php?id=002061121212121212
http://200.85.152.193:443/idgiw.php?id=012199121212121212
http://200.85.152.193:443/idgiw.php?id=016013121212121212
http://200.67.116.4:80/qodvj.php?id=001726121212121212
http://200.67.116.4:443/qodvj.php?id=000460121212121212
http://200.67.116.4:443/qodvj.php?id=009717121212121212
http://200.85.152.193:443/qodvj.php?id=010797121212121212
http://200.85.152.193:443/qodvj.php?id=031067121212121212
http://200.85.152.193:443/qodvj.php?id=011898121212121212
http://200.67.116.4:80/dwhlg.php?id=016247121212121212
http://200.67.116.4:443/dwhlg.php?id=000920121212121212
http://200.67.116.4:443/dwhlg.php?id=007163121212121212
http://200.85.152.193:443/dwhlg.php?id=006127121212121212
http://200.85.152.193:443/dwhlg.php?id=014956121212121212
http://200.85.152.193:443/dwhlg.php?id=007903121212121212
http://200.67.116.4:80/vzrtk.php?id=032645121212121212
http://200.67.116.4:443/vzrtk.php?id=017698121212121212
http://200.67.116.4:443/vzrtk.php?id=020171121212121212
http://200.85.152.193:443/vzrtk.php?id=025477121212121212
http://200.85.152.193:443/vzrtk.php?id=003242121212121212
http://200.85.152.193:443/vzrtk.php?id=009714121212121212
http://200.67.116.4:80/uwdrv.php?id=005438121212121212
http://200.67.116.4:443/uwdrv.php?id=018918121212121212
http://200.67.116.4:443/uwdrv.php?id=023943121212121212
http://200.85.152.193:443/uwdrv.php?id=021448121212121212

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.