Submission Summary:

• Submission details:
• Submission received: 25 October 2012, 09:09:21
• Processing time: 7 min 31 sec
• Submitted sample:
• File MD5: 0x233E74EC2CAB0F1DA7B4A081721572E9
• File SHA-1: 0xC695ADB1B4F6716E4AE5BC43B6397680F177FFEE
• Filesize: 61,440 bytes
• Alias: PWS-Zbot.gen.xy [McAfee]

Technical Details:

File System Modifications

• The following file was created in the system:

Memory Modifications

• There was a new process created in the system:

Other details

• The following Host Name was requested from a host database:
• 192.5.5.241

• The following Internet download was started (the retrieved bits are saved into the local file):

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Downloaded File Summary:

• Download details:
• Download retrieved: 25 October 2012 09:16:53
• Processing time: 7 min 41 sec
• Downloaded sample:
• File MD5: 0xCB0A59F1CA42763A9A1CBC7B813458F3
• File SHA-1: 0x44A56558CF2C9DC2A38F925B2021C4918F3950B5
• Filesize: 259,072 bytes
• Alias: PWS-Zbot.gen.xy [McAfee]

Technical Details:

File System Modifications

• The following files were created in the system:

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Ebkahi
• %AppData%\Feaq
• %AppData%\Unfy

Memory Modifications

• There were new processes created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
cmd.exe	%System%\cmd.exe	245,760 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Pedih

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Okekaxpai = ""%AppData%\Ebkahi\xybi.exe""

so that xybi.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Pedih]
• Wudezu = 86 FC CF CF AF CE 38 E3 EB E8 DF 9D 81 32 CF 5A 86 FC CF CF AF CE 38 E3 EB E8 DF 9D 81 32 CF 5A 86 FC CF CF AF CE 38 E3 EB E8 DF 9D 81 32 CF 5A B6 19 77 CA 25 21 52 57 D6 3A DF 51 66 2C CD 16 86 FC CF CF AF CE 38 E3 EB E8 DF 9D 81 32 CF 5A 86 FC CF C

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex objects were created:
• Local\{647E8AF7-9511-8B5F-1BC5-C5E407159A7E}
• Local\{3E679C82-8364-D146-1BC5-C5E407159A7E}

• The following Internet Connection was established: