Submission Summary:

What's been foundSeverity Level
Downloads/requests other files from Internet.

 

Technical Details:

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 %System%\AMgFathxV.dll 125 bytes MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415
SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41
(not available)
2 [file and pathname of the sample #1] 26,112 bytes MD5: 0x2D06C9392BE97877E09DC2F60CC1C629
SHA-1: 0x9838E1F02C18AEA907A212E4F15210ACDB5210AD
Trojan-Downloader.Win32.Banload [Ikarus]
packed with PE_Patch.PECompact [Kaspersky Lab]

 

Memory Modifications

Process NameProcess FilenameMain Module Size
[generic host process][generic host process filename]20,480 bytes

Module NameModule FilenameAddress Space Details
[filename of the sample #1][file and pathname of the sample #1]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0x3E0000 - 0x3F2000

 

Other details

China

Remote HostPort Number
192.5.5.2411033

Server NameServer PortConnect as UserConnection Password
www.go890.com80(null)(null)

 

 

Downloaded File Summary:

What's been foundSeverity Level
Downloads/requests other files from Internet.

 

Technical Details:

 

File System Modifications

 

Memory Modifications

Process NameProcess FilenameMain Module Size
[generic host process][generic host process filename]20,480 bytes

Module NameModule FilenameAddress Space Details
[filename of the sample #1][file and pathname of the sample #1]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0xB10000 - 0xC91000

 

Registry Modifications

 

Other details

Remote HostPort Number
192.5.5.2411038

Server NameServer PortConnect as UserConnection Password
www.haosou.com80(null)(null)

 

 

Downloaded File Summary (Generation #2):

 

Technical Details:

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 [file and pathname of the sample #1] 126,464 bytes MD5: 0x89D67CAA050C7CDCD0D25617570C5100
SHA-1: 0xAB8F493FDA42F2CD688B594D23E2831304D45CDE
packed with UPX [Kaspersky Lab]
2 [file and pathname of the sample #2] 132,608 bytes MD5: 0x158B710A2CE07E3A34E46118F2AD39F2
SHA-1: 0x89F2E5298DE9484387273D7AAA3128DC3708E978
packed with UPX [Kaspersky Lab]

 

Memory Modifications

Process NameProcess FilenameMain Module Size
[generic host process][generic host process filename]20,480 bytes

Module NameModule FilenameAddress Space Details
[filename of the sample #1][file and pathname of the sample #1]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0xB10000 - 0xB4A000
[filename of the sample #2][file and pathname of the sample #2]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0xB10000 - 0xB4C000

 

Other details

China

 

 

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2017 ThreatExpert. All rights reserved.