ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 21 July 2012, 06:56:08
Processing time: 7 min 30 sec
Submitted sample:

File MD5: 0x306F167E88F93A408CCA98C3DA704ED4
File SHA-1: 0x9602DB05BC617AEA0B43D752F5CC4345A298A588
Filesize: 80,384 bytes

Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\updates\updates.exe %Programs%\Startup\updates.exe [file and pathname of the sample #1]	80,384 bytes	MD5: 0x306F167E88F93A408CCA98C3DA704ED4 SHA-1: 0x9602DB05BC617AEA0B43D752F5CC4345A298A588

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

The following directory was created:

%AppData%\updates

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	102,400 bytes
updates.exe	%Programs%\startup\updates.exe	102,400 bytes
updates.exe	%AppData%\updates\updates.exe	204,800 bytes

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

The newly created Registry Values are:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

DHCP = "1166850"
DNS = ""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]

LowRiskFileTypes = ".exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

engel = "%AppData%\updates\updates.exe"

so that updates.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

Ms32Dll

The following ports were open in the system:

Port	Protocol	Process
3128	TCP	[file and pathname of the sample #1]
7049	TCP	[file and pathname of the sample #1]
14857	TCP	updates.exe (%Programs%\startup\updates.exe)

The following Host Names were requested from a host database:

109.160.9.38
208.70.94.147
41.215.8.190
74.213.119.224
190.74.221.96
46.211.181.229
216.36.151.227
2.178.242.197
84.235.47.147
197.220.153.22
190.198.81.219
189.194.212.130
2.133.49.174
189.97.32.152
82.115.17.81
2.184.52.101
50.94.152.35
177.119.93.145
46.225.102.118
80.90.168.131
190.202.244.173
190.11.111.59
87.247.48.48
189.98.171.1
82.205.47.41
95.57.171.46
77.245.6.14
190.220.51.251
95.58.205.137
80.246.0.109
69.137.219.41
177.147.103.133
197.220.153.58
200.90.114.25
76.76.176.88
92.46.214.208
37.58.35.101
84.240.194.4
81.203.5.112
201.223.130.40
46.100.111.146
190.113.196.6
41.223.228.17
201.164.130.251
41.70.172.121
79.127.47.198
196.46.196.3
201.41.32.99
200.66.23.45
201.165.170.209
83.221.191.239
197.6.47.224
61.19.87.222
2.180.97.161
2.50.150.19
201.165.172.24
91.98.16.104
62.84.46.93
177.119.126.78
2.178.244.48
95.59.232.85
201.160.136.179
41.223.57.78
89.78.49.179
82.200.168.67
41.188.138.77
123.238.71.233
84.54.103.195
115.252.191.187
93.116.4.98
189.194.249.188
84.228.82.170
95.57.66.58
2.178.188.123
201.172.80.156
200.56.140.21
201.222.102.3
109.229.170.12
190.128.5.11
200.82.151.138
77.127.66.117
95.93.21.223
221.120.237.99
84.94.73.193
201.164.177.131
78.90.129.176
187.185.211.236
77.125.2.199
95.59.2.148
2.185.218.191
187.91.209.197
75.179.134.187
190.73.76.71
95.57.29.196
200.119.4.10
37.99.108.37
85.133.247.38
41.204.80.95
201.248.99.55
201.243.151.93

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
200.66.23.45	3128
85.130.81.228	3128
84.54.93.115	3128
2.176.217.230	3128

Outbound traffic (potentially malicious)

Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

POST /?b1efe2f4a2efe5e2e6ebf4a7efe3e2e3f4a4efe1e7e 7e7f4b0efe2f4b6efe3f4a1efe3e3e4e4eae7e2f4b5efbbbcb ba6f4a4e3efe7f4a4e0efe3f4a4e1efe0e4e2e2f4a4b0efe1e 0f4a4a7efe2f4a0a0efe3f4bea0efe3f4b7bbefbdb9f2f4b7e fb1e88ea5bbbcb6bda5a18ea1aba1a6b7bfe1e08ea1b3bfa2b..
Accept-Language: en-us
..POST /?f2aca0b7e1aca6a1a5a8b7e4aca0a1a0b7e7aca2a 4a4a4b7f3aca1b7f5aca0b7e2aca0a0a7a7a9a4a1b7f6acf8f ff8e5b7e7a0aca4b7e7a3aca0b7e7a2aca3a7a1a1b7e7f3aca 2a3b7e7e4aca1b7e3e3aca0b7fde3aca0b7f4f8acfefab1b7f 4acf2abcde6f8fff5fee6e2cde2e8e2e5f4fca2a3cde2f0fce..
Accept: */*
Accept-Lang..POST /?550b0410460b0106020f10430b0706 0710400b0503030310540b0610520b0710450b070700000e03 0610510b5f585f421040070b031040040b071040050b040006 061040540b05041040430b061044440b07105a440b0710535f 0b595d1610530b550c6a415f58525941456a454f4542535b05..
UA-CPU: x86..POST /?8fd1dfca9cd1dbdcd8d5ca99d1dddc ddca9ad1dfd9d9d9ca8ed1dcca88d1ddca9fd1dddddadad4d9 dcca8bd185828598ca9addd1d9ca9aded1ddca9adfd1dedadc dcca9a8ed1dfdeca9a99d1dcca9e9ed1ddca809ed1ddca8985 d18387ccca89d18fd6b09b858288839b9fb09f959f988981df..
Accept-Lang..POST /?104e4755034e4443474a55064e4243 4255054e4046464655114e4355174e4255004e424245454b46 4355144e1a1d1a075505424e465505414e425505404e414543 435505114e40415505064e435501014e42551f014e4255161a 4e1c185355164e10492f041a1d171c04002f000a0007161e40..
Accept-Lang..POST /?7a242c3f69242e292d203f6c242829 283f6f242a2c2c2c3f7b24293f7d24283f6a2428282f2f212c 293f7e247077706d3f6f28242c3f6f2b24283f6f2a242b2f29 293f6f7b242a2b3f6f6c24293f6b6b24283f756b24283f7c70 247672393f7c247a23456e70777d766e6a456a606a6d7c742a..
Accept-Lang..POST /?bce2e9f9afe2e8efebe6f9aae2eeef eef9a9e2eceaeaeaf9bde2eff9bbe2eef9ace2eeeee9e9e7ea eff9b8e2b6b1b6abf9a9eee2eaf9a9ede2eef9a9ece2ede9ef eff9a9bde2ecedf9a9aae2eff9adade2eef9b3ade2eef9bab6 e2b0b4fff9bae2bce583a8b6b1bbb0a8ac83aca6acabbab2ec..
Accept-Lang..POST /?7d2329386e23292e2a27386b232f2e 2f3868232d2b2b2b387c232e387a232f386d232f2f2828262b 2e3879237770776a38682f232b38682c232f38682d232c282e 2e38687c232d2c38686b232e386c6c232f38726c232f387b77 2371753e387b237d24426977707a71696d426d676d6a7b732d..
..POST /?3d6366782e63696e6a67782b636f6e6f7828636d6 b6b6b783c636e783a636f782d636f6f6868666b6e783963373 0372a78286f636b78286c636f78286d636c686e6e78283c636 d6c78282b636e782c2c636f78322c636f783b376331357e783 b633d64022937303a31292d022d272d2a3b336d6c022d3f332..
UA-CPU: x86..POST /?07595d4214595354505d4211595554 55421259575151514206595442005955421759555552525c51 544203590d0a0d104212555951421256595542125759565254 5442120659575642121159544216165955420816595542010d 590b0f44420159075e38130d0a000b131738171d1710010957..
Accept-Lang..POST /?39676b6a7c2a676d6a6e637c2f676b 6a6b7c2c67696f6f6f7c38676a7c3e676b7c29676b6b6c6c62 6f6a7c3d673334332e7c2c6b676f7c2c68676b7c2c6967686c 6a6a7c2c386769687c2c2f676a7c2828676b7c3628676b7c3f 336735317a7c3f673960062d33343e352d29062923292e3f37..
Accept-La..

There was an outbound traffic produced on port 3128:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.