Submission Summary:

• Submission details:
• Submission received: 13 July 2012, 14:41:54
• Processing time: 10 min 15 sec
• Submitted sample:
• File MD5: 0x4AE162409F1860617F262351D2CA6410
• File SHA-1: 0x8C69CA28FC14922B098F19F4264A41906863D726
• Filesize: 195,232 bytes
• Alias: PWS-Zbot.gen.ahc [McAfee]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Icfiyz\ymlo.exe	329,376 bytes	MD5: 0x1BB151664AF46028DE4BF4D6ED25C2E0 SHA-1: 0x646A4E03E1D730E15E37896FEBDC8B90671BC849	PWS-Zbot.gen.ahc [McAfee]
2	%AppData%\ozypuj.lio	1,322 bytes	MD5: 0x85E76E0F8C9428BA0EC58A1CCE5B88D5 SHA-1: 0x9B3A2FA79DF19252C58A7318F279E5DF973D9793	(not available)
3	%Temp%\abcd.bat	75 bytes	MD5: 0x0849CFE65B98BA5FCD9A9EC61A671D09 SHA-1: 0x9D0CCB383C32B1BC07FD9064B9324A18E1276902	(not available)
4	%Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe	115,712 bytes	MD5: 0x05E3785997D780474C46C5979E4CED34 SHA-1: 0xF9BB80BA4276DC7649073ECFE1B4DF9B198822CC	Generic PWS.y!1dj [McAfee] Mal/Generic-L [Sophos] Trojan-Dropper.Agent [Ikarus]
5	%Temp%\tmp3fe839da\update.exe	208 bytes	MD5: 0x2F48D1F2F6A5C73A89EB13FC414C15DB SHA-1: 0xB7667E95A11F64DDA440B1EFE7538A904C80D829	(not available)
6	%Temp%\tmp78417699\load.exe %Temp%\tmpda4cd8ad\load.exe	332 bytes	MD5: 0x20F4CC7D3EB7C00575F9BC6576F36D3E SHA-1: 0xC6685FFC4A389811BE85E9856B699513B75EB073	(not available)

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Icfiyz
• %Temp%\tmp0f842646
• %Temp%\tmp3fe839da
• %Temp%\tmp78417699
• %Temp%\tmpda4cd8ad

Memory Modifications

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
cmd.exe	%System%\cmd.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes
heap__approved_id38_lokdart.net_20051.exe	%Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe	278,528 bytes
ymlo.exe	%AppData%\icfiyz\ymlo.exe	278,528 bytes
heap__approved_id38_lokdart.net_20051.exe	%Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes
ntvdm.exe	%System%\ntvdm.exe	278,528 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Qydei
• HKEY_CURRENT_USER\Software\WinRAR

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {3DFA1AE4-115C-AD7B-A6BA-A75086AF8442} = ""%AppData%\Icfiyz\ymlo.exe""

so that ymlo.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Qydei]
• 26511704 = "CAgouWtnfdKh0R29g/LMe9k1"
• 22d7e04a = 0xB958082A
• 5hjgdfi = 26 5A 58 B9 11 52 14 D2 CF D1 69 BD
• 2cb5ea4f = 7B 08 58 B9 19 67 14 D2 CF E1 68 BD E9 F2 FD 65 8D F8 C7 48 47 1E 29 06 82 8C D6 CD 0C ED C6 87 18 56 A3 6D D5 5A C4 BD 61 E0 53 A3 EC 4B 6A DE 1E 0B 6F AD FC C0 9D 41 FE EA 9C 0C 06 56 1E B0 9C 52 11 C2 CD E5 FF A1 65 F8 11 12 C2 79 4C BC 4E 4C 8C B
• 1e358jdj = 7B 08 58 B9 5F F1 14 82 4A 28 B7 C7 DD 61 13 E1 A5 B9 22 F3 03 4C CF 6B 0B 52 42 97 F2 1A C5 CF 34 02 36 43 E4 05 AC 66 48 E0 53 A3 EC 4B 6A DE 1E 0B 6F AD FC C0 9D 41 FE EA 9C A0 D7 EB 80 0B 0C CB 9F 77 61 8C 6A 44 6C 30 4E 4F 4C 00 5B 7C 2D 8D 15 2
• 248dbi5i = 8D C8 F6 95 C8 21 48 EE F4 F2 67 77 C0 57 2A 81 D9 A1 61 2D 97 D9 52 03 A9 C4 14 2B 00 6B 15 42 1E 77 BC 37 0B 2D 8B 9A FC 1A E3 AC DC BB B0 03 ED 5E 6F AD FD C0 9D 51 31 EB 9C A0 AB 79 80 5B 6C B0 E4 E1 4E E7 92 98 DC 27 03 DC F8 C9 EE D9 FA 8D D4 1
• iagce5 = 3C 38 57 B2 66 5D 5C 65 3F 18 FF FA E2 80 F2 7C 30 99 54 56 44 68 C7 A5 D6 FF 37 A4 21 69 A8 B1 BC 67 91 AE F7 E6 44 07 F0 CE D7 68 CE 30 12 1A 69 9B 66 A6 C9 3E 33 EC 7C 5D B1 09 8B 83 DC 07 CD 4E 5C C2 DF 57 21 16 2B 40 36 E1 42 08 50 FE 80 EA 3F 4
• 4a7ajcj = A7 D7 09 54 32 8B E1 EA 06 9E BB 25 6B 4F 73 6E A4 02 86 92 0B 8A 22 40 33 1A D2 41 15 0F 1D 04 23 26 58 37 15 B8 96 2D 09 E4 48 E3 4B 06 81 B1 16 B1 4C 8C E3 14 19 C6 B3 78 97 2F 7E 93 C8 13 64 D9 EC 86 C1 07 33 7D C6 7A 49 AA 40 27 74 1A E4 ED F9 B
• 1212f5c = 7B 08 58 B9 19 67 14 D2 CF D1 69 BD E9 F2 FD 7B F4 52 81 88 3D AE D7 7C AC EF 5C E9 53 E0 01 30 6A 86 50 D6
• f8j91aa = "D55Y6atERQEho4VirHZQ9r4U9ml2n1YD0VIUe2JMmPI4XOg1c2Gp8JW0ZWHsS2reZJ1v/TtHkAxbLIUfB45r98YYpXpmImHlC51XrE5/o1zapKaOAlVFSh2vN7eMJGcbYvyzQZlPEQ7uacRw9g3CwmI2xQ6chvgvjBJ7+i9AvIk4zJfsQsLAAoMvqaGFfXytXvrZb1ud/WKtA3Fr5P3JAhDLPZ7NeTdB"
• [HKEY_CURRENT_USER\Software\WinRAR]
• HWID = 7B 32 33 33 33 31 36 34 36 2D 42 46 39 36 2D 34 42 44 35 2D 39 37 30 46 2D 37 43 31 44 31 44 38 35 38 44 38 35 7D
• Client Hash = 1B 26 26 70 9D BA 7F 9C 62 12 09 80 63 A8 99 C0
• F6BC2E4D1C761766F2F24EBF9274CC61 = 74 72 75 65

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://eurodecor.co.in/images/load.exe
• http://csmju.jowave.com/fusX.exe
• http://etsiunjour.fr/pony/gate.php
• http://infico.radwlan.pl/URYp.exe
• http://tenderbidsupply.com/wp-content/heap__approved_id38_lokdart.net_20051.exe
• http://blog.expozimages.fr/s3UhktD.exe
• http://20percedzes.hu/update.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 81:

• There was an outbound traffic produced on port 10715:

• There was an outbound traffic produced on port 26215:

• There was an outbound traffic produced on port 24062: