Submission Summary:

What's been foundSeverity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

 

Technical Details:

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 %AppData%\Icfiyz\ymlo.exe 329,376 bytes MD5: 0x1BB151664AF46028DE4BF4D6ED25C2E0
SHA-1: 0x646A4E03E1D730E15E37896FEBDC8B90671BC849
PWS-Zbot.gen.ahc [McAfee]
2 %AppData%\ozypuj.lio 1,322 bytes MD5: 0x85E76E0F8C9428BA0EC58A1CCE5B88D5
SHA-1: 0x9B3A2FA79DF19252C58A7318F279E5DF973D9793
(not available)
3 %Temp%\abcd.bat 75 bytes MD5: 0x0849CFE65B98BA5FCD9A9EC61A671D09
SHA-1: 0x9D0CCB383C32B1BC07FD9064B9324A18E1276902
(not available)
4 %Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe 115,712 bytes MD5: 0x05E3785997D780474C46C5979E4CED34
SHA-1: 0xF9BB80BA4276DC7649073ECFE1B4DF9B198822CC
Generic PWS.y!1dj [McAfee]
Mal/Generic-L [Sophos]
Trojan-Dropper.Agent [Ikarus]
5 %Temp%\tmp3fe839da\update.exe 208 bytes MD5: 0x2F48D1F2F6A5C73A89EB13FC414C15DB
SHA-1: 0xB7667E95A11F64DDA440B1EFE7538A904C80D829
(not available)
6 %Temp%\tmp78417699\load.exe
%Temp%\tmpda4cd8ad\load.exe
332 bytes MD5: 0x20F4CC7D3EB7C00575F9BC6576F36D3E
SHA-1: 0xC6685FFC4A389811BE85E9856B699513B75EB073
(not available)

 

Memory Modifications

Process NameProcess FilenameAllocated Size
cmd.exe%System%\cmd.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes
heap__approved_id38_lokdart.net_20051.exe%Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe278,528 bytes
ymlo.exe%AppData%\icfiyz\ymlo.exe278,528 bytes
heap__approved_id38_lokdart.net_20051.exe%Temp%\tmp0f842646\heap__approved_id38_lokdart.net_20051.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes
ntvdm.exe%System%\ntvdm.exe278,528 bytes

 

Registry Modifications

 

Other details

Remote HostPort Number
103.1.115.15780
122.155.18.5080
188.165.114.12080
50.97.97.13280
92.243.12.15880
94.199.180.7080
176.31.255.4181
46.49.95.10410715
67.240.14.6526215
71.67.112.14024062

 

Outbound traffic (potentially malicious)

 

 

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2014 ThreatExpert. All rights reserved.