| Visit Threat Expert web site | | | Close Report |
| What's been found | Severity Level |
| Downloads/requests other files from Internet. |  |
 | File System Modifications |
| # | Filename(s) | Filename Size | Filename MD5 |
| 1 | [file and pathname of the sample #1] | 1,536 bytes | 0x686F00031E198EC9D420E2BBBFBA3455 |
 | Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [filename of the sample #1] | [file and pathname of the sample #1] | 110,592 bytes |
 | Other details |
| Remote IP address | Port Number |
| 208.66.194.215 | 80 |
| What's been found | Severity Level |
| Downloads/requests other files from Internet. | |
| File System Modifications |
| # | Filename(s) | Filename Size | Filename MD5 | Alias |
| 1 | [file and pathname of the sample #1] | 69,632 bytes | 0x7B7D68041AE2E0174AFD76A486AB6556 | Backdoor.Rustock.B [Symantec] |
| # | ADS name(s) | ADS name Size | ADS name MD5 |
| 1 | %Windir%\system32:xpdt.sys | 64,156 bytes | 0x88D44C88381A045172EC08A1FCD07359 |
| Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [filename of the sample #1] | [file and pathname of the sample #1] | 77,824 bytes |
| Process Name | Process Filename | Allocated Size |
| services.exe | %System%\services.exe | 53,248 bytes |
| Driver Name | Driver Filename |
| system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| System Call | Driver name | Driver Filename |
| NtCreateKey | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| NtEnumerateKey | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| NtOpenKey | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| NtQueryKey | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| NtQuerySystemInformation | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
| NtTerminateProcess | system32:xpdt.sys | %Windir%\system32:xpdt.sys |
 | Registry Modifications |
| Other details |
All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("Threat Expert") and may not be copied without the express permission of Threat Expert.
The Information is provided on an "as is" basis. Threat Expert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, Threat Expert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.
Copyright © 2007 Threat Expert. All rights reserved.