ThreatExpert Report: Trojan-PWS.Win32.VKont

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 11 August 2012, 04:35:21
Processing time: 15 min 10 sec
Submitted sample:

File MD5: 0xADB059B0EB94ABB12DBE7AC27329F5E4
File SHA-1: 0x0AA1B8C89B6BF0DE470584B9A5E24114E0CC97CB
Filesize: 2,766,060 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\is-8CGH7.tmp\default.xml	1,201 bytes	MD5: 0x49C5F062A7E465DC4A8FEA5D295B4C63 SHA-1: 0x2C55B30560D0AD569DA2A06E18C6EE9A967A1850	(not available)
2	%Temp%\is-8CGH7.tmp\setup.exe	4,475,904 bytes	MD5: 0x3FB3748A91FA81F28DEA8B7A01981133 SHA-1: 0xB944064567E5DC2F354CDC6FF4F6406EC9B50419	Trojan-PWS.Win32.VKont [Ikarus]
3	%Temp%\is-8CGH7.tmp\_isetup\_iscrypt.dll	2,560 bytes	MD5: 0xA69559718AB506675E907FE49DEB71E9 SHA-1: 0xBC8F404FFDB1960B50C12FF9413C893B56F2E36F	(not available)
4	%Temp%\is-8CGH7.tmp\_isetup\_shfoldr.dll	23,312 bytes	MD5: 0x92DC6EF532FBB4A5C3201469A5B5EB63 SHA-1: 0x3E89FF837147C16B4E41C30D6C796374E0B8E62C	(not available)
5	%Temp%\is-M33UN.tmp\[filename of the sample #1 without extension].tmp	1,166,336 bytes	MD5: 0xABE7F4B9CA2627D3450D0A2D97A3069C SHA-1: 0x018D04BE220103440D4D56BB47897DC96DA82CED	(not available)
6	[file and pathname of the sample #1]	2,766,060 bytes	MD5: 0xADB059B0EB94ABB12DBE7AC27329F5E4 SHA-1: 0x0AA1B8C89B6BF0DE470584B9A5E24114E0CC97CB	(not available)

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%Temp%\is-8CGH7.tmp
%Temp%\is-8CGH7.tmp\_isetup
%Temp%\is-M33UN.tmp

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	196,608 bytes
[filename of the sample #1 without extension].tmp	%Temp%\is-M33UN.tmp\[filename of the sample #1 without extension].tmp	1,216,512 bytes

There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
[filename of the sample #1 without extension].tmp	%Temp%\is-m33un.tmp\[filename of the sample #1 without extension].tmp	172,032 bytes

Other details

To mark the presence in the system, the following Mutex objects were created:

MutexNPA_UnitVersioning_1520
MutexNPA_UnitVersioning_220

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.