ThreatExpert Report: Trojan-PWS.Keylogger

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 6 September 2012, 16:28:33
Processing time: 10 min 24 sec
Submitted sample:

File MD5: 0xB7054358AD1AD7B22530E2DA5A6052FE
File SHA-1: 0x91BFA11719017F1CC84BDE6E585133D30E3161C1
Filesize: 31,232 bytes
Alias: Trojan-PWS.Keylogger [Ikarus]

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\%ComputerName%\AppData\%ComputerName%.exe	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41	(not available)
2	[file and pathname of the sample #1]	31,232 bytes	MD5: 0xB7054358AD1AD7B22530E2DA5A6052FE SHA-1: 0x91BFA11719017F1CC84BDE6E585133D30E3161C1	Trojan-PWS.Keylogger [Ikarus]

Note:

%ComputerName% is a variable that refers to the current computer name.

The following directories were created:

c:\%ComputerName%
c:\%ComputerName%\AppData

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	N/A

Other details

The following ports were open in the system:

Port	Protocol	Process
1033	TCP	[file and pathname of the sample #1]
1035	TCP	[file and pathname of the sample #1]
1037	UDP	[file and pathname of the sample #1]

The following Host Names were requested from a host database:

192.5.5.241
wpad.mrc.pctools.com.
websysdown12.oost4u.com

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
192.5.5.241	1034

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
www.google.com.br	443	(null)	(null)

The following GET request was made:

wpad.dat

The following HTTP URL was started reading:

http://websysdown12.oost4u.com/03/drafaela.txt

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 443:

Downloaded File Summary:

Download details:

Download retrieved: 6 September 2012 16:38:58
Processing time: 8 min 32 sec
Downloaded sample:

File MD5: 0x4F03A9B833E13D85B11D08FC194B276E
File SHA-1: 0x46A3BA46FC821FB019B207D0158EDD475915640D
Filesize: 142,336 bytes

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	[file and pathname of the sample #1]	142,336 bytes	MD5: 0x4F03A9B833E13D85B11D08FC194B276E SHA-1: 0x46A3BA46FC821FB019B207D0158EDD475915640D

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	N/A

Other details

The following Host Name was requested from a host database:

192.5.5.241

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.