ThreatExpert Report: Trojan.Crypt

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 8 September 2012, 04:55:55
Processing time: 7 min 44 sec
Submitted sample:

File MD5: 0xBDF4B5B8D268044DCE184CF897290161
File SHA-1: 0x2602E4570F9A01E0A5F2887A0BC5410C40F2FD2C
Filesize: 87,360 bytes
Alias & packer info:

Trojan.Crypt [Ikarus]
packed with: UPX [Kaspersky Lab]

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	87,360 bytes	MD5: 0xBDF4B5B8D268044DCE184CF897290161 SHA-1: 0x2602E4570F9A01E0A5F2887A0BC5410C40F2FD2C	Trojan.Crypt [Ikarus] packed with UPX [Kaspersky Lab]

The following directory was created:

%AppData%\Spotify

Note:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	184,320 bytes

Other details

Analysis of the file resources indicate the following possible country of origin:

Sweden

To mark the presence in the system, the following Mutex object was created:

Spotify Update Started Interactive Mutex

The data identified by the following URL was then requested from the remote web server:

http://download.spotify.com/SpotifyFullSetup.exe

Downloaded File Summary:

Download details:

Download retrieved: 8 September 2012 05:03:40
Processing time: 8 min 51 sec
Downloaded sample:

File MD5: 0x425B7B58C1F47A8F550745A10D797B53
File SHA-1: 0xC378F636C6C7060358AFB9724168FA24D94E8F7D
Filesize: 17,617,480 bytes
Packer info: packed with: UPX [Kaspersky Lab]

Technical Details:

The new window was created, as shown below:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\Spotify\Data\chrome.pak	2,292,280 bytes	MD5: 0x03184213D65A50D165260DE8D3F558CD SHA-1: 0x7951BB8E761380514A00BA91BCD9A3BD85A860BB
2	%AppData%\Spotify\Data\gnsdk_dsp.dll	213,208 bytes	MD5: 0xF73B0132B5CF9C5672A92388316A1B44 SHA-1: 0xD2ACD9F4B6DBADABC64502798D4CEE2AB7263E20
3	%AppData%\Spotify\Data\gnsdk_musicid_file.dll	286,936 bytes	MD5: 0x939ACF27C4ED76B3A466AB781053C399 SHA-1: 0xCA264AA7C33F582AD4DD8960D78F0D08A1EF0FE5
4	%AppData%\Spotify\Data\gnsdk_sdkmanager.dll	659,672 bytes	MD5: 0xD2CE29CABF687DFC552837711772E366 SHA-1: 0xC9643F2F11FE657A49EB2A554595AFF0E3FF29A6
5	%AppData%\Spotify\Data\icudt.dll	9,953,496 bytes	MD5: 0x88C65BEA4F599FD7080C82F0598BAE9D SHA-1: 0x0FACF0BB95773087E6A626906449FE27B0729DA9
6	%AppData%\Spotify\Data\libcef.dll	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
7	%AppData%\Spotify\Data\locales\en-US.pak	2,798 bytes	MD5: 0x474E298CDC078AD6E1D7E8BC55F1826C SHA-1: 0x7570E510CA7384950D7BA7BC8219C0484F3D4118
8	%AppData%\Spotify\Data\resources.zip	2,128,309 bytes	MD5: 0x35F9C24D12BCE3B61E58FA3D536C0A9E SHA-1: 0x1283D6ED0CE6E5C4271B8F174B618E5ABC85B7A6
9	%AppData%\Spotify\Data\SpotifyWebHelper.exe	1,193,176 bytes	MD5: 0x6411B4ECFFFD47D6872506CF8E2258C6 SHA-1: 0xB0BC86120588D517ACD0BE21A31590B8BB4CBF67
10	%AppData%\Spotify\inst_ver.dat	20 bytes	MD5: 0x77BC2C8697D5D334C10AD48DDDC7BFE0 SHA-1: 0x102BE197F6B5AAF89F7E4E90052EEE4E83A0239D
11	%AppData%\Spotify\spotify.exe	5,576,408 bytes	MD5: 0x0439FEEFE1F2154D68345596521CC5CD SHA-1: 0xAAEEDE4C142BDF3BE599F2420CD531128EBB1ED1
12	%AppData%\Spotify\SpotifyLauncher.exe	114,904 bytes	MD5: 0x86A321A49AFF3EBC7F2B3D288491247A SHA-1: 0xB445FA1D27A4A5826B05B1F42ACB3371BB47D190
13	%DesktopDir%\Spotify.lnk	1,879 bytes	MD5: 0x643089BF72F087CCCB22A735EFAC3B9E SHA-1: 0xFAB4012614CF27DBA480FC865DD7EA1FBE7CEDB3
14	%Programs%\Spotify.lnk	1,885 bytes	MD5: 0xA4923AD2260442811B527650DC65F82B SHA-1: 0x1095817ABC756A3571403B3B5F3C8CFAB9A3F852

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

The following directories were created:

%AppData%\Spotify
%AppData%\Spotify\Data
%AppData%\Spotify\Data\locales

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	184,320 bytes
spotifylauncher.exe	%AppData%\spotify\spotifylauncher.exe	122,880 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spotify

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spotify]

DisplayIcon = "%AppData%\Spotify\Spotify.exe"
DisplayName = "Spotify"
DisplayVersion = "0.8.4.124.ga3559d86"
Version = "0.8.4.124.ga3559d86"
InstallDate = "20120908"
InstallLocation = "%AppData%\Spotify"
NoModify = 0x00000001
NoRepair = 0x00000001
Publisher = "Spotify AB"
UninstallString = ""%AppData%\Spotify\Spotify.exe" /uninstall"
URLInfoAbout = "http://www.spotify.com"

Other details

Analysis of the file resources indicate the following possible country of origin:

Sweden

To mark the presence in the system, the following Mutex objects were created:

Spotify Update Started Interactive Mutex
Spotify Update Started Mutex

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.