ThreatExpert Report: Infostealer.Banker.C, Spy-Agent.cj.gen.i, PWS:Win32/Zbot.gen!B..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 1 August 2012, 13:15:11
Processing time: 11 min 46 sec
Submitted sample:

File MD5: 0xC27FE7DA91B1DD898E81D3051C241E5F
File SHA-1: 0x62E558D50C6B6E937570521468D79F458C74D76F
Filesize: 542,208 bytes
Alias:

Infostealer.Banker.C [Symantec]
Spy-Agent.cj.gen.i [McAfee]
PWS:Win32/Zbot.gen!B [Microsoft]
Trojan-Spy.Wsnpoem.S [Ikarus]
Win32/IRCBot.worm.variant [AhnLab]

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\ntos.exe	1,063,424 bytes	MD5: 0xEAC12D40583CECD8A4E2A8CAA3E760FA SHA-1: 0x1D30C82C17E1681EB9FF0DCC71F9E97AFEB2EBB9	Infostealer.Banker.C [Symantec] Spy-Agent.cj.gen.i [McAfee] PWS:Win32/Zbot.gen!B [Microsoft] Trojan-Spy.Wsnpoem.S [Ikarus] Win32/IRCBot.worm.variant [AhnLab]
2	[file and pathname of the sample #1]	542,208 bytes	MD5: 0xC27FE7DA91B1DD898E81D3051C241E5F SHA-1: 0x62E558D50C6B6E937570521468D79F458C74D76F	Infostealer.Banker.C [Symantec] Spy-Agent.cj.gen.i [McAfee] PWS:Win32/Zbot.gen!B [Microsoft] Trojan-Spy.Wsnpoem.S [Ikarus] Win32/IRCBot.worm.variant [AhnLab]
3	%System%\wsnpoem\audio.dll	101 bytes	MD5: 0x27B66A0AF08F9C310E28C0013CE78713 SHA-1: 0x8F13A4C00AB3D39835AD903DFD823C4193CA0DD2	(not available)
4	%System%\wsnpoem\video.dll	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%System%\wsnpoem

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	139,264 bytes

Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]

UID = "%ComputerName%_00018112"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer]

{F710FA10-2031-3106-8872-93A2B5C5C620} = F7 09 F2 0D

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Userinit =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies =
Cache =
History =

Other details

To mark the presence in the system, the following Mutex objects were created:

__SYSTEM__91C38905__
__SYSTEM__23D80F10__
5DDC64FA01CD7022000000E02

The data identified by the following URL was then requested from the remote web server:

http://www.botsys.net:8080/globalpay/globalpay/www.globalpay.co.uk/images/au/cfg.bin

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.