ThreatExpert Report: Trojan.MSIL.Agent.rzr, HackTool.MSIL, HackTool:MSIL/Jaktinier.A, Generic..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 14 October 2012, 08:51:05
Processing time: 10 min 37 sec
Submitted sample:

File MD5: 0xFFFF1BDD40CE8C68F5FE96E9742E9787
File SHA-1: 0x4B282F4A6F82C5B87BE12D24CDF85BC8E027BF46
Filesize: 392,879 bytes
Alias:

Trojan.MSIL.Agent.rzr [Kaspersky Lab]
HackTool.MSIL [Ikarus]

Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\njRAT.exe	1,065,472 bytes	MD5: 0x4D005D513B4D1FCD98582935B9BB779A SHA-1: 0x238BCB07692F38F8CC78B8DAE3B8E5A59C184A1D	HackTool:MSIL/Jaktinier.A [Microsoft] HackTool.MSIL [Ikarus]
2	%Temp%\Plugin\cam.dll	64,512 bytes	MD5: 0xCDBADC56FF4F49DB676B3EFF525C1112 SHA-1: 0x77F82FE62EEB737F45889FDD046F78D9B01D376B	Trojan.MSIL.Agent.rzr [Kaspersky Lab] Generic PUP.z!op [McAfee] HackTool:MSIL/Jaktinier.A!plugin [Microsoft] HackTool.MSIL [Ikarus]
3	%Temp%\Plugin\fm.dll	14,336 bytes	MD5: 0xD79AB7D962F7A4415AB5CDABD7B713DE SHA-1: 0x002A63EB2969C0A6002F01BA16DCEDEE9292DC82	Trojan.MSIL.Agent.rzr [Kaspersky Lab] Generic PUP.z!oq [McAfee] HackTool:MSIL/Jaktinier.A!plugin [Microsoft] HackTool.MSIL [Ikarus]
4	%Temp%\Plugin\kl.dll	8,704 bytes	MD5: 0x5E106B219C3FC2008322DF1CEEB2B9C8 SHA-1: 0x74745B2D1B5378BB4CDADC651E53D0A03127CFED	HackTool:MSIL/Jaktinier.A!plugin [Microsoft] HackTool.MSIL [Ikarus]
5	%Temp%\Plugin\proc.dll	10,240 bytes	MD5: 0x96A93B99C77CB368A71E1AE95ED64072 SHA-1: 0x620A3D895462BE7B6A43C150EF5548B65BBDAF4D	Trojan.MSIL.Agent.rzr [Kaspersky Lab] Generic PUP.z!ot [McAfee] HackTool:MSIL/Jaktinier.A!plugin [Microsoft] HackTool.MSIL [Ikarus]
6	%Temp%\Plugin\pw.dll	39,936 bytes	MD5: 0x008E4E04DD4AF5B9F030FF5A083BE411 SHA-1: 0x488695FA64E235239935BBB08EE485FED4E6B9E3	Trojan.Gen.2 [Symantec] Trojan.MSIL.Agent.rzr [Kaspersky Lab] Generic PWS.y!1in [McAfee] HackTool:MSIL/Jaktinier.A!plugin [Microsoft] Trojan-PWS.MSIL [Ikarus]
7	%Temp%\Plugin\sc.dll	13,312 bytes	MD5: 0xDD9DE81A6B3CE967892D4351045362AB SHA-1: 0x4FE4B025899A95A3EC735E684998ED8FE3639B23	Trojan.MSIL.Agent.rzr [Kaspersky Lab] HackTool:MSIL/Jaktinier.A!plugin [Microsoft] HackTool.MSIL [Ikarus]
8	[file and pathname of the sample #1]	392,879 bytes	MD5: 0xFFFF1BDD40CE8C68F5FE96E9742E9787 SHA-1: 0x4B282F4A6F82C5B87BE12D24CDF85BC8E027BF46	Trojan.MSIL.Agent.rzr [Kaspersky Lab] HackTool.MSIL [Ikarus]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directory was created:

%Temp%\Plugin

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes
njRAT.exe	%Temp%\njrat.exe	N/A

Notes:

[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\nj-RAT

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\nj-RAT]

port = "1177"

Other details

The following port was open in the system:

Port	Protocol	Process
1177	TCP	njRAT.exe (%Temp%\njRAT.exe)

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.