Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =67e8c3a59deb2cea68bb4beac29d9d7d

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
67e8c3a59deb2cea68bb4beac29d9d7d	d2048768230d65bac387c72cafabf523e92317b1	34ab30706bff64f5a692ce6999a06fba6be3c711648f1f5caae586580a16462a	6144:+8U2qy6rRZb7jxGYKSTJQBF2WQQQFZ0jC5W:gzy6rRxErBF2cQF15W	227437

File Name
1289125%5Fx352fsd.640x480.exe

Snort Class	Snort Alert	Count
A Network Trojan was Detected	SPYWARE-PUT Trojan.Win32.Karagany.A contact to server attempt	1
Misc Attack	ET RBN Known Russian Business Network IP TCP (62)	1

AV Alert	AV Vendor

Path	Folder Name
c:/Documents and Settings/dmc73144/Application Data/Adobe	plugs
c:/Documents and Settings/dmc73144/Application Data/Adobe	shed
c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	MSHist012011051720110518

Path	File Name
c:/Documents and Settings/dmc73144/Application Data/Adobe	adb.cer
c:/Documents and Settings/dmc73144/Application Data/Adobe	AdobeUtil .exe
c:/Documents and Settings/dmc73144/Application Data/Adobe	AdobeUtil.exe
c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5/MSHist012011051720110518	index.dat
c:/Documents and Settings/dmc73144/Recent	127014_128820_f_640x480.jpg.lnk
c:/Documents and Settings/dmc73144/Recent	dmc73144.lnk
c:/Documents and Settings/dmc73144/Start Menu/Programs/Startup	AdbUpd.lnk
c:/Documents and Settings/dmc73144	127014_128820_f_640x480.jpg
c:/Documents and Settings/dmc73144	blank
c:/Documents and Settings/dmc73144	err.log128625
c:/Documents and Settings/dmc73144	file.exe
c:/Documents and Settings/dmc73144	rnm.exe
c:/Documents and Settings/dmc73144	source
c:/Documents and Settings/dmc73144	start.exe
c:/WINDOWS/Prefetch	ADOBEUTIL.EXE-27EA9B9F.pf
c:/WINDOWS/Prefetch	AUTOIT3.EXE-32361418.pf
c:/WINDOWS/Prefetch	B2E.EXE-0B089C36.pf
c:/WINDOWS/Prefetch	CHCP.COM-18156052.pf
c:/WINDOWS/Prefetch	DIEP.EXE-0B3E1DC8.pf
c:/WINDOWS/Prefetch	FILE.EXE-1FD3EFA4.pf
c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
c:/WINDOWS/Prefetch	REGSHOT.EXE-010A5EE6.pf
c:/WINDOWS/Prefetch	RNM.EXE-04823DAF.pf
c:/WINDOWS/Prefetch	RUNDLL32.EXE-4536E703.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/Prefetch	START.EXE-26A0271A.pf
c:/WINDOWS/system32/drivers/etc	hlsts
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	ATTRIB.EXE-39EAFB02.pf
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	NTOSBOOT-B00DFAAD.pf
modified	c:/WINDOWS/Prefetch	SCP.EXE-174845DC.pf
modified	c:/WINDOWS/Prefetch	SENDIT.EXE-34C997E3.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/Prefetch	WUAUCLT.EXE-399A8E72.pf
modified	c:/WINDOWS	SchedLgU.Txt
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.chk
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	3C 01 42 4A F5 13 48 93 85 8E 0D 6B CD F7 2A A1 03 58 56 78 CE AD F3 F3 18 C5 4B	74 42 11 4B A9 B5 0F 4A 57 9B 14 D2 CA C4 A2 7E 15 93 95 54 4A DB 09 62 C7 65 9
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs	MRUListEx	03 00 00 00 02 00 00 00 00 00 00 00 08 00 00 00 07 00 00 00 06 00 00 00 05 00 00	0A 00 00 00 09 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 08 00 00 00 07 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Explorer/RecentDocs/Folder	MRUListEx	01 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF	04 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000003

DNS	DNS Response
adobe.com	Standard query response A 192.150.16.117
data-fold.org	Standard query response A 193.107.16.43

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
192.150.16.117	adobe.com	/geo/productid.php	Opera/10.80 Pesto/2.2.30	0x06
193.107.16.43	data-fold.org	/kadabra/xgate.php	Opera/10.60 Presto/2.2.30	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	10	8	953	1030
17	1	0	175	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	10	8	953	1030
1900	17	1	0	175	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
12:36:13	2011-05-17	6	10.10.10.7	192.150.16.117	->	e	31	80	9	989
12:36:15	2011-05-17	6	10.10.10.7	193.107.16.43	->	e	63	80	9	994
12:41:38	2011-05-17	17	10.10.10.7	239.255.255.250	->	e	8	1900	1	175

Packer Name

Honey Trap Log File Location

PTFB Log File Location