**** Malware_Report_-_Results **** This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection. Malware Search Criteria: MD5 =80427b754b11de653758dd5e1ba3de1c **** Malware_Report_-_Results **** _____________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |File_MD5Sum_____________________|SHA1SUM_________________________________|SHA256SUM_______________________________________________________|FUZZY_HASH______________________________________________________________________|File_Size| |80427b754b11de653758dd5e1ba3de1c|554e1331fdc050bd603f6f3628285008a91cba37|5b0dd1aa5e1f84d044ac2c381a78144b988cd6d314a9b0ebc862449e9343f499|384:KeDE19UDclcuPFFCl0k47fEb/i8xZT1vZS37SCyNS/iPZpf4bacPXkKh9QPpdmx+:nDAUDctFCl0|24576____| **** File_Results **** __________________________________________ |File_Name_________________________________| |yourbot.exe_______________________________| |wsc.exe___________________________________| |load.php%3Fspl%3Dmdac%5F3%26h%3D.exe______| |load.php%3Fspl%3Dmdac%5F3%26amp%3Bh%3D.exe| |load.exe__________________________________| |exe.exe___________________________________| |de.exe____________________________________| |bot.exe___________________________________| |723.exe___________________________________| **** SNORT_Results **** ___________________________________________ |Snort_Class|Snort_Alert______________|Count| |N/A________|No_snort_alerts_generated|0____| **** AV_Results **** _____________________________________ |AV_Alert___________________|AV_Vendor| |Trojan.FakeAV______________|Symantec_| |Generic.dx!pnl_____________|McAfee___| |Net-Worm.Win32.Koobface.fxb|Kaspersky| **** Folders_(Added)_-_ICC_Results **** ________________ |Path|Folder_Name| **** Files_(Added)_-_ICC_Results **** ___________________________________________ |Path_______________|File_Name______________| |c:/WINDOWS/Prefetch|SANDNET.EXE-2012C478.pf| |c:_________________|netstat_post.txt_______| |c:_________________|taskv_post.txt_________| |c:/WINDOWS/Prefetch|SANDNET.EXE-2012C478.pf| |c:_________________|netstat_post.txt_______| |c:_________________|taskv_post.txt_________| |c:/WINDOWS/Prefetch|AUTOIT3.EXE-32361418.pf| |c:/WINDOWS/Prefetch|DIEP.EXE-0B3E1DC8.pf___| |c:/WINDOWS/Prefetch|HSTART.EXE-221D72BF.pf_| |c:/WINDOWS/Prefetch|REGSHOT.EXE-010A5EE6.pf| |c:/WINDOWS/Prefetch|SANDNET.EXE-2012C478.pf| |c:_________________|netstat_post.txt_______| |c:_________________|taskv_post.txt_________| |c:_________________|netstat_post.txt_______| |c:_________________|tasksvc_post.txt_______| |c:_________________|taskv_post.txt_________| **** Files_(Deleted)_-_ICC_Results **** _____________________ |Action|Path|File_Name| **** Files_(Changed)_-_ICC_Results **** ________________________________________________________________________________ |Action__|Path__________________________________________|File_Name_______________| |modified|c:/WINDOWS/Prefetch___________________________|ATTRIB.EXE-39EAFB02.pf__| |modified|c:/WINDOWS/Prefetch___________________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________________|HSTART.EXE-221D72BF.pf__| |modified|c:/WINDOWS/Prefetch___________________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/system32/drivers/etc_______________|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|OBJECTS.MAP_____________| |modified|c:/WINDOWS/Prefetch___________________________|ATTRIB.EXE-39EAFB02.pf__| |modified|c:/WINDOWS/Prefetch___________________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________________|HSTART.EXE-221D72BF.pf__| |modified|c:/WINDOWS/Prefetch___________________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/system32/drivers/etc_______________|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Logs_________________|wmiprov.log_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|OBJECTS.MAP_____________| |modified|c:/WINDOWS/Prefetch___________________________|ATTRIB.EXE-39EAFB02.pf__| |modified|c:/WINDOWS/Prefetch___________________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________________|NTOSBOOT-B00DFAAD.pf____| |modified|c:/WINDOWS/Prefetch___________________________|SCP.EXE-174845DC.pf_____| |modified|c:/WINDOWS/Prefetch___________________________|SENDIT.EXE-34C997E3.pf__| |modified|c:/WINDOWS/Prefetch___________________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________________|SLEEP.EXE-094A3D2A.pf___| |modified|c:/WINDOWS/Prefetch___________________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/Prefetch___________________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/Prefetch___________________________|WUAUCLT.EXE-399A8E72.pf_| |modified|c:/WINDOWS____________________________________|SchedLgU.Txt____________| |modified|c:/WINDOWS/SoftwareDistribution/DataStore/Logs|edb.chk_________________| |modified|c:/WINDOWS/system32/drivers/etc_______________|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|OBJECTS.MAP_____________| |modified|c:/WINDOWS/Prefetch___________________________|ATTRIB.EXE-39EAFB02.pf__| |modified|c:/WINDOWS/Prefetch___________________________|CMD.EXE-087B4001.pf_____| |modified|c:/WINDOWS/Prefetch___________________________|NETSTAT.EXE-2B2B4428.pf_| |modified|c:/WINDOWS/Prefetch___________________________|SANDNET.EXE-2012C478.pf_| |modified|c:/WINDOWS/Prefetch___________________________|SH.EXE-00254D2B.pf______| |modified|c:/WINDOWS/Prefetch___________________________|SSHD.EXE-298CA236.pf____| |modified|c:/WINDOWS/Prefetch___________________________|SWITCH.EXE-0496EC21.pf__| |modified|c:/WINDOWS/Prefetch___________________________|TASKLIST.EXE-10D94B23.pf| |modified|c:/WINDOWS/Prefetch___________________________|WMIPRVSE.EXE-28F301A9.pf| |modified|c:/WINDOWS/system32/drivers/etc_______________|hosts___________________| |modified|c:/WINDOWS/system32/wbem/Logs_________________|wmiprov.log_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|INDEX.MAP_______________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING.VER_____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|MAPPING2.MAP____________| |modified|c:/WINDOWS/system32/wbem/Repository/FS________|OBJECTS.MAP_____________| **** Registry_Keys_(Added)_-_ICC_Results **** ___________ |Action|Path| **** Registry_Values_(Added)_-_ICC_Results **** _____________________________ |Action|Path|Val_Name|Val_Data| **** Registry_Values_(Deleted)_-_ICC_Results **** ________________________________________________________________ |Action|Path|Val_Name|Val_Type|Mod_Val_Type|Val_Data|Mod_Val_Data| **** Registry_Values_(Changed)_-_ICC_Results **** __________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ |Action__|Path_______________________________________________________________|Val_Name____|Val_Data________________________________________________________________________|Mod_Val_Data___________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|12_5A_BC_39_09_DA_BC_1D_F7_7D_E4_B6_30_13_79_BD_28_72_9C_1C_85_D6_78_6B_E3_65_C3|93_9F_E8_C3_B4_80_91_8A_BA_29_A9_8B_81_5A_4F_A1_1C_8E_FD_E1_E0_D3_32_4B_F1_17_6| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|2F_56_3C_A3_F7_D9_D4_7E_CF_81_FF_29_8E_A7_5A_03_67_33_27_2E_0C_69_18_3E_F3_B1_89|E6_D6_1F_AD_5C_6F_A8_F4_9D_04_5F_AE_A4_E8_32_60_C6_A7_B5_22_47_59_5A_4B_9A_10_7| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|B4_8A_C8_7D_ED_F5_7F_B4_F2_52_49_B6_4E_96_CF_5D_80_A8_91_E2_C1_E9_32_F7_35_10_4D|8E_4A_0D_06_BB_DF_F4_7A_9A_45_D6_72_79_59_64_34_9F_6E_08_5A_88_5E_71_DC_DA_36_C| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| |modified|HKLM/SOFTWARE/Microsoft/Cryptography/RNG___________________________|Seed________|E8_26_5A_97_49_98_E7_3A_70_5E_E3_5F_5C_2A_5E_4B_C1_B2_4A_C5_07_91_7A_7F_3A_DF_46|96_B6_DA_1A_13_7E_CE_5D_19_97_0B_86_1C_B9_23_39_71_A6_05_B9_FA_77_61_46_03_C7_6| |modified|HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation|ProgramCount|0x00000002______________________________________________________________________|0x00000001_____________________________________________________________________| **** DNS_Results **** ________________ |DNS|DNS_Response| **** URL_Results **** ______________________________________________________________________________ |DstIP__________|HTTP_HOST___________|HTTP_REQUEST_URI|HTTP_USER_AGENT|PROTOCOL| |239.255.255.250|239.255.255.250:1900|*_______________|--blank--______|0x11____| **** ARGUS_PROTOCOL_Results **** ______________________________________________ |PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| |17______|2_______|0_______|350______|0________| **** ARGUS_DPORT_Results **** ____________________________________________________ |DPORT|PROTOCOL|SRC_PKTS|DST_PKTS|SRC_BYTES|DST_BYTES| |1900_|17______|2_______|0_______|350______|0________| **** ARGUS_DATA_Results **** ________________________________________________________________________________________ |Time____|Date______|Protocol|SrcIP_____|DstIP__________|Dir|Flags|Sport|Dport|Pkts|Bytes| |09:18:32|2010-07-28|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |00:38:54|2010-07-30|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |19:18:48|2010-07-30|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| |14:28:12|2010-08-30|17______|10.10.10.7|239.255.255.250|->_|e____|8____|1900_|2___|350__| **** Packer_Results **** ___________ |Packer_Name| **** HoneyTrap_Results **** ____________________________ |Honey_Trap_Log_File_Location| **** PTFB_Results **** ______________________ |PTFB_Log_File_Location|