| |
| | Drops | Processes |
|---|
msnmanegers.exe (100%)
cmd.exe (61%)
csrss.exe (61%)
explorer.exe (61%)
lsass.exe (61%)
services.exe (61%)full list | msnmanegers.exe (99%)
cmd.exe (61%)
csrss.exe (61%)
explorer.exe (61%)
lsass.exe (61%)
services.exe (61%)full list |
|
| | Snort IDs | Snort Egg IDs | Snort Outbound IDs |
|---|
1:1390:5 (78%)
1:2001944:3 (78%)
1:99998:2 (78%)
1:3003:4 (76%) | 1:3000006:99 (97%)
1:2001684:3 (78%) | 555:5555005:1 (100%)
1:2001569:11 (93%) |
|
| | Registry keys | Registry values |
|---|
...currentversion/runservices (100%)
...currentversion/runonce (62%)
...currentversion/runonce (62%)
...currentversion/run (38%)full list | hotefix (100%) |
|
| | DNS Lookups | Failed connections | C & C IPs |
|---|
CN:hail.dns2go.com (74%)
CN:scorti1.dns2go.com (61%) | CN:211.96.97.44:7000 (57%) | 211.96.97.44:7000 (59%)
222.177.11.165:7000 (22%)
209.250.232.240:7000 (10%)
210.217.196.11:7000 (6%) |
|
| | FTP chatter | HTTP chatter | IRC chatter |
|---|
exec=msnmanegers.exe (100%)
user=a (100%)
pass=a (64%)
pass=saad (31%) | - | - |
|
| | Antivirus labels | Packed MD5 | Unpacked MD5 |
|---|
sophos (100%)
webwasher (100%)
kaspersky (96%)
ikarus (95%)
spybot (94%)
drweb (93%)full list | 5f78ff... (78%) diversity: 14.4%
full list | d4a06b... (78%) diversity: 0.8%
full list |
|
