Packed MD5	1fcc146d70a0ba85245db16c4b793f5d
Priority	7
First	03/01/2008
Last	08/26/2008
Count	33
History	33 hits: 01-02 to 08-26
Unpacked MD5	258fafe8925a16c68fccfd783b5b73d6
AV Hits	29
AV Count	32
CC Servers	194.54.90.246:80
DNS Lookups	UA:citi-bank.ru
Failed Connects	UA:194.54.90.246:80
AV Name	AhnLab-V3:Korgo.9359.C, AntiVir:Rand, Authentium:Korgo.Z, Avast:_Korgo-AC, AVG:Padobot.AA, BitDefender:Korgo.AC, CAT-QuickHeal:Korgo.AC, ClamAV:Korgo.AJ, DrWeb:Lsabot, eSafe:Korgo.ac, eTrust-Vet:Korgo.AC, Ewido:Dropper.Paradrop.a, FileAdvisor:MISSED, Fortinet:Korgo.AC!worm, F-Prot:Korgo.Z, F-Secure:MISSED, Ikarus:Korgo.AC, Kaspersky:Padobot.gen, McAfee:Korgo.ac, Microsoft:Korgo.H, NOD32v2:Korgo.AA, Norman:Malware.JWK, Panda:Korgo.AH.worm, Prevx1:MISSED, Rising:MISSED, Sophos:Korgo-U, Sunbelt:Korgo, Symantec:Korgo.Z, TheHacker:Korgo(2).gen.pack, VBA32:Padobot.gen, VirusBuster:Korgo.AC, Webwasher-Gateway:Rand
WinXP Files	ftpupd.exe, jmaix.exe, ysqpgpu.exe, vpdidob.exe, xhoxkm.exe, loyjf.exe, cyrgqf.exe, dbbciqtw.exe, gnost.exe, rbyag.exe, wajiww.exe, wcaad.exe, jddiifem.exe, zsrkyzyn.exe, caegvn.exe, skejjibg.exe, jhnuil.exe, vwhmdt.exe, sfhxqfvo.exe, wzbjpy.exe, lrzqcbb.exe, yfiqmxie.exe, otpwy.exe, phqghu.exe, uwrgfww.exe, qgora.exe, ulaaqu.exe, sushvslu.exe
WinXP Processes	CMD.EXE, CSRSS.EXE, EXPLORER.EXE, jmaix.exe, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE, ysqpgpu.exe, vpdidob.exe, loyjf.exe, dbbciqtw.exe, gnost.exe, rbyag.exe, wcaad.exe, jddiifem.exe, zsrkyzyn.exe, caegvn.exe, skejjibg.exe, jhnuil.exe, sfhxqfvo.exe, lrzqcbb.exe, yfiqmxie.exe, otpwy.exe, uwrgfww.exe, qgora.exe, ulaaqu.exe, sushvslu.exe
WinXP Registries	HKEY_LOCAL_MACHINE@...Microsoft\Wireless, HKEY_LOCAL_MACHINE@...Microsoft\\Wireless
WinXP Ports	5377, 4371, 4784, 6986, 549, 7767, 2365, 6076, 6977, 2170, 5406, 2489, 2692, 6641, 7727, 4778, 2934, 1459, 6685, 2292, 7691, 1031, 6308
Win-2Kf Files
Win-2Kf Processes
Win-2Kf Registries
Win-2Kf Ports
Create Events
Create Files
Create RegKeys	Cryptographic Service,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ID,Client
Open RegKeys	Cryptographic Service,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Software\Microsoft\Wireless,ID,Client
Service Starts
Service Deletes
Service Creates
Cluster
Cluster Confidence
Packer ID1	PolyEnE
Packer ID2
Embedded DNS
String Count	68
String Link	text
String MD5	cfa0c73c95b8c998ed0af13d826ea09f
Timerange	365 Days
Unpack Status	good (unpacked : 0 : Unpacking Provided Binary. (Code,Data) = (69.68%, 18.80%))
Countries	8
Unpacked Link	258fafe892 [0]
Callgraph	ASM:Graph
API Resolution	99%
Comment	none