| Packed MD5 | 557c0e256275860dbc8548c529f869c8 |
| Priority | 2 |
| First | 07/24/2008 |
| Last | 08/11/2008 |
| Count | 6 |
| History | 6 hits: 07-24 to 08-11 |
| Unpacked MD5 | |
| AV Hits | 22 |
| AV Count | 32 |
| CC Servers | 85.214.127.219:59999 |
| DNS Lookups | DE:skathari.oligarxia.com |
| Failed Connects | DE:85.214.127.219:59999 |
| AV Name | AhnLab-V3:Win-Agent.92684, AntiVir:TRBuzus.iij, Authentium:MISSED, Avast:MISSED, AVG:Downloader.Generic7.MPA, BitDefender:Downloader.Delf.OSQ, CAT-QuickHeal:MISSED, ClamAV:IRCBot-2743, DrWeb:DownLoader.62991, eSafe:MISSED, eTrust-Vet:MISSED, Ewido:IRCBot.dhr, FileAdvisor:MISSED, Fortinet:MISSED, F-Prot:MISSED, F-Secure:IRCBot.dhr, Ikarus:Crypt.XDR, Kaspersky:IRCBot.dhr, McAfee:MISSED, Microsoft:VirTool_DelfInject.gen!X, NOD32v2:Rbot, Norman:DLoader.HDXP, Panda:MISSED, Prevx1:MISSED, Rising:MISSED, Sophos:TrojIRCBot-ABP, Sunbelt:MISSED, Symantec:MISSED, TheHacker:BackdoorIRCBot.dhr, VBA32:IRCBot.dhr, VirusBuster:MISSED, Webwasher-Gateway:Buzus.iij |
| WinXP Files | |
| WinXP Processes | CMD.EXE, CSRSS.EXE, EXPLORER.EXE, LSASS.EXE, MSMSGS.EXE, msnupdater.exe, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE |
| WinXP Registries | HKEY_LOCAL_MACHINE@...CurrentVersion\RunServices, HKEY_USERS@...Software\ASProtect, HKEY_LOCAL_MACHINE@...CurrentVersion\\RunServices, HKEY_USERS@...Software\\ASProtect |
| WinXP Ports | 1034, 1034, 1134, 1210, 1366, 1957, 1999, 2013, 2062, 2071, 21740, 2280, 2285, 2443, 2453, 2470, 2471, 2472, 2473, 2474, 2475, 2476, 2477, 2478, 2479, 2480, 2481, 2482, 2483, 2484, 2485, 2486, 2487, 2488, 2489, 2490, 2491, 2492, 2493, 2494, 2495, 2496, 2497, 2498, 69, 1032, 1223, 1235, 1458, 1459, 1460, 1461, 1462, 1463, 1464, 1465, 1466, 1467, 1468, 1469, 1470, 1471, 1472, 1473, 1474, 1475, 1476, 1477, 1478, 1479, 1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487, 1488, 1489, 1490, 1491, 19683 |
| Win-2Kf Files | |
| Win-2Kf Processes | msnupdater.exe, drwtsn32.exe |
| Win-2Kf Registries | HKEY_LOCAL_MACHINE@...CurrentVersion\\RunServices, HKEY_USERS@...InternetSettings\\5.0, HKEY_USERS@...InternetSettings\\Connections, HKEY_USERS@...Software\\ASProtect |
| Win-2Kf Ports | 1027, 1030, 1521, 1522, 1523, 1524, 1525, 1526, 1527, 1528, 1529, 1530, 1531, 1532, 1533, 1534, 1535, 1536, 1537, 1538, 1539, 1540, 1541, 1542, 1543, 1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555, 1957, 29119, 69, 1032, 1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180, 1181, 1182, 1183, 1184, 1185, 1186, 1187, 1188, 1189, 1190, 1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198, 1199, 1200, 1201, 1202, 1203, 1204, 1205, 1206, 1207, 18670, 1208, 1209, 1210, 1211, 1212, 1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220, 1221, 1222, 1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 1236, 1237, 1238, 1239, 1240, 31601, 24762, 445, 1082 |
| Create Events | |
| Create Files | |
| Create RegKeys | |
| Open RegKeys | |
| Service Starts | |
| Service Deletes | |
| Service Creates | |
| Cluster | |
| Cluster Confidence | |
| Packer ID1 | none |
| Packer ID2 | none |
| Embedded DNS | |
| String Count | |
| String Link | text |
| String MD5 | |
| Timerange | 365 Days |
| Unpack Status | unknown () |
| Countries | 3 |
| Unpacked Link | none[none] |
| Callgraph | none:none |
| API Resolution | |
| Comment | none |