Pattern JUL-AUGQ

50 samples (WinXP (64%)
Win2K-f (36%))


Ports
InfectionListenEgg-download
445 (88%)
135 (10%)
135 (40%)
500 (40%)
1026 (40%)
44445 (25%)
445 (68%)
1032 (34%)
1028 (30%)
Filenames
ProcessesExecutables
MSMSGS.EXE (68%)

random 5/6/7/8/9
character filename
ftpupd.exe (50%)
index.dat (43%)
o (29%)

random 8
character filename
Registry keys
...Microsoft\Wireless (61%)
...CurrentVersion\RunServices (35%)

full list

Snort IDs
1:5001684 (78%)
1:2001683 (66%)
1:2000032 (52%)
1:2466 (52%)
555:5555005 (52%)
1:99913 (46%)

full list

Network chatter
FTP
server=- (69%)
pass=1 (59%)
user=1 (44%)
exec=resource32w.exe (38%)
pass=a (38%)
user=a (34%)
Static analysis
MD5Antivirus labelsDomain
7d99b0... (16%)
2aa59b... (14%)
04af72... (6%)
0a0261... (6%)
7fdfe3... (6%)
97ac56... (6%)

full list

sdbot (59%)
linkbot (48%)
rbot (43%)
poebot (37%)
korgo (30%)
lsabot (30%)

full list

SOFTWARE\Classes\Applicat... (100%)
paypal.com (100%)
..έ..Π..Z..\ΠΡΡΡΡ..ΠΡΡX... (43%)

full list