Cluster AY

10 samples (Win2K-f (50%)
WinXP (50%))


Ports
InfectionListenEgg-downloadUpload
135 (60%)1250 (70%)
135 (60%)
500 (50%)
1026 (50%)		1028 (71%)
1034 (29%)		43807 (29%)
44152 (29%)
Filenames
ProcessesExecutables
setupex.exe (70%)
MSMSGS.EXE (50%)		a (100%)
supu.exe (100%)
index.dat (60%)
fa4537ef.tmp (40%)
fe43e701.htm (40%)
feff35a0.htm (40%)

full list

random 7
character filename

Registry keys
...Microsoft\ProtectedStorageSystemProvider (100%)
...Software\SARS (100%)
...InternetSettings\5.0 (71%)
...InternetSettings\Connections (71%)

full list

Snort IDs
1:5001684 (100%)
1:99913 (100%)
1:3000004 (71%)
Network chatter
FTP
exec=supu.exe (100%)
pass=p (100%)
user=l (100%)
destport=1028 (40%)
Static analysis
MD5Antivirus labels
b47155... (80%)

diversity: 22.2%

full list

dumaru (100%)
ec1d (100%)
explet (100%)
mudrop (100%)
muldrop (100%)
multidropper (100%)

full list