Report - CrySyS Lab

NetScanFiles_2.jpg
hash: F445D90FDD7AB950ADABC79451E57E2A
compile time: 2012-07-19
This module scans mapped network shares for specific file names and writes their list into the file
“\ProgramData\Adobe\AdobeArm\sysdll2.txt”
The file names to be found include the follwoing: *saidumlo* *secret*.* *секрет*.* *парол*.*
*.xls *.pdf *.pgp *pass*.* *.rtf *.doc”
The collected file list consists of items formatted according to the following structure:
“[/N2.0-02.02.01.00:0000000032]\\SRV\share\a.xls 5 01.03.2013 06:43”
NetScanShares_2.jpg
hash: 696F408AF42071FBF1C60E6E50B60E09
compile time: 2012-07-19
This module enumerates network resources and writes its output into the file
“\ProgramData\Adobe\AdobeArm\sysdll2.txt”
The output contains Server, Share and Domain lists in use by the computer.
Interestingly, the binary contains leftover data that is not used, like the listing of interesting files:
“*saidumlo* *secret*.* *секрет*.* *парол*.* *.xls *.pdf *.pgp *pass*.* *.rtf *.doc”
SystemInfo_2.jpg
hash: 5C7BF0BB019B6C2DCD7DE61F89A2DE2E
compile time: 2012-07-19
This module obtains information about the victim system and its environment by executing the
following commands:
route print
netstat -r
netstat -b
netstat -a
systeminfo
wmic computersystem get * /format:list
wmic os get * /format:list
wmic logicaldisk get * /format:list
wmic product get * /format:list
wmic service get * /format:list
wmic process get * /format:list
wmic useraccount get * /format:list
wmic qfe get * /format:list
Output is written into “\ProgramData\Adobe\AdobeArm\sysdll2.txt”
32