Report - CrySyS Lab

screen capture is saved, it checks in every 40 seconds if the file “C:\sysdll5.txt” was deleted, and if so,
it makes and saves another screen capture.
2016_11.txt
hash: 3962E531A76BB6CA4F95D5CC5566311A
compile time: 2004-01-24
This module reads some specified files (names are hard-coded), compresses them, and saves the
result into temporary files, whose names look like hexadecimal numbers (e.g., “1F.tmp”). There are
similar modules with similar names (e.g., “2016\10.txt”) and functionality. The output is also written
in file “C:\sysdll9.txt” or in some cases in “C:\sysdll2.txt”. The output format is shown below:
Format is as below:
0000000000: 5B 4E 31 2E 36 2D 06 00 │ 2E 01 00 3A 33 00 00 00 [N1.6-♠ .☺ :3
0000000010: 2E 01 00 00 00 2E 01 00 │ 00 00 2E 2B 00 00 00 2E .☺ .☺ .+ .
0000000020: 61 56 65 72 3A 30 30 30 │ 31 3B 75 50 61 63 6B 65 aVer:0001;uPacke
0000000030: 64 53 69 7A 65 3A 30 30 │ 30 30 30 30 33 30 3B 43 dSize:00000030;C
0000000040: 52 43 3A 65 35 32 31 34 │ 30 35 64 5D 00 1B 82 EB RC:e521405d] ←‚ë
Figure 42– Output format of module 2016\11.txt
The files that our samples where looking for include the following:
D:\yazilar\beyaz okuz ve arab ata sozu(mahmut topbas).doc (2016\11.exe)
D:\yazilar\gazzedeki tunelin isigi sizsiniz.doc (2016\10.exe)
C:\Documents and Settings\user\Рабочий стол\Комерческие предложения\Ком
предложение общее (Елена Никитина).doc (201617\8.exe)
D:\yazilar\?з'e kapanmayla d??'a yamanma aras?nda…(yusuf kaplan).doc (201611\8.exe)
D:\yazilar\Cocuk yeti?tirmek (yavuz bahadiroglu).doc (201611\9.exe)
C:\Documents and Settings\user\Рабочий стол\пароль 696806.txt (201617\10.exe)
file “==================8