Report - CrySyS Lab

Figure 44– Process Monitor shows that ocp.exe drops iepv.exe
The dropped file iepv.exe has the following hashes and compile time:
MD5 hash: 28c110b8d0ad095131c8d06043678086
SHA1 hash: c684cf321e890e0e766a97609a4cde866156d6c5
compile time: 2009-09-28 09:29:03
The file is packed with UPX, and its content is compiled with Microsoft Visual C++ 7.1. Its known
functionality is to reveal the passwords stored by IExplorer. The file has been submitted for analysis
to VirusTotal on March 8, 2013, and it is recognized by multiple anti-virus products.
oct.txt
MD5 hash: ba7f9a2cec106773d17df4f571b4b8e8
Identical with: planetnews_ct.ex
40