Report - CrySyS Lab

The module is capable to send emails, but also to receive emails from POP3 connection. It can send
basic information about the victim e.g. Computer Name, Operating system language, available
drives.
Module atl_4
Module atl_4 uses Mutex {119-36-FOOTBOLL-92}
It sets the target addresses for atl_3.through registry keys: EX S2 S1
The values to be used for user name and password for pop3 login are: bibi.lima/yergt37h for
host pop.laposte.net Another likely name/password pair is bine.bono/hdyw386k
Two corresponding email address also exists in the binary:
smtp.laposte.net and
Some host references can also be found, namely:
mail.zoznam.sk post.freemail.lt
politnews – n.txt
MD5 hash: 22dd42246ebec969e1a9c608793a644e
compile time: 2004-01-24
The size of the module is ~160k.
This module installs acxMonitor.exe and acxAgin.dll into the directory “c:\windows\system32”, then
installs a new key to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
namely “acxMonitor” pointing to “C:\WINDOWS\system32\acxMonitor.exe”
The MD5 hash of acxMonitor.exe is: 0b74db5420416129ce82c65c03df337e
The MD5 hash of acxAgin.dll is: c75f7a3a1d1695797e1a55e1200a6044
The compile time for the samples according to the binaries is: 1992-06-19
The output files are c:\sysdll2.txt and c:\sysdll8.txt, where the latter contains debug data related to
modem communications:
11:32:27 PM ATR0
11:32:28 PM ATDP**
11:32:33 PM OPEN LINK.....COM3
11:32:33 PM CHECK GDT.....OK
11:32:33 PM CHECK GDT.....OK
11:32:33 PM CHECK DT.....OFF
48