66.225.241.182

Remote Host Port Number
204.0.5.41 80
204.0.5.48 80
204.0.5.56 80
204.0.5.58 80
216.178.38.168 80
63.135.80.58 80
63.135.86.21 80
63.135.86.30 80
63.215.202.6 80
64.208.138.218 80
66.225.241.182 2345 PASS xxx

NICK NEW-[USA|00|P|20395]
USER XP-6912 * 0 :COMPUTERNAME
MODE NEW-[USA|00|P|20395] -ix
JOIN #!gf! test
PONG 22 MOTD
JOIN #USA

* The data identified by the following URLs was then requested from the remote web server:
o http://c2.ac-images.myspacecdn.com/images02/62/s_0644a0fa208843d99ba3052f4b5b1e2d.jpg
o http://c2.ac-images.myspacecdn.com/images02/119/s_3833714430eb4bb0b0b16b01e681eea1.jpg
o http://c2.ac-images.myspacecdn.com/images02/101/s_8fcfc0c9890745f188d56ee3fa7b15e1.png
o http://c2.ac-images.myspacecdn.com/images02/142/s_5a6197be2bc845eba5fa84125e03a54d.jpg
o http://c2.ac-images.myspacecdn.com/images02/148/s_cc021bff41b94642bc1e9423212f57fd.jpg
o http://c2.ac-images.myspacecdn.com/images02/116/s_545ae57a68b44e299b304677dc257a71.jpg
o http://c2.ac-images.myspacecdn.com/images02/100/s_01814ee89e8241c59118b5f1de3001dd.jpg
o http://c2.ac-images.myspacecdn.com/images01/63/s_65fef7498cf9d65dd907021bccd83f05.jpg
o http://c2.ac-images.myspacecdn.com/images02/102/s_563f2ef887054d29ae7c92ce686c0139.jpg
o http://c1.ac-images.myspacecdn.com/images02/91/s_7a9043587e134898ad7ada2f0769e9f0.jpg
o http://c1.ac-images.myspacecdn.com/images02/91/s_376097448eb94434b626a088c91835fc.jpg
o http://c1.ac-images.myspacecdn.com/images02/139/s_e717c8ed41fa407a99cda63130a194fc.jpg
o http://c1.ac-images.myspacecdn.com/images02/78/s_ef745b54658e4c95bf1e74900a36c814.jpg
o http://c1.ac-images.myspacecdn.com/images02/113/s_5622450adb4a4cf4954fbfc0bf176970.jpg
o http://c1.ac-images.myspacecdn.com/images02/57/s_f62742a70a1c408dbc713bec5bd4fe28.jpg
o http://c1.ac-images.myspacecdn.com/images02/136/s_e01e4faf54974300abc2b1bebc2e20ec.jpg
o http://c1.ac-images.myspacecdn.com/images02/36/s_40330d830619417294799cedc4238708.jpg
o http://c1.ac-images.myspacecdn.com/images02/120/s_ae5a7633e1a14cd8a0d7b0570a6c448c.jpg
o http://c1.ac-images.myspacecdn.com/images02/145/s_7d6dbda21fd74cc79ecdbd73e8bc9c7c.jpg
o http://c1.ac-images.myspacecdn.com/images02/148/s_7f206365dab2480f9707dac25a955344.jpg
o http://c1.ac-images.myspacecdn.com/images02/130/s_4a1c7440701a467d88ca5859759e3930.jpg
o http://c1.ac-images.myspacecdn.com/images02/84/s_9458a23b32d946aa8afc1c82f3fa69f0.jpg
o http://c4.ac-images.myspacecdn.com/images02/53/s_b47539ab50f64f278d6c8e8669bc94c3.jpg
o http://c4.ac-images.myspacecdn.com/images02/15/s_cb26ff99f78f4f99a4d408ba4637e9bb.jpg
o http://c4.ac-images.myspacecdn.com/images02/86/s_90a59cfd280344c9acb093a77790b1c7.jpg
o http://c4.ac-images.myspacecdn.com/images02/88/s_0b03a9b465e6486884dc7b1741bf9c73.jpg
o http://c4.ac-images.myspacecdn.com/images02/92/s_5fa96767fd28407ca057a753a8a6f47f.jpg
o http://c4.ac-images.myspacecdn.com/images02/47/s_b61673a1c93346c5b7d9a47598c4df7f.jpg
o http://c4.ac-images.myspacecdn.com/images02/126/s_30f1523d2a754b7e9c669d5e3727ac67.jpg
o http://c4.ac-images.myspacecdn.com/images02/139/s_08e9f48cfc3f458c8ab96989cffc3557.gif
o http://c4.ac-images.myspacecdn.com/images02/99/s_3703d090ddb14ba4a8add5ee134a023b.jpg
o http://c3.ac-images.myspacecdn.com/images02/150/s_7b86bc0d982241e0b109bf612b6a66aa.jpg
o http://c3.ac-images.myspacecdn.com/images02/127/s_85249ad022404c7084692ac762ee2f26.jpg
o http://c3.ac-images.myspacecdn.com/images02/119/s_7f1ae831b5d54834943b76d0fd5cd86e.jpg
o http://c3.ac-images.myspacecdn.com/images02/115/s_07a879367d794a95a45ba19087cd56f2.jpg
o http://c3.ac-images.myspacecdn.com/images02/106/s_83522203c18040219cf08e2810e49462.jpg
o http://c3.ac-images.myspacecdn.com/images01/25/s_089c4cce8a6b6bd50804fb5f7944a48e.jpg
o http://c3.ac-images.myspacecdn.com/images02/146/s_dfc2a5dfd93b4d5fa63d284327ddc292.jpg
o http://c3.ac-images.myspacecdn.com/images01/97/s_5b13b6970b7588d71b823e2bbc1f6b0a.jpg
o http://c3.ac-images.myspacecdn.com/images02/138/s_90cc99bfb3a34625a4cf888507c1cd56.jpg
o http://browseusers.myspace.com/Browse/Browse.aspx
o http://delb.opt.fimserve.com/adopt/?r=h&l=24000000&pos=leaderboard&rnd=226902419
o http://desk.opt.fimserve.com/adopt/?r=h&l=24000000&pos=skyscraper&rnd=226902419
o http://media.fastclick.net/w/get.media?sid=54674&tp=5&d=j&t=n
o http://media.fastclick.net/w/get.media?sid=54674&tp=5&d=j&t=n&no_cj_c=1&upsid=512052989590
o http://fim.adnxs.com/fpt?id=3594&size=160×600&flash=1&cookies=1&callback=C1Kk0Ap3Uv8H.b0Rw0Gg3Qo8Y&referrer=www.foxaudiencenetwork.com&age=&gender=&cb=1280493102604
o http://x.myspacecdn.com/Modules/Common/Static/img/cornersSheet3.png
o http://x.myspacecdn.com/modules/common/static/css/Sprites/globalNavRefreshSprite.png
o http://x.myspacecdn.com/modules/common/static/css/uploadcontrol_ioe1imsn.css
o http://x.myspacecdn.com/Modules/Splash/Static/img/bgSheet.png
o http://x.myspacecdn.com/modules/browse/static/img/btnicons_tiled.gif
o http://cms.myspacecdn.com/cms/js/ad_wrapper0153.js
o http://x.myspacecdn.com/modules/common/static/css/global_y5kcgkyi.css
o http://x.myspacecdn.com/modules/browse/static/css/browse_qiz4yewv.css
o http://x.myspacecdn.com/modules/profilesdirectory/static/css/browsebyname_4vb3esmf.css
o http://x.myspacecdn.com/modules/common/static/img/spacer.gif
o http://x.myspacecdn.com/modules/common/static/img/onlinenow2.gif
o http://x.myspacecdn.com/modules/splash/static/img/moduleBg.gif
o http://1.download.advertise.myspace.com/03/1f/bf/bd1fbf9e3437c71996a5000fd8a10312_final.jpg
o http://js.myspacecdn.com/modules/common/static/js/atlas/msglobal__7us4lzq.js
o http://js.myspacecdn.com/modules/browse/static/js/browsebundle_kwg2eboy.js
o http://js.myspacecdn.com/modules/common/static/js/jquery/tracking/tynt_zcvgeagv.js?user=bjNOt4bfyr35kFadbiUt4I&lang=en
o http://js.myspacecdn.com/modules/common/static/js/atlas/quickpost_a0c24hfu.js
o http://js.myspacecdn.com/modules/common/static/js/atlas/richtexteditor_uvm5sqtf.js
o http://bid.ace.advertising.com/bid/ebs=1/site=744646/size=728090/tags=1/callback=C1Fx6Sd0Mb9D.b0Zl6Lf0Kt9T/bnum=1280493102713
o http://bid.ace.advertising.com/ctst=1/bid/ebs=1/site=744646/size=728090/tags=1/callback=C1Fx6Sd0Mb9D.b0Zl6Lf0Kt9T/bnum=1280493102713
o http://p.ic.tynt.com/b/p?id=bjNOt4bfyr35kFadbiUt4I&ts=1280493103151&t=Browse%20MySpace%20Friends%20and%20Profiles
o http://www.google-analytics.com/ga.js
o http://googleads.g.doubleclick.net/pagead/test_domain.js
o http://pagead2.googlesyndication.com/pagead/show_ads.js
o http://pagead2.googlesyndication.com/pagead/render_ads.js
o http://ad.yieldmanager.com/getbid?Z=160×600&s=796250&_salt=1280493102604&u=http://www.foxaudiencenetwork.com&r=1&callback=C1Kk0Ap3Uv8H.b1Uq0Hj3Mh8B&cookie=1&flash=1&bvs=&hvs=BBJRUOOP
o http://ad.yieldmanager.com/getbid?Z=728×90&s=796250&_salt=1280493102713&u=http://www.foxaudiencenetwork.com&r=1&callback=C1Fx6Sd0Mb9D.b1Cu6Jj0Ok9Z&cookie=1&flash=1&bvs=&hvs=BBJRUOOP

Other details

* The following ports were open in the system:

Port Protocol Process
1057 TCP jusched.exe (%Windir%jusched.exe)
1092 TCP jusched.exe (%Windir%jusched.exe)

Registry Modifications

* The newly created Registry Values are:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionTerminal ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts

Memory Modifications

* There was a new process created in the system:

Process Name Process Filename Main Module Size
jusched.exe %Windir%jusched.exe 3 141 632 bytes

* The following system service was modified:

Service Name Display Name New Status Service Filename
wuauserv Automatic Updates “Stopped” %System%svchost.exe -k netsvcs

* Notes:
o %System% is a variable that refers to the System folder. By default, this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).

File System Modifications

* The following files were created in the system:

# Filename(s) File Size File Hash
1 %Windir%jusched.exe
[file and pathname of the sample #1] 106 496 bytes MD5: 0x6665B2838608D7DF014561809EF14B19
SHA-1: 0x707510D4A96DDC2B9242BAEB1D2858E282FF9110
2 %Windir%mdll.dl 2 222 bytes MD5: 0x0DD76BD4E53CF74097B6DA1682E24EAD
SHA-1: 0x511F5EB9D1301E0648B9A96F1ECA84116BEE9CE0
3 %Windir%wintybrd.png 3 416 bytes MD5: 0xD3A3A9391EA080EDFEF8BA202CC36D2E
SHA-1: 0xD771C5BA93DC6FC0438AF3FF1E909338F63EC283
4 %Windir%wintybrdf.jpg 3 968 bytes MD5: 0xE246233F7DCFE923D7A54F29B63CC30E
SHA-1: 0xB512DA23F7D01E8BD23133583103A83DC6D5C787

Categories: Uncategorized