IMAGE12.zip / Trojan.Win32.Agent.xqq

[Malekal_morte]

Se propage par le fichier contenant le fichier IMAGE12.zip (se trouve dans %windir%) contenant le fichier IMAGE0012.JPG-www.facebook.scr

Message de propagation :

do you care if I post this picture on my new profile?
have you seen the last picture I created with photoshop?
I just found this wallpaper from the new Batman Movie, I think its PERFECT for you!
You missed out on the party! It was pretty intense, just take a look!
can I post this picture of you on my blog? Or would you get upset at me?

L'infection ajoute la ligne suivante sur HijackThis :

N/A

Fichier 0x04.exe reçu le 2008.08.05 10:05:20 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 6/36 (16.67%)
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.5.0 2008.08.05 -
AntiVir 7.8.1.15 2008.08.05 TR/ATRAPS.Gen
Authentium 5.1.0.4 2008.08.04 W32/Threat-SysVenFak-based!Maximus
Avast 4.8.1195.0 2008.08.05 -
AVG 8.0.0.156 2008.08.04 -
BitDefender 7.2 2008.08.05 -
CAT-QuickHeal 9.50 2008.08.04 -
ClamAV 0.93.1 2008.08.05 -
DrWeb 4.44.0.09170 2008.08.05 -
eSafe 7.0.17.0 2008.08.05 -
eTrust-Vet 31.6.6009 2008.08.05 -
Ewido 4.0 2008.08.04 -
F-Prot 4.4.4.56 2008.08.04 W32/Threat-SysVenFak-based!Maximus
F-Secure 7.60.13501.0 2008.08.05 -
Fortinet 3.14.0.0 2008.08.04 -
GData 2.0.7306.1023 2008.08.04 -
Ikarus T3.1.1.34.0 2008.08.05 -
K7AntiVirus 7.10.403 2008.08.04 -
Kaspersky 7.0.0.125 2008.08.05 -
McAfee 5353 2008.08.04 -
Microsoft 1.3807 2008.08.05 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3327 2008.08.05 -
Norman 5.80.02 2008.08.04 -
Panda 9.0.0.4 2008.08.04 -
PCTools 4.4.2.0 2008.08.04 -
Prevx1 V2 2008.08.05 Worm
Rising 20.56.11.00 2008.08.05 -
Sophos 4.31.0 2008.08.05 -
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.05 -
TheHacker 6.2.96.393 2008.08.04 -
TrendMicro 8.700.0.1004 2008.08.05 -
VBA32 3.12.8.2 2008.08.04 -
ViRobot 2008.8.4.1322 2008.08.04 -
VirusBuster 4.5.11.0 2008.08.04 -
Webwasher-Gateway 6.6.2 2008.08.05 Trojan.ATRAPS.Gen
Information additionnelle
File size: 53248 bytes
MD5...: f4f2c1a6ea2eefa0d00d681070a4ea57
SHA1..: 2092de0ad5021de046441a1ca05a307bca5faae2

[Malekal_morte]

Complete scanning result of "0x04.exe", processed in VirusTotal at 08/06/2008 12:02:09 (CET).

[ file data ]
* name..: 0x04.exe
* size..: 53248
* md5...: f4f2c1a6ea2eefa0d00d681070a4ea57
* sha1..: 2092de0ad5021de046441a1ca05a307bca5faae2
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.8.6.2/20080806 found nothing
AntiVir 7.8.1.15/20080806 found [TR/ATRAPS.Gen]
Authentium 5.1.0.4/20080805 found [W32/Threat-SysVenFak-based!Maximus]
Avast 4.8.1195.0/20080805 found nothing
AVG 8.0.0.156/20080806 found [BackDoor.Ircbot.FCO]
BitDefender 7.2/20080806 found nothing
CAT-QuickHeal 9.50/20080805 found nothing
ClamAV 0.93.1/20080806 found nothing
DrWeb 4.44.0.09170/20080806 found [Trojan.Inject.3688]
eSafe 7.0.17.0/20080805 found nothing
eTrust-Vet 31.6.6015/20080806 found nothing
Ewido 4.0/20080805 found nothing
F-Prot 4.4.4.56/20080805 found [W32/Threat-SysVenFak-based!Maximus]
F-Secure 7.60.13501.0/20080806 found [Trojan.Win32.Agent.xqq]
Fortinet 3.14.0.0/20080806 found nothing
GData 2.0.7306.1023/20080806 found [Trojan.Win32.Agent.xqq]
Ikarus T3.1.1.34.0/20080806 found [Trojan.ATRAPS]
K7AntiVirus 7.10.404/20080805 found nothing
Kaspersky 7.0.0.125/20080806 found [Trojan.Win32.Agent.xqq]
McAfee 5354/20080805 found nothing
Microsoft 1.3807/20080806 found [VirTool:Win32/DelfInject.gen!AF]
NOD32v2 3331/20080806 found [Win32/IRCBot.AAH]
Norman 5.80.02/20080806 found nothing
Panda 9.0.0.4/20080805 found nothing
PCTools 4.4.2.0/20080805 found nothing
Prevx1 V2/20080806 found [Worm]
Rising 20.56.22.00/20080806 found [Trojan.Win32.Host.eu]
Sophos 4.31.0/20080806 found nothing
Sunbelt 3.1.1537.1/20080806 found nothing
Symantec 10/20080806 found nothing
TheHacker 6.2.96.393/20080804 found nothing
TrendMicro 8.700.0.1004/20080806 found nothing
VBA32 3.12.8.2/20080805 found nothing
ViRobot 2008.8.5.1324/20080806 found nothing
VirusBuster 4.5.11.0/20080805 found nothing
Webwasher-Gateway 6.6.2/20080806 found [Trojan.ATRAPS.Gen]