Submission Summary:

• Submission details:
• Submission received: 7 September 2012, 12:07:12
• Processing time: 7 min 52 sec
• Submitted sample:
• File MD5: 0x010CE99D5E16007057396A9EBDBD1F4B
• File SHA-1: 0x1F94F6CCF5B41AE612F739C6ADA8BAFED5D1F980
• Filesize: 54,784 bytes
• Alias:
• Downloader.Lofog!gen4 [Symantec]
• Trojan.Win32.Oficla.fjt [Kaspersky Lab]
• Mal/FakeAV-IU [Sophos]
• Trojan.Win32.Bamital [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonDocuments%\19792079	54,784 bytes	MD5: 0x010CE99D5E16007057396A9EBDBD1F4B SHA-1: 0x1F94F6CCF5B41AE612F739C6ADA8BAFED5D1F980	Downloader.Lofog!gen4 [Symantec] Trojan.Win32.Oficla.fjt [Kaspersky Lab] Mal/FakeAV-IU [Sophos] Trojan.Win32.Bamital [Ikarus]
2	%System%\dll	36,316 bytes	MD5: 0xD0EBA852E8602A21740F3B40594429C6 SHA-1: 0x06463FE5DA0FA760670B0EDF2FACD365C4F2C0D1	Backdoor.Win32.Shiz.dfc [Kaspersky Lab] Troj/Patched-Y [Sophos]
3	%System%\zx.dll	3,584 bytes	MD5: 0x7049917042D3BBFA152CB42EFD9F240B SHA-1: 0x4E9D0A1C45454ACD8E8B42FB62CC4AAF5CD15890	Trojan.Gen [Symantec] Trojan.Win32.Small.cmh [Kaspersky Lab] W32/Bamital.dll [McAfee] Troj/Patched-Y [Sophos] Trojan:Win32/Bamital.J [Microsoft] Backdoor.Win32.Shiz [Ikarus]
4	%Windir%\Temp\explorer.dat	1,032,192 bytes	MD5: 0xA0732187050030AE399B241436565E64 SHA-1: 0x69F33740413DA112630BE73EBB805A23B69F2F7F	(not available)
5	%Windir%\Temp\winlogon.dat	502,272 bytes	MD5: 0x01C3346C241652F43AED8E2149881BFE SHA-1: 0xA5396141CAB8B22D9D88B28A814089537DCE366A	(not available)

• Notes:
• %CommonDocuments% is a variable that refers to the file system directory that contains documents that are common to all users. A typical paths is C:\Documents and Settings\All Users\Documents.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
spoolsv.exe	%System%\spoolsv.exe	999,424 bytes

Registry Modifications

• The following Registry Value was deleted:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
• DisableSR = 0x00000001

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex object was created:
• Setup555

• The following Host Name was requested from a host database:
• 192.5.5.241