Submission Summary:

• Submission details:
• Submission received: 16 July 2012, 08:38:11
• Processing time: 10 min 44 sec
• Submitted sample:
• File MD5: 0x12EBB38C8BB0C09EBD0B37D7C2A95E03
• File SHA-1: 0x1F9A524C72302BBC8AF78039A5687CD0306B52C0
• Filesize: 352,256 bytes
• Alias:
• Generic VB.ci [McAfee]
• Mal/VB-AD [Sophos]
• VirTool.Win32.VBInject [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\DATA\FILES\BEAST.exe [file and pathname of the sample #1]	352,256 bytes	MD5: 0x12EBB38C8BB0C09EBD0B37D7C2A95E03 SHA-1: 0x1F9A524C72302BBC8AF78039A5687CD0306B52C0	Generic VB.ci [McAfee] Mal/VB-AD [Sophos] VirTool.Win32.VBInject [Ikarus]
2	c:\DATA\FILES\Desktop.ini	62 bytes	MD5: 0x7457A5DF1FF47C957ACF1FA000D7D9AD SHA-1: 0x69D2BBA827FD4DE0169419A0FDA280252B348514	(not available)

• The following directories were created:
• c:\DATA
• c:\DATA\FILES

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	372,736 bytes
beast.exe	c:\data\files\beast.exe	372,736 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67KLN5J0-4OPM-01WE-AAX5-314CCA322142}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67KLN5J0-4OPM-01WE-AAX5-314CCA322142}]
• StubPath = "c:\DATA\FILES\BEAST.exe"

so that BEAST.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• beast.darkogard.com

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 5900: