Submission Summary:

• Submission details:
• Submission received: 1 October 2012, 07:20:52
• Processing time: 12 min 43 sec
• Submitted sample:
• File MD5: 0x1586AC48B6D5C648C8120B02BE9A6EB0
• File SHA-1: 0xE3444299656C14D53DC95F901EC733B70C0F6AEB
• Filesize: 50,176 bytes
• Alias:
• Backdoor.Trojan [Symantec]
• Backdoor.Win32.Androm.a [Kaspersky Lab]
• Backdoor-FGP [McAfee]
• Worm:Win32/Gamarue.I [Microsoft]
• Trojan.Win32.Spy [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AllUsersProfile%\svchost.exe [file and pathname of the sample #1]	50,176 bytes	MD5: 0x1586AC48B6D5C648C8120B02BE9A6EB0 SHA-1: 0xE3444299656C14D53DC95F901EC733B70C0F6AEB	Backdoor.Trojan [Symantec] Backdoor.Win32.Androm.a [Kaspersky Lab] Backdoor-FGP [McAfee] Worm:Win32/Gamarue.I [Microsoft] Trojan.Win32.Spy [Ikarus]

• Note:
• %AllUsersProfile% is a variable that specifies the all users' profile folder. By default, this is C:\Documents and Settings\All Users (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
svchost.exe	%AllUsersProfile%\svchost.exe	20,480 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• SunJavaUpdateSched = "%AllUsersProfile%\svchost.exe"

so that svchost.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• 192.5.5.241