Submission Summary:

• Submission details:
• Submission received: 29 October 2012, 21:28:42
• Processing time: 7 min 22 sec
• Submitted sample:
• File MD5: 0x16625F5EE30BA33945B807FB0B8B2F9E
• File SHA-1: 0xA9759E9000A04FE090B4F7CFA9DDE9B2C0947C54
• Filesize: 81,948 bytes

• Summary of the findings:

What's been found	Severity Level
Capability to steal information such personal financial data (credit card numbers, online banking login details), user profiles, software registration keys, passwords.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\WinRAR

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\WinRAR]
• HWID = 7B 34 30 33 38 42 31 34 44 2D 37 30 45 43 2D 34 38 45 34 2D 42 34 42 44 2D 38 39 31 37 44 31 43 37 41 34 32 41 7D

Other details

• The following Host Names were requested from a host database:
• 192.5.5.241
• ser.foryourcatonly.com
• ser.luckypetspetsitting.com
• dechotheband.gr
• barisdogalurunler.com
• alpertarimurunleri.com
• oneglobalexchange.com
• rumanas.org
• www.10130138.wavelearn.de
• visiosofttechnologies.com
• sgisolution.com.br
• plusloinart.be
• marengoit.pl

• The following HTTP URLs were started reading:
• http://dechotheband.gr/5Wjm3iV2.exe
• http://barisdogalurunler.com/9BMu2.exe
• http://alpertarimurunleri.com/rRq.exe
• http://oneglobalexchange.com/19J.exe
• http://rumanas.org/1vAWoxz3.exe
• http://www.10130138.wavelearn.de/4pxp.exe
• http://visiosofttechnologies.com/iDm9vs.exe
• http://sgisolution.com.br/jq5.exe
• http://plusloinart.be/Ue7cHNm.exe
• http://marengoit.pl/ZBrBpBh2.exe

Downloaded File Summary:

• Download details:
• Download retrieved: 29 October 2012 21:36:05
• Processing time: 6 min 19 sec
• Downloaded sample:
• File MD5: 0x2FC39B95A36BDD61C44BAAD205BCC2EC
• File SHA-1: 0x6C5AD5C09A25B95C819823E9AB2AFDE0008F596B
• Filesize: 90,471 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
system.exe	%AppData%\system\system.exe	86,016 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	40,960 bytes

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
• EnableLUA = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
• Update = "%AppData%\system\system.exe"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• Update = "%AppData%\system\system.exe"

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• To mark the presence in the system, the following Mutex object was created:
• zoie

• The following Host Names were requested from a host database:
• 192.5.5.241
• oftechnologies.co.in

• The following Internet download was started (the retrieved bits are saved into the local file):