Submission Summary:

• Submission details:
• Submission received: 28 July 2012, 03:51:22
• Processing time: 13 min 54 sec
• Submitted sample:
• File MD5: 0x16870AED0361A722760C42ACFB369E05
• File SHA-1: 0xAC60C23FD6E5D18C261C9FCC6C602D339B20AB1A
• Filesize: 414,456 bytes
• Alias:
• Backdoor.Trojan [Symantec]
• Trojan.Win32.Refroso [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\RGI6.tmp	85,018 bytes	MD5: 0x8DDC22056678464374DBD9BF8EFBFDA4 SHA-1: 0x59FB24832C6E73587B01D492D0932D20B45A0BBD	(not available)
2	%Windir%\linkinfo.dll	53,248 bytes	MD5: 0x08B1547672A359972E7038834AB18C9F SHA-1: 0xBAAD24272B5B13DC105112AEC20451508B86183F	W32.Almanahe.B!inf [Symantec] Virus.Win32.Agent.bu [Kaspersky Lab] W32/Almanahe.dll [McAfee] PE_CORELINK.C-O [Trend Micro] W32/Alman-E [Sophos] Trojan:Win32/Almanahe.B.dll [Microsoft] Trojan-Dropper.Agent [Ikarus] Win-Trojan/Agent.53248.GU [AhnLab]
3	%Windir%\Media\1.exe	233,472 bytes	MD5: 0x44E27F78BF16DA5FF7E611690238793C SHA-1: 0xF0A98F25AA13DC8E93D0C3289789E63BC4D3F31E	W32.Almanahe.B!inf [Symantec] Virus.Win32.Alman.b [Kaspersky Lab] W32/Almanahe.c [McAfee] PE_CORELINK.C-1 [Trend Micro] W32/Alman-C [Sophos] Virus:Win32/Almanahe.B [Microsoft] Virus.Win32.Alman [Ikarus] Win32/Alman.C [AhnLab]
4	%Windir%\Media\c.exe	119,714 bytes	MD5: 0xEFB49571A2E26DD4455D819C6BEE07BF SHA-1: 0x60A0FC81359C4A805256FA481500A947FD363300	Backdoor.Trojan [Symantec] Generic BackDoor.rb [McAfee] VirTool:Win32/VBInject.gen!EP [Microsoft] Trojan.Win32.Refroso [Ikarus]
5	[file and pathname of the sample #1]	414,456 bytes	MD5: 0x16870AED0361A722760C42ACFB369E05 SHA-1: 0xAC60C23FD6E5D18C261C9FCC6C602D339B20AB1A	Backdoor.Trojan [Symantec] Virus.Win32.Alman.b [Kaspersky Lab] Trojan.Win32.Refroso [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	217,088 bytes
c.exe	%Windir%\Media\c.exe	65,536 bytes

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Spain

• To mark the presence in the system, the following Mutex object was created:
• _SHuassist.mtx