Submission Summary:

• Submission details:
• Submission received: 31 March 2009, 15:10:24
• Processing time: 7 min 27 sec
• Submitted sample:
• File MD5: 0x185A4EFA40739E0EB93C121BEF3FA20D
• File SHA-1: 0x17AF0E862B9D3B3BFC57A4DFAE47A6DDFF9FF9C5
• Filesize: 2,638,205 bytes
• Alias:
• Backdoor.Bifrose [Symantec]
• Packed.Win32.Black.a [Kaspersky Lab]
• Backdoor-CEP [McAfee]
• Mal/Behav-285 [Sophos]
• Virus.Win32.Bifrose [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Is protected with Themida in order to prevent the sample from being reverse-engineered. Themida protection can potentially be used by a threat to complicate the manual threat analysis (e.g. the sample would not run under the Virtual Machine).
Capability to terminate Antivirus, Firewall and other security related processes.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	2,638,205 bytes	MD5: 0x185A4EFA40739E0EB93C121BEF3FA20D SHA-1: 0x17AF0E862B9D3B3BFC57A4DFAE47A6DDFF9FF9C5	Backdoor.Bifrose [Symantec] Packed.Win32.Black.a [Kaspersky Lab] Backdoor-CEP [McAfee] Mal/Behav-285 [Sophos] Virus.Win32.Bifrose [Ikarus]

• The following directory was created:
• %System%\Computers

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\BIFROST1.2

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\BIFROST1.2]
• settings = 51 00 00 00 00 00 00 00 00 00 00 00 6D 79 70 61 73 73 00 00 00 00 00 00 00 00 00 00 61 64 64 6F 6E 2E 64 61 74 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Sweden

• To mark the presence in the system, the following Mutex objects were created:
• DBWinMutex
• BIFROST1.2

• The following port was open in the system:

Heuristics Analysis

• Heuristically identified capability to terminate the following security related processes: