Submission Summary:

• Submission details:
• Submission received: 20 March 2009, 19:44:50
• Processing time: 7 min 3 sec
• Submitted sample:
• File MD5: 0x19BFFA751AAFA9E63420203938A0D8A9
• File SHA-1: 0xFBE813C4D8F033A1B7533B716BAC512CCB0BA5C2
• Filesize: 99,840 bytes
• Alias:
• Backdoor.Win32.IRCBot.ibd [Kaspersky Lab]
• Worm:Win32/Pushbot.LE [Microsoft]
• VirTool.Win32.CeeInject [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\IXP000.TMP\testx.exe %Windir%\fxsteller.exe	48,690 bytes	MD5: 0x101F0D2201D43ABBD591DEE3FC7DA4C8 SHA-1: 0x4C6AA9E3E3EE20B8490B33DE7B3A1AEB296C2C77	Backdoor.Win32.IRCBot.ibd [Kaspersky Lab] Worm:Win32/Pushbot.LE [Microsoft] VirTool.Win32.CeeInject [Ikarus]
2	[file and pathname of the sample #1]	99,840 bytes	MD5: 0x19BFFA751AAFA9E63420203938A0D8A9 SHA-1: 0xFBE813C4D8F033A1B7533B716BAC512CCB0BA5C2	Backdoor.Win32.IRCBot.ibd [Kaspersky Lab] Worm:Win32/Pushbot.LE [Microsoft] VirTool.Win32.CeeInject [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directory was created:
• %Temp%\IXP000.TMP

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
fxsteller.exe	%Windir%\fxsteller.exe	311,296 bytes
testx.exe	%Temp%\IXP000.TMP\testx.exe	311,296 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	114,688 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Windows UDP Control Center = "fxsteller.exe"

so that fxsteller.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Israel

• To mark the presence in the system, the following Mutex object was created:
• hiddenrulzking

• The following ports were open in the system:

• The following Host Name was requested from a host database:
• msnrulz.hi5photos.us

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: