Submission Summary:

• Submission details:
• Submission received: 19 March 2009, 08:32:10
• Processing time: 7 min 58 sec
• Submitted sample:
• File MD5: 0x1CEEA3C99E0769B53D0597C1B5BFCD77
• File SHA-1: 0xFA8382476A15E65E4A4B3DF2175E4594512011FA
• Filesize: 64,512 bytes
• Alias:
• Trojan-Downloader.Win32.Banload.acfg [Kaspersky Lab]
• Trojan-Downloader.Win32.Banload [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\GbPluggin\svchost	3,168 bytes	MD5: 0x548F5D6FB0864DB742A7206A5201E192 SHA-1: 0x1FC8F1BA34DB56C4C02D5B38EAAD72990545D4CC	(not available)
2	[pathname with a string SHARE]\sharedapp.reg	124 bytes	MD5: 0x904F6AC9501EB4A4856E82EADA4DA3C9 SHA-1: 0x9DB518F005AD8A1B8F9E2B94C31CC68175B48E03	Trojan.Win32.Ciucio [Ikarus]
3	%Windir%\system\rockfeller.bat	273 bytes	MD5: 0x7575765A1A304414F957A36D7B99CBA1 SHA-1: 0xE373A662479C9857DE52093F27BA90AB8B75101E	(not available)
4	%Windir%\system\[filename of the sample #1] [file and pathname of the sample #1]	64,512 bytes	MD5: 0x1CEEA3C99E0769B53D0597C1B5BFCD77 SHA-1: 0xFA8382476A15E65E4A4B3DF2175E4594512011FA	Trojan-Downloader.Win32.Banload.acfg [Kaspersky Lab] Trojan-Downloader.Win32.Banload [Ikarus]
5	%System%\rockfeller.bat	279 bytes	MD5: 0x2053A34A0E003CAC1DE60CF55E5F6F13 SHA-1: 0x0D6E02445B91D84954350B18833222D7A491B66E	(not available)

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %ProgramFiles%\GbPluggin

Memory Modifications

• There were new processes created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• SharedAPPs = "%Windir%\system\[filename of the sample #1]"

so that [filename of the sample #1] runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• The following Internet downloads were started (the retrieved bits are saved into the local file):