Submission Summary:

• Submission details:
• Submission received: 25 October 2012, 13:09:15
• Processing time: 7 min 59 sec
• Submitted sample:
• File MD5: 0x1E09970C9BF2CA08EE48F8B2E24F6C44
• File SHA-1: 0x985B38B338A6B8371EA2179C4EDA3563F21F7082
• Filesize: 46,048 bytes
• Alias:
• Trojan Horse [Symantec]
• Trojan-Downloader.Win32.Agent.fziy [Kaspersky Lab]
• Generic Downloader.x!fid [McAfee]
• Mal/Generic-L [Sophos]
• Trojan-Dropper.Agent [Ikarus]

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\crsenvironscan2.xls	29,184 bytes	MD5: 0x1990C787E54A7E96E4CB550D83E9D3F4 SHA-1: 0x4131B026FC2D0285EE4AAC5000EA5A3B0455E78A	(not available)
2	%Temp%\svchost.exe	65,536 bytes	MD5: 0x90993B5279365B204148E8B04EDF477F SHA-1: 0x1D3DE34F6282D66F689F978855FA5EBBB123D0B4	Trojan Horse [Symantec] Trojan-Downloader.Win32.Agent.fziy [Kaspersky Lab] Generic Downloader.x!fid [McAfee] TrojanDownloader:Win32/Losews.A [Microsoft] Trojan-Dropper.Agent [Ikarus]
3	%Temp%\X60E	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	c:\RECYCLER\97109.tmp	46,048 bytes	MD5: 0x1E09970C9BF2CA08EE48F8B2E24F6C44 SHA-1: 0x985B38B338A6B8371EA2179C4EDA3563F21F7082	Trojan Horse [Symantec] Trojan-Downloader.Win32.Agent.fziy [Kaspersky Lab] Generic Downloader.x!fid [McAfee] Mal/Generic-L [Sophos] Trojan-Dropper.Agent [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svchost.exe	%Temp%\svchost.exe	86,016 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	16,384 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• AdobeUpdate = "%Temp%\svchost.exe"

so that svchost.exe runs every time Windows starts

Other details

• The following port was open in the system:

• The following Host Name was requested from a host database:
• 192.5.5.241

• There was registered attempt to establish connection with the remote host. The connection details are:

• The following Internet Connection was established:

• The following GET request was made:
• html/lost.html