Submission Summary:

• Submission details:
• Submission received: 22 January 2008, 08:06:18
• Processing time: 3 min 28 sec
• Submitted sample:
• File MD5: 0x1E8F0BD55A0C1AB94514C077F3A9CA70
• Filesize: 32,768 bytes
• Alias:
• Backdoor.IRCBot [PCTools]
• W32.IRCBot [Symantec]
• W32/IRCbot.gen.b [McAfee]
• WORM_IRCBOT.CF [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Backdoor.IRCBot	Backdoor.IRCBot is a family of IRC backdoors allowing unauthorized access to an infected PC. It has the capability to spread over a network exploiting various Windows vulnerabilities.
Backdoor.Hupigon.GEN	Backdoor.Hupigon.GEN has rootkit functionality. It injects itself into Internet Explorer causing IE to hide itself. It also logs keystrokes and sends this information to remote servers.
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.
Trojan-Spy.Banpaes.J	Trojan.Spy.Banpaes.J is a trojan which monitors users Internet usage, collects all login information entered by users on banking or financial websites and then sends that information back to the author of the trojan.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\Startup\Microsoft Office.lnk	567 bytes	MD5: 0x5FA24DA5EE6A165FCE836C4CE3E10E05	(not available)
2	c:\Surat_Buat_Presiden.exe %Windir%\documents.exe %Windir%\SVCH0ST.exe %Windir%\svchost.exe [file and pathname of the sample #1] %Windir%\WINL0G0N.exe	32,768 bytes	MD5: 0x1E8F0BD55A0C1AB94514C077F3A9CA70	Backdoor.IRCBot [PCTools] W32.IRCBot [Symantec] W32/IRCbot.gen.b [McAfee] WORM_IRCBOT.CF [Trend Micro]
3	%Windir%\database.txt	55 bytes	MD5: 0xBEEB5F42A54B7F83BBC679CD166325BA	(not available)

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directories were created:
• %ProgramFiles%\Microsoft Office
• %ProgramFiles%\Microsoft Office\Office

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
WINL0G0N.exe	%Windir%\winl0g0n.exe	102,400 bytes
SVCH0ST.exe	%Windir%\svch0st.exe	102,400 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	102,400 bytes

• There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
srservice	System Restore Service	"Stopped"	%Windir%\svchost.exe

Registry Modifications

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot]
• AlternateShell = "%Windir%\svchost.exe"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
• AlternateShell = "%Windir%\svchost.exe"

Other details

• The following ports were open in the system:

• The following Host Name was requested from a host database:
• irc.librenet.net

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: