Submission Summary:

• Submission details:
• Submission received: 18 November 2009, 14:05:42
• Processing time: 7 min 47 sec
• Submitted sample:
• File MD5: 0x2143A7B9A9DE6EA26987ED8ECE29D2C6
• File SHA-1: 0x30F6BEFC76E4E269E5AA9C01C735D55D7CA4099A
• Filesize: 65,024 bytes
• Alias:
• Trojan-PSW.Generic [PCTools]
• Infostealer [Symantec]
• Trojan.Win32.Cossta.byc [Kaspersky Lab]
• Generic.dx!grk [McAfee]
• Mal/Generic-A [Sophos]
• Trojan.Win32.Cossta [Ikarus]
• Win-Trojan/Malagent.65024 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\03452.tmp	9,216 bytes	MD5: 0xB7ACAD4042BCE5CA854FB3462BBBDFDB SHA-1: 0x83DF2938B0EB76B67B8E539A185833D423A6002A	Trojan.Generic [PCTools] Trojan Horse [Symantec] Trojan.Win32.Pincav.jza [Kaspersky Lab] Mal/Generic-A [Sophos] Trojan.Win32.Pincav [Ikarus]
2	%Temp%\03453.tmp %Programs%\Startup\iexplore.exe	82,944 bytes	MD5: 0x47BC140B217C76AD388116809A38CF26 SHA-1: 0x83935B34500F895340DA12DCFD2600F5911FC5D6	Trojan-PSW.Generic [PCTools] Infostealer [Symantec] Mal/Generic-A [Sophos] Trojan.Win32.Agent [Ikarus]
3	[file and pathname of the sample #1]	65,024 bytes	MD5: 0x2143A7B9A9DE6EA26987ED8ECE29D2C6 SHA-1: 0x30F6BEFC76E4E269E5AA9C01C735D55D7CA4099A	Trojan-PSW.Generic [PCTools] Infostealer [Symantec] Trojan.Win32.Cossta.byc [Kaspersky Lab] Generic.dx!grk [McAfee] Mal/Generic-A [Sophos] Trojan.Win32.Cossta [Ikarus] Win-Trojan/Malagent.65024 [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

• The following Alternate Data Stream was created in the system:

#	ADS name(s)	ADS Size	ADS Hash	Alias
1	c:\WINDOWS:EXPL0RER.exe	9,216 bytes	MD5: 0xB7ACAD4042BCE5CA854FB3462BBBDFDB SHA-1: 0x83DF2938B0EB76B67B8E539A185833D423A6002A	Trojan.Generic [PCTools] Trojan Horse [Symantec] Trojan.Win32.Pincav.jza [Kaspersky Lab] Mal/Generic-A [Sophos] Trojan.Win32.Pincav [Ikarus]

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
iexplore.exe	%Programs%\startup\iexplore.exe	126,976 bytes
03452.tmp	%Temp%\03452.tmp	16,384 bytes
03453.tmp	%Temp%\03453.tmp	126,976 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	143,360 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4E4E5D0B-37E1-91F4-CD41-8EFC8821861D}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4E4E5D0B-37E1-91F4-CD41-8EFC8821861D}]
• StubPath = "C:\WINDOWS:EXPL0RER.exe"

Other details

• To mark the presence in the system, the following Mutex object was created:
• )!VoqA.I4

• The following Host Name was requested from a host database:
• missgas.3322.org

• The data identified by the following URL was then requested from the remote web server:
• http://xiaoiboxip.appspot.com/fuck?hostname=COMPUTERNAME&&systemcpoy=WindowsXp&&userName=UserName