Submission Summary:

• Submission details:
• Submission received: 14 September 2012, 19:04:14
• Processing time: 8 min 59 sec
• Submitted sample:
• File MD5: 0x2600D6E2990EF4E3FDA203824BAE4F98
• File SHA-1: 0xCE56BD2BA0813CB74C383F6CC9575185710F154E
• Filesize: 57,344 bytes
• Alias:
• Backdoor.Trojan [Symantec]
• Backdoor.Win32.Rbot.adqd [Kaspersky Lab]
• W32/Virut.gen.a [McAfee]
• PE_VIRUT.AV [Trend Micro]
• W32/Virut-W [Sophos]
• Virus:Win32/Virut.AC [Microsoft]
• Net-Worm.Win32.Allaple [Ikarus]
• Win32/Virut.B [AhnLab]

• Summary of the findings:

What's been found	Severity Level
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.
MS04-012: DCOM RPC Overflow exploit - replication across TCP 135/139/445/593 (common for Blaster, Welchia, Spybot, Randex, other IRC Bots).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	57,344 bytes	MD5: 0x2600D6E2990EF4E3FDA203824BAE4F98 SHA-1: 0xCE56BD2BA0813CB74C383F6CC9575185710F154E	Backdoor.Trojan [Symantec] Backdoor.Win32.Rbot.adqd [Kaspersky Lab] W32/Virut.gen.a [McAfee] PE_VIRUT.AV [Trend Micro] W32/Virut-W [Sophos] Virus:Win32/Virut.AC [Microsoft] Net-Worm.Win32.Allaple [Ikarus] Win32/Virut.B [AhnLab]

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{346436FA-5138-50DA-D412-0870CE39768B}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{346436FA-5138-50DA-D412-0870CE39768B}\LocalServer32

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{346436FA-5138-50DA-D412-0870CE39768B}\LocalServer32]
• (Default) = "[file and pathname of the sample #1]"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{346436FA-5138-50DA-D412-0870CE39768B}]
• (Default) = "khvszreqnclltttj"

Other details

• To mark the presence in the system, the following Mutex object was created:
• jhdgcjhasgdc09890gjasgcjhg2763876uyg3fhg