Submission Summary:

• Submission details:
• Submission received: 15 July 2009, 09:45:34
• Processing time: 6 min 48 sec
• Submitted sample:
• File MD5: 0x2C078F0D98CE3822EEAE28321711ACFE
• File SHA-1: 0xF2AA64433719E81AECCD1086B20F4DE659712041
• Filesize: 15,360 bytes
• Packer info: packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Spy.Banker.ALR	Trojan.Spy.Banker.ALR steals personal information from an infected PC by monitoring users online activities including but not limited to login information and creditcard numbers which are subsequently sent to a remote server.

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\Assicen.dll	792,064 bytes	MD5: 0x6728270CB7DBB776ED086F5AC4C82310 SHA-1: 0xE913CC86F68627541DAE2A92509AB230F427E980	(not available)
2	%System%\Hatanem.dat	256 bytes	MD5: 0xB973CF5FF0E73B5F31D30287DFBDF9D5 SHA-1: 0xB25308EA04AD8876634D81B86714CA0C0D00C67A	(not available)
3	%System%\myInsDll.exe	33,280 bytes	MD5: 0x8358193945474F68A2D498CBED8EB97E SHA-1: 0xA905C9849147628387F6B1D5A7BF88FD5A64F15F	(not available)
4	%System%\Ntuscrb.dll	11,264 bytes	MD5: 0x7932ECE36C185F3A0D408D4F0169D867 SHA-1: 0x13132663E16CB5E4661F8A596EC7BED123C51F10	Infostealer.Onlinegame [Symantec] Mal/Behav-044 [Sophos] packed with PE_Patch.UPX [Kaspersky Lab]
5	[file and pathname of the sample #1]	15,360 bytes	MD5: 0x2C078F0D98CE3822EEAE28321711ACFE SHA-1: 0xF2AA64433719E81AECCD1086B20F4DE659712041	packed with PE_Patch.UPX [Kaspersky Lab]
6	%System%\sfc32.dll	133,120 bytes	MD5: 0xE8F132E41430A1EFD24282BE4DFF0723 SHA-1: 0x96FF851E5CC953D99950110F64D0DA8E67D9B215	Trojan-Spy.Banker.ALR [PCTools] PatchedSFC [McAfee]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\comres.dll

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
myInsDll.exe	%System%\myinsdll.exe	45,056 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	49,152 bytes

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
Ntuscrb.dll	%System%\Ntuscrb.dll	Process name: myInsDll.exe Process filename: %System%\myinsdll.exe Address space: 0x10000000 - 0x100FF000
sfc32.dll	%System%\sfc32.dll	Process name: myInsDll.exe Process filename: %System%\myinsdll.exe Address space: 0x76C60000 - 0x76C89000

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China