Submission Summary:

• Submission details:
• Submission received: 27 August 2012, 22:16:47
• Processing time: 9 min 38 sec
• Submitted sample:
• File MD5: 0x3BB73A840B7846F74CD4DDA34171C8AC
• File SHA-1: 0x4BA2BA5FB7D37BB36D2F60CF0DCA9E82D0DC2566
• Filesize: 4,523,008 bytes
• Alias:
• Trojan.Gen.2 [Symantec]
• Worm:Win32/Braim.A [Microsoft]
• Worm.Win32.Braim [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\teste.txt	2 bytes	MD5: 0x81051BCC2CF1BEDF378224B0A93E2877 SHA-1: 0xBA8AB5A0280B953AA97435FF8946CBCBB2755A27	(not available)
2	%Temp%\teste.vbs	842 bytes	MD5: 0x2EFC5A10E85EBA3AEB42335F44847951 SHA-1: 0x594645C276A1931F6BEBF4B77873D6DB7DA53D39	(not available)
3	%System%\Language\Default.ini	15,273 bytes	MD5: 0xEE9826FD3883B9756896BAED5D076CC6 SHA-1: 0xD1C829CABCB967410E03489723D9E51B9549D6F6	(not available)
4	[file and pathname of the sample #1]	4,523,008 bytes	MD5: 0x3BB73A840B7846F74CD4DDA34171C8AC SHA-1: 0x4BA2BA5FB7D37BB36D2F60CF0DCA9E82D0DC2566	Trojan.Gen.2 [Symantec] Worm:Win32/Braim.A [Microsoft] Worm.Win32.Braim [Ikarus]
5	%System%\Settings\Settings.ini	1,597 bytes	MD5: 0x448A49C2D7253C927E820056E9E7EA8B SHA-1: 0xC7171C7B597BEEA4BB584319DDAC80EADEE5D3BE	(not available)
6	%System%\sqlite3.dll	175,104 bytes	MD5: 0x744DCC4CBBFBB18FE3878C4E769EC48F SHA-1: 0xC1F2C56EE2D91203A01D3465F185295477A1217D	packed with UPX [Kaspersky Lab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directories were created:
• %System%\Language
• %System%\Settings

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• To mark the presence in the system, the following Mutex objects were created:
• Spy-Net
• Pode mostrar essa merda
• _SHuassist.mtx

• The data identified by the following URL was then requested from the remote web server:
• http://www.ip-adress.com/