Submission Summary:

• Submission details:
• Submission received: 11 February 2009, 00:48:21
• Processing time: 6 min 18 sec
• Submitted sample:
• File MD5: 0x3E654A1D6D2C199B0B111870B31D30E1
• File SHA-1: 0xEF970549316D1DCA53F3616453C61AC41CB9DB6D
• Filesize: 49,152 bytes
• Alias:
• IRC.Backdoor.Trojan [Symantec]
• Trojan-Dropper.Win32.VB.iuj [Kaspersky Lab]
• Generic Dropper [McAfee]
• W32/Autorun-WT [Sophos]
• VirTool:Win32/VBInject.R [Microsoft]
• Virus.Win32.PePatch [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates desktop.ini system file in the fake Recycle Bin folder in order to register it in Windows as a valid Recycle Bin.
Creates an executable file in the fake Recycle Bin folder with the purpose of concealing its presence in the system.
Creates fake Recycle Bin folder.
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\699c4b9cdebca7aaea5193cae8a50098_a7bcc1a4-f7a4-4502-8650-8579e607f7f7	50 bytes	MD5: 0x5B63D4DD8C04C88C0E30E494EC6A609A SHA-1: 0x884D5A8BDC25FE794DC22EF9518009DCF0069D09	(not available)
2	c:\RECYCLER\k-1-3542-4232123213-7676767-8888886\Desktop.ini	62 bytes	MD5: 0x7457A5DF1FF47C957ACF1FA000D7D9AD SHA-1: 0x69D2BBA827FD4DE0169419A0FDA280252B348514	(not available)
3	c:\RECYCLER\k-1-3542-4232123213-7676767-8888886\r00t.exe [file and pathname of the sample #1]	49,152 bytes	MD5: 0x3E654A1D6D2C199B0B111870B31D30E1 SHA-1: 0xEF970549316D1DCA53F3616453C61AC41CB9DB6D	IRC.Backdoor.Trojan [Symantec] Trojan-Dropper.Win32.VB.iuj [Kaspersky Lab] Generic Dropper [McAfee] W32/Autorun-WT [Sophos] VirTool:Win32/VBInject.R [Microsoft] Virus.Win32.PePatch [Ikarus]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directory was created:
• c:\RECYCLER\k-1-3542-4232123213-7676767-8888886

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{23KLN5J0-4OPM-11WE-AAX5-24EF1F187332}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{23KLN5J0-4OPM-11WE-AAX5-24EF1F187332}]
• StubPath = "c:\RECYCLER\k-1-3542-4232123213-7676767-8888886\r00t.exe"

so that r00t.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• root.helldark.biz

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 3211: