Submission Summary:

• Submission details:
• Submission received: 19 August 2012, 03:43:35
• Processing time: 7 min 37 sec
• Submitted sample:
• File MD5: 0x43021DC3B0C97E038A5111C6B01D49E5
• File SHA-1: 0x12067801079186641AE1FBF156B3FC1508F88216
• Filesize: 245,760 bytes
• Alias:
• Trojan.Win32.VBKrypt.hcrb [Kaspersky Lab]
• Trojan.VB [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk

Description

Application.Savekeys_Keylogger

Savekeys is a keylogger which captures all your keystrokes and saves it in a file specified by the person who installed or else by default it stores in a file called log.txt. It also has an option for storing in an encrypted format in a file called 'Encrypted log.txt'. Apart from all the keystrokes it stores the window title of the various applications used, status of the capslock, numlock button etc. This keylogger software can be installed with password protection and made undetectable. We recommend that you should remove this application unless installed for a purpose.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\windows.exe [file and pathname of the sample #1]	245,760 bytes	MD5: 0x43021DC3B0C97E038A5111C6B01D49E5 SHA-1: 0x12067801079186641AE1FBF156B3FC1508F88216	Trojan.Win32.VBKrypt.hcrb [Kaspersky Lab] Trojan.VB [Ikarus]
2	%Windir%\Log.txt	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
windows.exe	%AppData%\windows.exe	266,240 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	266,240 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Security Center = "%AppData%\windows.exe"

so that windows.exe runs every time Windows starts

Other details

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %AppData%\windows.exe