Submission Summary:

• Submission details:
• Submission received: 3 October 2012, 04:20:01
• Processing time: 9 min 7 sec
• Submitted sample:
• File MD5: 0x4C6EC929C02E016E90CD95F15439F42C
• File SHA-1: 0x17032C08E87BD770C41C37567E72DCF7D0D83CE1
• Filesize: 90,279 bytes
• Alias:
• Backdoor.Darkmoon!gen7 [Symantec]
• BackDoor-DKI.gen.dg [McAfee]
• Win32.SuspectCrc [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	90,279 bytes	MD5: 0x4C6EC929C02E016E90CD95F15439F42C SHA-1: 0x17032C08E87BD770C41C37567E72DCF7D0D83CE1	Backdoor.Darkmoon!gen7 [Symantec] BackDoor-DKI.gen.dg [McAfee] Win32.SuspectCrc [Ikarus]

• The following Alternate Data Stream was created in the system:

#	ADS name(s)	ADS Size	ADS Hash	Alias
1	%Windir%\system32:mscrosslis.exe	90,279 bytes	MD5: 0x4C6EC929C02E016E90CD95F15439F42C SHA-1: 0x17032C08E87BD770C41C37567E72DCF7D0D83CE1	Backdoor.Darkmoon!gen7 [Symantec] BackDoor-DKI.gen.dg [McAfee] Win32.SuspectCrc [Ikarus]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Microsoft Menulist = "%Windir%\system32:mscrosslis.exe"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• m3333sher

• The following Host Name was requested from a host database:
• tw.2012yearleft.com

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 443: