Submission Summary:

• Submission details:
• Submission received: 4 November 2009, 17:19:16
• Processing time: 5 min 20 sec
• Submitted sample:
• File MD5: 0x50AC484D4775B783D70D87A21BBFAA36
• File SHA-1: 0x1D66B274813E58516F7105C5F75D069EF1D3E63A
• Filesize: 33,792 bytes
• Alias:
• Backdoor.Win32.Agent.amjz [Kaspersky Lab]
• Trojan-Dropper.Agent [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\1.tmp %System%\helh.oso	27,136 bytes	MD5: 0x6FDC2AED1A95E203461E16911837BFD1 SHA-1: 0x4B235F976A984FE5D6681A674CBFD7832B952A11	Trojan.Win32.Agent.dbed [Kaspersky Lab] Mal/Generic-A [Sophos] Trojan:Win32/Oficla.E [Microsoft]
2	[file and pathname of the sample #1]	33,792 bytes	MD5: 0x50AC484D4775B783D70D87A21BBFAA36 SHA-1: 0x1D66B274813E58516F7105C5F75D069EF1D3E63A	Backdoor.Win32.Agent.amjz [Kaspersky Lab] Trojan-Dropper.Agent [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid]
• url0 = 1E 9B 6D D8 89 E6 C4 47 70 EB 16 7E BA E0 E8 50 1F 8E 37 CB DD E6 86 4E 7D B4 15 7D FA F1 F2 48 76 11 FD 34 8C 2F 1B 02 C6 A4 E0 E1 B8 99 FF 08
• op = 0x00000001
• url1 = 68 74 74 70 3A 2F 2F 70 7A 64 75 6C 69 6E 61 2E 63 6E 2F 6D 79 6C 2F 62 62 2E 70 68 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
• url2 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://gamerszons.cn/dib-file.exe
• http://papaanarhia.cn/myl/bb.php?id=603225387&v=200&tm=2&b=01
• http://papaanarhia.cn/myl/bb.php?id=603225387&v=200&tm=2&b=01&tid=3&r=1