Submission Summary:

• Submission details:
• Submission received: 20 February 2010, 06:56:38
• Processing time: 6 min 11 sec
• Submitted sample:
• File MD5: 0x52B02B0CDBD9A636E952C47CC4E97637
• File SHA-1: 0xDD739556A42E8563784CB44BE0E1F1C7935396F5
• Filesize: 68,133 bytes
• Alias & packer info:
• Trojan.Win32.Refroso.aqlw [Kaspersky Lab]
• Win-Trojan/Buzus.98304.X [AhnLab]
• packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\WindowsUpdate\server.exe	33,018 bytes	MD5: 0x6C597E9143BAE6A0784FC37E01BF9D30 SHA-1: 0x9BB2F8F91EF285B5425D609D104893A9B07F16EC	Backdoor.Bifrose [PCTools] Backdoor.Bifrose [Symantec] Trojan.Win32.Refroso.aqlw [Kaspersky Lab] Troj/Bifrose-WC [Sophos]
2	%ProgramFiles%\WindowsUpdate\server.vbs	917 bytes	MD5: 0xE1610607336B9258A63C92AF8D42D37D SHA-1: 0x5A819F3D91F71D22ACDC3D37B7E00BC70811AD5F	HTML.Psyme.Gen [PCTools] VBS/Psyme [McAfee]
3	[file and pathname of the sample #1]	68,133 bytes	MD5: 0x52B02B0CDBD9A636E952C47CC4E97637 SHA-1: 0xDD739556A42E8563784CB44BE0E1F1C7935396F5	Trojan.Win32.Refroso.aqlw [Kaspersky Lab] Win-Trojan/Buzus.98304.X [AhnLab] packed with UPX [Kaspersky Lab]

• Note:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Memory Modifications

• There was a new process created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
wscript.exe	%System%\wscript.exe	172,032 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Croatia