Submission Summary:

• Submission details:
• Submission received: 13 August 2012, 09:02:35
• Processing time: 7 min 42 sec
• Submitted sample:
• File MD5: 0x6591831CAF499A2E33A2950166F45C2F
• File SHA-1: 0x270085BE6DAF8DCC50498A345BCD4A287FDB008D
• Filesize: 86,392 bytes
• Alias:
• Trojan.Dropper [Symantec]
• Packed.Win32.Krap.c [Kaspersky Lab]
• Downloader-ASH.gen.g [McAfee]
• Mal/EncPk-GT [Sophos]
• Backdoor:Win32/Farfli.K [Microsoft]
• Trojan.Win32.Hiloti [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\bits.dll	53,522 bytes	MD5: 0xDE6AAC383E414E361295EE7370BF63BD SHA-1: 0xD72F5E43C8548827E89B05F103741FE992F196FB	Backdoor.Trojan [Symantec] Trojan-Spy.Win32.Batton.aj [Kaspersky Lab] Backdoor:Win32/Zegost.Q [Microsoft] Trojan.Win32.Agent [Ikarus] packed with PE_Patch.RLPack [Kaspersky Lab]
2	[file and pathname of the sample #1]	86,392 bytes	MD5: 0x6591831CAF499A2E33A2950166F45C2F SHA-1: 0x270085BE6DAF8DCC50498A345BCD4A287FDB008D	Trojan.Dropper [Symantec] Packed.Win32.Krap.c [Kaspersky Lab] Downloader-ASH.gen.g [McAfee] Mal/EncPk-GT [Sophos] Backdoor:Win32/Farfli.K [Microsoft] Trojan.Win32.Hiloti [Ikarus]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
bits.dll	%System%\bits.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xA90000 - 0xAC2E68

• The following system service was modified:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
• (Default) =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
• (Default) =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• +Pf8+P35rq6vvLGxsLC8/fAFqLGxsLCe

• The following Host Names were requested from a host database:
• 192.5.5.241
• jinjok001.3322.org

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 3322: