Submission Summary:

• Submission details:
• Submission received: 14 July 2009, 15:21:20
• Processing time: 6 min 11 sec
• Submitted sample:
• File MD5: 0x65C2BC6576CDAEA78ECD65047B242CA8
• File SHA-1: 0x07ECA12723D8B4DA2D6C9E977BCA2FCEE2F0AA0F
• Filesize: 12,288 bytes
• Alias:
• Trojan.Dropper [Symantec]
• Trojan.Win32.Agent2.kum [Kaspersky Lab]
• Generic.dx!so [McAfee]
• Mal/Behav-112 [Sophos]
• TrojanDownloader:Win32/Bakted.A [Microsoft]
• Win32.SuspectCrc [Ikarus]
• Win-Trojan/Bakted.12288 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A program that downloads files to the local computer that may represent security risk
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\2903901426don.dll	6,144 bytes	MD5: 0x435ADC4E0B7BE6A8F8FC4F4E7E7D4AB6 SHA-1: 0xFBAC0822C8F9AAC4A17A22ABB4784644979510CC	Downloader [Symantec] Trojan-Spy.Win32.Gologger.20.c [Kaspersky Lab] Generic Downloader.x!id [McAfee] Mal/Generic-A [Sophos] TrojanDownloader:Win32/Small.MK [Microsoft] Win32.SuspectCrc [Ikarus] Win-Trojan/OnlineGameHack.6144.AH [AhnLab]
2	%Temp%\d.bat	106 bytes	MD5: 0x15C40C44E7BD1D8F2DE38D9185F0B3F0 SHA-1: 0x59B3B619ED9B8F4A06AA5A09E81714049820855A	(not available)
3	[file and pathname of the sample #1]	12,288 bytes	MD5: 0x65C2BC6576CDAEA78ECD65047B242CA8 SHA-1: 0x07ECA12723D8B4DA2D6C9E977BCA2FCEE2F0AA0F	Trojan.Dropper [Symantec] Trojan.Win32.Agent2.kum [Kaspersky Lab] Generic.dx!so [McAfee] Mal/Behav-112 [Sophos] TrojanDownloader:Win32/Bakted.A [Microsoft] Win32.SuspectCrc [Ikarus] Win-Trojan/Bakted.12288 [AhnLab]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• yahoo! = "%System%\rundll32.exe %Temp%\2903901426don.dll,Set"

so that 2903901426don.dll runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• The following HTTP URL was started reading:
• http://www.leadpod.net/task/sk5.exe;http://207.159.133.42/images/v2/sk5.exe;http://www.leadpod.net/task/21703.exe;http://207.159.133.42/images/v2/27031.exe;

• The data identified by the following URL was then requested from the remote web server:
• http://www.betheboss.it/Featured/FCKeditor/editor/edit.txt