Submission Summary:

• Submission details:
• Submission received: 15 August 2012, 21:07:53
• Processing time: 7 min 36 sec
• Submitted sample:
• File MD5: 0x69A166A23DE9C1AAA9CAE0CD0705CD5E
• File SHA-1: 0x08400BAC6CD01DBB9153CCC49CE0F408B65154B1
• Filesize: 113,519 bytes
• Packer info: packed with: PE_Patch [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\xtm1rltj1qdyy3mlalmtreidynyr2ulf2\svcnost.exe	113,519 bytes	MD5: 0x69A166A23DE9C1AAA9CAE0CD0705CD5E SHA-1: 0x08400BAC6CD01DBB9153CCC49CE0F408B65154B1	packed with PE_Patch [Kaspersky Lab]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following files were modified:
• %AppData%\desktop.ini
• %System%\drivers\etc\hosts

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %AppData%\xtm1rltj1qdyy3mlalmtreidynyr2ulf2

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svcnost.exe	%AppData%\xtm1rltj1qdyy3mlalmtreidynyr2ulf2\svcnost.exe	57,344 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	57,344 bytes

• Attention! The following processes were intentionally hidden from the user:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry]
• SavedLegacySettingsML = 38 35 38 30 34 30 30 38 36
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Windows Init = ""%AppData%\xtm1rltj1qdyy3mlalmtreidynyr2ulf2\svcnost.exe""

so that svcnost.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• LDR.ML.STARTED

• The HOSTS file was updated with the following URL-to-IP mappings:

• The following Host Names were requested from a host database:
• 89.149.243.23
• 217.20.127.39
• lced.ru
• 89.149.243.240
• 217.20.112.161