Submission Summary:

• Submission details:
• Submission received: 29 November 2009, 02:19:55
• Processing time: 6 min 23 sec
• Submitted sample:
• File MD5: 0x6A9D209CE2B9AA39AC1C5BDA8E516840
• File SHA-1: 0x93C08F3CCC1F6DBA9187CD4634FB53A495469320
• Filesize: 167,936 bytes
• Alias:
• Spyware.Keylogger [PCTools]
• Spyware.Keylogger [Symantec]
• Trojan.Win32.VB.yoi [Kaspersky Lab]
• Generic VB.am [McAfee]
• Mal/Generic-A [Sophos]
• VirTool:Win32/VBInject.BQ [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.
MS04-012: DCOM RPC Overflow exploit - replication across TCP 135/139/445/593 (common for Blaster, Welchia, Spybot, Randex, other IRC Bots).
MS04-011: LSASS Overflow exploit - replication across TCP 445 (common for Sasser, Bobax, Kibuv, Korgo, Gaobot, Spybot, Randex, other IRC Bots).
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A spyware program that represents security risk for a local system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\bo4tlar.exe %System%\bssqnqen.exe	253,952 bytes	MD5: 0x582ED541D2D177C14A8CD0497F674C04 SHA-1: 0xE9AA724526ECF1A362FD6B68855CA853FB8592AD	Spyware.Keylogger [PCTools] Spyware.Keylogger [Symantec] Trojan.Win32.VB.yoi [Kaspersky Lab] Generic VB.am [McAfee] Mal/Generic-A [Sophos] VirTool:Win32/VBInject.BQ [Microsoft]
2	%Windir%\csrs.exe [file and pathname of the sample #1]	167,936 bytes	MD5: 0x6A9D209CE2B9AA39AC1C5BDA8E516840 SHA-1: 0x93C08F3CCC1F6DBA9187CD4634FB53A495469320	Spyware.Keylogger [PCTools] Spyware.Keylogger [Symantec] Trojan.Win32.VB.yoi [Kaspersky Lab] Generic VB.am [McAfee] Mal/Generic-A [Sophos] VirTool:Win32/VBInject.BQ [Microsoft]

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
csrs.exe	%Windir%\csrs.exe	331,776 bytes
bssqnqen.exe	%System%\bssqnqen.exe	778,240 bytes
bo4tlar.exe	c:\bo4tlar.exe	778,240 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Windows Services = "csrs.exe"
• Windows Service Agent = "bssqnqen.exe"

so that csrs.exe runs every time Windows starts
so that bssqnqen.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
• Windows Service Agent = "bssqnqen.exe"

so that bssqnqen.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run]
• Windows Services = "csrs.exe"

so that csrs.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Windows Service Agent = "bssqnqen.exe"

so that bssqnqen.exe runs every time Windows starts

Other details

• The following ports were open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://www.delicesevdam.net/botistan.exe

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

• There was an outbound traffic produced on port 6667: