Submission Summary:

• Submission details:
• Submission received: 24 September 2012, 04:38:04
• Processing time: 8 min 56 sec
• Submitted sample:
• File MD5: 0x70E875549F4DC0AC5E8A39D85E9AA436
• File SHA-1: 0xA007432FC0E07F06362D146AC19ECD66A5ECF829
• Filesize: 39,424 bytes
• Alias:
• Backdoor.IRC.Bot [Symantec]
• Worm.Win32.Ngrbot.lof [Kaspersky Lab]
• W32/IRCbot.gen.ay [McAfee]
• W32/Autorun-BTM [Sophos]
• Worm:Win32/Nayrabot.gen!A [Microsoft]
• Gen.Trojan.Heur [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\svhost.exe	39,424 bytes	MD5: 0x70E875549F4DC0AC5E8A39D85E9AA436 SHA-1: 0xA007432FC0E07F06362D146AC19ECD66A5ECF829	Backdoor.IRC.Bot [Symantec] Worm.Win32.Ngrbot.lof [Kaspersky Lab] W32/IRCbot.gen.ay [McAfee] W32/Autorun-BTM [Sophos] Worm:Win32/Nayrabot.gen!A [Microsoft] Gen.Trojan.Heur [Ikarus]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	57,344 bytes
svhost.exe	%AppData%\svhost.exe	57,344 bytes

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
explorer.exe	%Windir%\explorer.exe	57,344 bytes

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• svhost.exe = ""%AppData%\svhost.exe""

so that svhost.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• svhost.exe = ""%AppData%\svhost.exe""

so that svhost.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• botnet.gen.tr

• The data identified by the following URL was then requested from the remote web server:
• http://api.wipmania.com/

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: