Submission Summary:

• Submission details:
• Submission received: 18 September 2012, 02:18:12
• Processing time: 8 min 5 sec
• Submitted sample:
• File MD5: 0x7C152B99D5F21E327F8A52044E5E4F81
• File SHA-1: 0x0BCA01AA4272517CE7DE9BA9CE43A492CDBD2D86
• Filesize: 84,480 bytes
• Alias:
• Trojan.Gen.2 [Symantec]
• VirTool:Win32/VBInject.gen!FA [Microsoft]
• Trojan.SuspectCRC [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\IXP000.TMP\xp-7.exe	53,248 bytes	MD5: 0xC86A4A9DC318B37D9823D36987F96BF3 SHA-1: 0x77D5FF3A62F641852C3BF18F9944083172DFB992	Trojan.Usuge!gen3 [Symantec] Generic VB.fl [McAfee] Mal/VBCheMan-C, Mal/VBCheMan-C [Sophos] VirTool:Win32/VBInject.OT [Microsoft] Trojan.SuspectCRC [Ikarus]
2	[file and pathname of the sample #1]	84,480 bytes	MD5: 0x7C152B99D5F21E327F8A52044E5E4F81 SHA-1: 0x0BCA01AA4272517CE7DE9BA9CE43A492CDBD2D86	Trojan.Gen.2 [Symantec] VirTool:Win32/VBInject.gen!FA [Microsoft] Trojan.SuspectCRC [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %Temp%\IXP000.TMP

Memory Modifications

• There were new processes created in the system:

• There were new memory pages created in the address space of the system process(es):

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• toki.exe = "%Temp%\IXP000.TMP\xp-7.exe"

so that xp-7.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Saudi Arabia

• To mark the presence in the system, the following Mutex object was created:
• )!VoqA.I4

• The following Host Names were requested from a host database:
• 192.5.5.241
• toooki.no-ip.biz

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %Temp%\ixp000.tmp\xp-7.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 3460: