Submission Summary:

• Submission details:
• Submission received: 20 April 2009, 02:21:08
• Processing time: 7 min 12 sec
• Submitted sample:
• File MD5: 0x857FE3B30BC1F8A7EC4B73CB8DD38D3D
• File SHA-1: 0xE829CC3B64B831534B74D9C7BDCE5980CCBAE6DF
• Filesize: 47,104 bytes
• Alias:
• Rootkit.TDSS!sd6 [PCTools]
• Packed.Generic.200 [Symantec]
• Rootkit.Win32.TDSS.dnn [Kaspersky Lab]
• Generic.dx [McAfee]
• Mal/FakeVirPk-A [Sophos]
• Trojan:Win32/InternetAntivirus [Microsoft]
• Trojan.Win32.InternetAntivirus [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Rootkit.TDSS!sd6	Rootkit.TDSS!sd6 is a threat that relies on rootkit-specific techniques in order to hide its presence in the system.

• Attention! The following threat category was identified:

Threat Category	Description
	A code with the rootkit-specific techniques designed to hide the software presence in the system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	47,104 bytes	MD5: 0x857FE3B30BC1F8A7EC4B73CB8DD38D3D SHA-1: 0xE829CC3B64B831534B74D9C7BDCE5980CCBAE6DF	Rootkit.TDSS!sd6 [PCTools] Packed.Generic.200 [Symantec] Rootkit.Win32.TDSS.dnn [Kaspersky Lab] Generic.dx [McAfee] Mal/FakeVirPk-A [Sophos] Trojan:Win32/InternetAntivirus [Microsoft] Trojan.Win32.InternetAntivirus [Ikarus] Win-Trojan/Xema.variant [AhnLab]

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• IA3_ = ""[file and pathname of the sample #1]" 0;B;"

so that [file and pathname of the sample #1] runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• IA3_

• The data identified by the following URLs was then requested from the remote web server:
• http://xoomer.alice.it/bapeggs/file.exe
• http://xoomer.alice.it/bapeggs/InternetAntivirusPro.exe
• http://websscan.com/download/InternetAntivirusPro.exe
• http://websscan.com/download/file.exe