Submission Summary:

• Submission details:
• Submission received: 1 October 2012, 10:03:56
• Processing time: 9 min 31 sec
• Submitted sample:
• File MD5: 0x89EB94992FDE03FAE40E96E2D6DBE217
• File SHA-1: 0x424284F3BF23B236008BFD69F62E7FA58E96B605
• Filesize: 5,521,920 bytes
• Alias: Trojan.SuspectCRC [Ikarus]

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\DEJAVUCOMP\%ComputerName%1012012100542 ADEJAVU.jpeg	44,807 bytes	MD5: 0xB58F0B652F68225404E750FA423372DC SHA-1: 0x714A59E0C22F4CC0F21A84A02DFFC2B03FBBC6DB	(not available)
2	[file and pathname of the sample #1]	5,521,920 bytes	MD5: 0x89EB94992FDE03FAE40E96E2D6DBE217 SHA-1: 0x424284F3BF23B236008BFD69F62E7FA58E96B605	Trojan.SuspectCRC [Ikarus]
3	%Windir%\w4sdx.exe	2,029,568 bytes	MD5: 0xE26894150DCE2728236F7A13C1FDBD29 SHA-1: 0x0E436882F11C8FE92186ABDA128FBB982C74AB45	Win32.SuspectCrc [Ikarus]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directory was created:
• %Windir%\DEJAVUCOMP

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
• EnableLUA = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Frelense APP = "%Windir%\w4sdx.exe"

so that w4sdx.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Turkey

• The following port was open in the system:

• The following Host Name was requested from a host database:
• cokocokoho.hostpo.net

• The following Internet Connection was established:

• The following HTTP URLs were started reading:
• http://cokocokoho.hostpo.net/USKOKOXPADLARI.txt
• http://cokocokoho.hostpo.net/USKOKOXPLINKLERI.txt
• http://cokocokoho.hostpo.net/EUROKOADLAR.txt
• http://cokocokoho.hostpo.net/EUROKOLINLER.txt
• http://cokocokoho.hostpo.net/METINADLAR.txt
• http://cokocokoho.hostpo.net/METIN2LINKLER.txt
• http://cokocokoho.hostpo.net/SILKROADADLAR.txt
• http://cokocokoho.hostpo.net/SILKROADLINKLER.txt
• http://cokocokoho.hostpo.net/WOLFTEAMADLAR.txt
• http://cokocokoho.hostpo.net/WOLFTEAMLINKLER.txt
• http://cokocokoho.hostpo.net/English.txt
• http://cokocokoho.hostpo.net/Turkish.txt
• http://s3.dosya.tc/server/BlGplL/US_Heroinn_3_g_dnme_V_1_3_34.zip.html
• http://s3.dosya.tc/server2/5FShUy/NFKingdomKnigbot.rar.html
• http://s3.dosya.tc/server/CqufuU/OuikBotProjectv1896v1.3.exe.html